containerize_me 0.1.1
Sign up to get free protection for your applications and to get access to all the features.
- data/.autotest +23 -0
- data/.gemtest +0 -0
- data/History.txt +12 -0
- data/Manifest.txt +19 -0
- data/README.txt +41 -0
- data/Rakefile +17 -0
- data/bin/containerize_me +99 -0
- data/lib/constants.rb +14 -0
- data/lib/containerize_me.rb +262 -0
- data/lib/cp_dep_libs.rb +21 -0
- data/lib/file.rb +24 -0
- data/templates/nginx.yaml +11 -0
- data/templates/ruby-enterprise-passenger.yaml +10 -0
- data/templates/ubuntu_mysqld.yaml +47 -0
- data/templates/ubuntu_rails_hosting_stack.yaml +36 -0
- data/templates/ubuntu_ruby18.yaml +17 -0
- data/templates/ubuntu_ruby191.yaml +22 -0
- data/templates/ubuntu_sshd.yaml +13 -0
- data/test/test_containerize_me.rb +13 -0
- metadata +97 -0
data/.autotest
ADDED
@@ -0,0 +1,23 @@
|
|
1
|
+
# -*- ruby -*-
|
2
|
+
|
3
|
+
require 'autotest/restart'
|
4
|
+
|
5
|
+
# Autotest.add_hook :initialize do |at|
|
6
|
+
# at.extra_files << "../some/external/dependency.rb"
|
7
|
+
#
|
8
|
+
# at.libs << ":../some/external"
|
9
|
+
#
|
10
|
+
# at.add_exception 'vendor'
|
11
|
+
#
|
12
|
+
# at.add_mapping(/dependency.rb/) do |f, _|
|
13
|
+
# at.files_matching(/test_.*rb$/)
|
14
|
+
# end
|
15
|
+
#
|
16
|
+
# %w(TestA TestB).each do |klass|
|
17
|
+
# at.extra_class_map[klass] = "test/test_misc.rb"
|
18
|
+
# end
|
19
|
+
# end
|
20
|
+
|
21
|
+
# Autotest.add_hook :run_command do |at|
|
22
|
+
# system "rake build"
|
23
|
+
# end
|
data/.gemtest
ADDED
File without changes
|
data/History.txt
ADDED
@@ -0,0 +1,12 @@
|
|
1
|
+
|
2
|
+
=== 0.1.1 / 2011-07-11
|
3
|
+
* Added ability to add users to a chroot jail which do not exists on the
|
4
|
+
system. This is good if one wants a user to be able to ssh into the jail
|
5
|
+
without any login capability outside of the jail.
|
6
|
+
|
7
|
+
=== 0.1.0 / 2011-07-11
|
8
|
+
|
9
|
+
* 1 major enhancement
|
10
|
+
|
11
|
+
* Birthday!
|
12
|
+
|
data/Manifest.txt
ADDED
@@ -0,0 +1,19 @@
|
|
1
|
+
.autotest
|
2
|
+
History.txt
|
3
|
+
Manifest.txt
|
4
|
+
README.txt
|
5
|
+
Rakefile
|
6
|
+
bin/containerize_me
|
7
|
+
lib/containerize_me.rb
|
8
|
+
lib/constants.rb
|
9
|
+
lib/file.rb
|
10
|
+
lib/cp_dep_libs.rb
|
11
|
+
test/test_containerize_me.rb
|
12
|
+
templates/ubuntu_rails_hosting_stack.yaml
|
13
|
+
templates/ubuntu_mysqld.yaml
|
14
|
+
templates/ubuntu_ruby191.yaml
|
15
|
+
templates/ubuntu_ruby18.yaml
|
16
|
+
templates/nginx.yaml
|
17
|
+
templates/ruby-enterprise-passenger.yaml
|
18
|
+
templates/ubuntu_sshd.yaml
|
19
|
+
|
data/README.txt
ADDED
@@ -0,0 +1,41 @@
|
|
1
|
+
= containerize_me
|
2
|
+
|
3
|
+
http://cyberconnect.biz/opensource
|
4
|
+
|
5
|
+
|
6
|
+
== DESCRIPTION:
|
7
|
+
|
8
|
+
Containerize Me is intended to provide a cross distro linux means for easily defining charactieristics of a chroot jail in yaml format. While there are other Linux tools out there aiming at delivering similar solutions often times they differ between distros. With containerize_me it's easy to get hosting setup in chroot jail's in a matter of minutes from any Linux distro.
|
9
|
+
|
10
|
+
== FEATURES:
|
11
|
+
|
12
|
+
* :copy_items Required YAML hash pointing to an array of files to copy over to the chroot environment.
|
13
|
+
* :depends_on Optional YAML configuration key referencing one or more dependancies. Dependancies may be may be nesed as many levels deep as long as there are no ciclic conditions.
|
14
|
+
* :mkdir: Optional YAML configuration key referencing an array of hashes where the has defines keys(:item, :user, :group, :mode)
|
15
|
+
|
16
|
+
|
17
|
+
== USAGE:
|
18
|
+
|
19
|
+
containerize_me --config <chroot yaml configuration file> --jail <full path to jail eg: /hosting/some_jail>
|
20
|
+
|
21
|
+
where <chroot yaml configuration file> defines the charicteristics of
|
22
|
+
the chroot environment being created. Items, such as which files are copied
|
23
|
+
over, and dependent yaml configuration files as well. See the templates directory
|
24
|
+
for examples.
|
25
|
+
|
26
|
+
|
27
|
+
|
28
|
+
== REQUIREMENTS:
|
29
|
+
|
30
|
+
* Linux
|
31
|
+
* jailkit
|
32
|
+
|
33
|
+
== INSTALL:
|
34
|
+
|
35
|
+
* Install jailkit: http://olivier.sessink.nl/jailkit/index.html#download
|
36
|
+
* gem install containerize_me
|
37
|
+
|
38
|
+
|
39
|
+
== LICENSE:
|
40
|
+
|
41
|
+
GPLv3: http://www.gnu.org/licenses/gpl.html
|
data/Rakefile
ADDED
@@ -0,0 +1,17 @@
|
|
1
|
+
# -*- ruby -*-
|
2
|
+
|
3
|
+
require 'rubygems'
|
4
|
+
require 'hoe'
|
5
|
+
|
6
|
+
# Hoe.plugin :compiler
|
7
|
+
# Hoe.plugin :gem_prelude_sucks
|
8
|
+
# Hoe.plugin :inline
|
9
|
+
# Hoe.plugin :racc
|
10
|
+
# Hoe.plugin :rubyforge
|
11
|
+
|
12
|
+
Hoe.spec 'containerize_me' do
|
13
|
+
developer('Cliff Cyphers', 'cliff.cyphers@gmail.com')
|
14
|
+
extra_deps << 'platform_helpers'
|
15
|
+
end
|
16
|
+
|
17
|
+
# vim: syntax=ruby
|
data/bin/containerize_me
ADDED
@@ -0,0 +1,99 @@
|
|
1
|
+
#!/usr/bin/env ruby
|
2
|
+
|
3
|
+
# Authod: Cliff Cyphers
|
4
|
+
# Published as part of the cyberconnect's platform mainly used
|
5
|
+
# in hosting rails applications.
|
6
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
7
|
+
|
8
|
+
|
9
|
+
|
10
|
+
base=File.expand_path(File.dirname(__FILE__) + '/..')
|
11
|
+
require 'getoptlong'
|
12
|
+
require base + '/lib/constants'
|
13
|
+
require base + '/lib/containerize_me.rb'
|
14
|
+
require 'yaml'
|
15
|
+
require 'open3'
|
16
|
+
require 'fileutils'
|
17
|
+
require 'find'
|
18
|
+
require 'rubygems'
|
19
|
+
require 'platform_helpers'
|
20
|
+
|
21
|
+
|
22
|
+
module Init
|
23
|
+
def usage
|
24
|
+
msg=<<-EOF
|
25
|
+
|
26
|
+
|
27
|
+
Usage:
|
28
|
+
containerize_me --config <chroot yaml configuration file> --jail <full path to jail: /hosting/some_jail>
|
29
|
+
|
30
|
+
where <chroot yaml configuration file> defines the charicteristics of
|
31
|
+
the chroot environment being created. Items, such as which files are copied
|
32
|
+
over, and dependent yaml configuration files as well. See the templates directory
|
33
|
+
for examples.
|
34
|
+
|
35
|
+
EOF
|
36
|
+
raise ArgumentError, msg
|
37
|
+
end
|
38
|
+
|
39
|
+
def valid?(cfg)
|
40
|
+
unless cfg.kind_of?(Hash)
|
41
|
+
raise ArgumentError, "Configuration yaml is expected to contain a hash format but found #{cfg.class}"
|
42
|
+
end
|
43
|
+
required_keys = { :system_binaries => {:type => Array, :required => false},
|
44
|
+
:other_files => {:type => Array, :required => false},
|
45
|
+
:copy_items => {:type => Array, :required => true},
|
46
|
+
:mkdir => {:type => Array, :required => false},
|
47
|
+
:depends_on => {:type => Array, :required => false},
|
48
|
+
:users => {:type => Array, :required => false} }
|
49
|
+
cfg.each_pair{ |k, v|
|
50
|
+
if required_keys.has_key?(k)
|
51
|
+
unless v.kind_of?(required_keys[k][:type])
|
52
|
+
raise ArgumentError, "Configuration for key #{k} is type #{v.class} but expected #{required_keys[k][:type]}"
|
53
|
+
end
|
54
|
+
required_keys.delete(k)
|
55
|
+
end
|
56
|
+
}
|
57
|
+
|
58
|
+
required_keys.each_pair { |k, v|
|
59
|
+
raise ArgumentError "Expected to find configuration key #{k}" if v[:required]
|
60
|
+
}
|
61
|
+
|
62
|
+
end
|
63
|
+
|
64
|
+
def config
|
65
|
+
opts = GetoptLong.new( [ '--config', '-c', GetoptLong::REQUIRED_ARGUMENT ],
|
66
|
+
['--jail', '-j', GetoptLong::REQUIRED_ARGUMENT ] )
|
67
|
+
cfg = {:cfg => nil, :jail => nil, :templates => nil}
|
68
|
+
begin
|
69
|
+
opts.each { |opt, arg|
|
70
|
+
case opt
|
71
|
+
when '--config'
|
72
|
+
raise StandardError, "config file not found: #{arg}" unless File.exists?(arg)
|
73
|
+
begin
|
74
|
+
cfg[:cfg] = YAML::load_file(arg)
|
75
|
+
cfg[:templates] = File.dirname(File.expand_path(arg))
|
76
|
+
rescue => e
|
77
|
+
raise StandardError, "\n\nUnable to parse yaml file. Use irb and\nrequire 'yaml'\nYAML::load_file(#{'arg'})\n\nto test out your configuration.\n\n"
|
78
|
+
end
|
79
|
+
when '--jail'
|
80
|
+
cfg[:jail] = arg
|
81
|
+
end
|
82
|
+
}
|
83
|
+
rescue => e
|
84
|
+
usage
|
85
|
+
end
|
86
|
+
Init.usage unless cfg[:cfg] && cfg[:jail] &&cfg[:templates]
|
87
|
+
Init.valid?(cfg[:cfg])
|
88
|
+
cfg
|
89
|
+
end
|
90
|
+
|
91
|
+
def run
|
92
|
+
cfg=config
|
93
|
+
Jail.module_eval { @config = Jail::Config.new(:cfg => cfg[:cfg], :jail => cfg[:jail], :templates => cfg[:templates]) }
|
94
|
+
Jail.perform
|
95
|
+
end
|
96
|
+
module_function :run, :config, :usage, :valid?
|
97
|
+
end
|
98
|
+
|
99
|
+
Init.run
|
data/lib/constants.rb
ADDED
@@ -0,0 +1,14 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
module Constants
|
8
|
+
module Errors
|
9
|
+
MISSING_JK = "jk_init not found as a system command. Ensure that you have jailkit installed and is in your path"
|
10
|
+
JAIL_NOT_WRITABLE = "Jail directory not writable or does not exists. Ensure that the user running the application has read, write and execute permissions on the directory where the jail resides."
|
11
|
+
JK_INIT_ERROR = "Issue running jk_init: "
|
12
|
+
NO_TMPL = "Template not found. Ensure that the templates defined in your config contain valid templates"
|
13
|
+
end
|
14
|
+
end
|
@@ -0,0 +1,262 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
base = File.expand_path(File.dirname(__FILE__))
|
8
|
+
require base + '/file'
|
9
|
+
require base + '/cp_dep_libs'
|
10
|
+
|
11
|
+
ENV['PATH'] += "/opt/cyberconnect/bin:/opt/cyberconnect/usr/bin:/opt/cyberconnect/sbin:/opt/cyberconnect/usr/sbin"
|
12
|
+
|
13
|
+
class ContainerizeMe
|
14
|
+
VERSION = '0.1.1'
|
15
|
+
end
|
16
|
+
class JailKitNotFoundError < StandardError ; end
|
17
|
+
class JailNotWritable < StandardError ; end
|
18
|
+
class NoJailDirectory < StandardError ; end
|
19
|
+
|
20
|
+
|
21
|
+
module Jail
|
22
|
+
class Config
|
23
|
+
attr_reader :jail, :dep_order, :cfg
|
24
|
+
def initialize(params={})
|
25
|
+
@cfg = params[:cfg]
|
26
|
+
@cfg[:system_binaries] ||= []
|
27
|
+
@cfg[:other_binaries] ||= []
|
28
|
+
@cfg[:copy_items] ||= []
|
29
|
+
|
30
|
+
@jail = params[:jail]
|
31
|
+
@templates = params[:templates]
|
32
|
+
@system_binaries = @cfg[:system_binaries]
|
33
|
+
@other_files = @cfg[:other_files]
|
34
|
+
@dep_order = []
|
35
|
+
order(@cfg)
|
36
|
+
end
|
37
|
+
|
38
|
+
def order(file)
|
39
|
+
if File.exists?("#{@templates}/#{file}")
|
40
|
+
cfg = YAML::load_file("#{@templates}/#{file}")
|
41
|
+
else
|
42
|
+
cfg = file
|
43
|
+
end
|
44
|
+
@dep_order << cfg unless @dep_order.include?(cfg)
|
45
|
+
if cfg.has_key?(:depends_on)
|
46
|
+
if cfg[:depends_on].kind_of?(Array)
|
47
|
+
cfg[:depends_on].each { |f| order(f) }
|
48
|
+
end
|
49
|
+
end
|
50
|
+
end
|
51
|
+
end
|
52
|
+
|
53
|
+
def exec(str)
|
54
|
+
res = ''
|
55
|
+
std_in, std_out, std_err = Open3::popen3(str)
|
56
|
+
puts std_out.read
|
57
|
+
err = std_err.read
|
58
|
+
err.each_line { |line|
|
59
|
+
next if "#{line}" =~ /empty, not checked/
|
60
|
+
res += line
|
61
|
+
}
|
62
|
+
res
|
63
|
+
end
|
64
|
+
def has_jailkit?
|
65
|
+
out=`which jk_init`
|
66
|
+
out.length > 0 ? true : false
|
67
|
+
end
|
68
|
+
def create
|
69
|
+
FileUtils.mkdir_p @config.jail unless File.directory?(@config.jail)
|
70
|
+
raise JailKitNotFoundError, Constants::Errors::MISSING_JK unless has_jailkit?
|
71
|
+
raise JailNotWritable, Constants::Errors::JAIL_NOT_WRITABLE unless File.writable?(@config.jail)
|
72
|
+
|
73
|
+
err = Jail.exec("jk_init -j #{@config.jail} jk_lsh")
|
74
|
+
if err.length != 0
|
75
|
+
raise StandardError, "#{Constants::Errors::JK_INIT_ERROR} #{err}"
|
76
|
+
end
|
77
|
+
true
|
78
|
+
end
|
79
|
+
|
80
|
+
# TODO: update to use following:
|
81
|
+
# jk_cp takes too long when copying large directory structures. Use
|
82
|
+
# FileUtils.cp_r first followed by cp_dep_libs to use jk_cp to copy over
|
83
|
+
# deps for executable and shared object items
|
84
|
+
def cp(item)
|
85
|
+
#=begin
|
86
|
+
if File.directory?(item)
|
87
|
+
dir = File.dirname(item)
|
88
|
+
begin
|
89
|
+
FileUtils.mkdir_p("#{@config.jail}#{dir}") unless File.directory?("#{@config.jail}#{dir}")
|
90
|
+
FileUtils.cp_r(item, "#{@config.jail}#{dir}", {:remove_destination => true})#, :preserve => true})
|
91
|
+
rescue => e
|
92
|
+
end
|
93
|
+
Jail.cp_dep_libs(item, @config.jail)
|
94
|
+
err = ''
|
95
|
+
else
|
96
|
+
#=end
|
97
|
+
err = Jail.exec("jk_cp -o -j #{@config.jail} #{item}")
|
98
|
+
end
|
99
|
+
FileUtils.clone_perms(item, @config.jail)
|
100
|
+
if err.length != 0
|
101
|
+
raise StandardError, "#{Constants::Errors::JK_INIT_ERROR} #{err}"
|
102
|
+
end
|
103
|
+
true
|
104
|
+
end
|
105
|
+
|
106
|
+
def add_common_items
|
107
|
+
files = []
|
108
|
+
common = %w(libnss libcurl)
|
109
|
+
common.each { |lib|
|
110
|
+
Find.find('/lib').each { |i| files << i if i =~ /#{lib}/ }
|
111
|
+
}
|
112
|
+
files
|
113
|
+
end
|
114
|
+
|
115
|
+
def user_in_jail?(user)
|
116
|
+
File.read(@config.jail + '/etc/passwd').grep(/^#{user}/).first != nil ? true : false
|
117
|
+
end
|
118
|
+
|
119
|
+
def group_in_jail?(gid)
|
120
|
+
File.read(@config.jail + '/etc/group').grep(/#{gid}:$/).first != nil ? true : false
|
121
|
+
end
|
122
|
+
|
123
|
+
|
124
|
+
# In order to preserve the system's /etc/passwd jailkit's jk_addjailuser is avoided.
|
125
|
+
# We only require that the user exists in the jail for all actions needed to host
|
126
|
+
# apps. Also, all other services(sshd, mysql, beanstalkd, etc) work fine
|
127
|
+
# using chroot with the --userspec. It's assumed system user's are not
|
128
|
+
# chrooted to a jail. A separate sshd process runs in the jail on a custom port
|
129
|
+
# and when a required jail user logs into that ssh instance they are confined to the jail.
|
130
|
+
# For this separation user's are added to the jail by grabbing the user info
|
131
|
+
# from /etc/passwd and appending to @config.jail/etc/passwd.
|
132
|
+
def add_user(user)
|
133
|
+
unless Jail.user_in_jail?(user)
|
134
|
+
system_users = File.read('/etc/passwd').split(/\n/).grep(/^#{user}/)
|
135
|
+
raise StandardError unless system_users.length == 1
|
136
|
+
user_info = system_users.first.split(':')
|
137
|
+
#Jail.cp(user_info[5])
|
138
|
+
|
139
|
+
fd = File.open(@config.jail + '/etc/passwd', 'a')
|
140
|
+
fd.puts system_users.first
|
141
|
+
fd.close
|
142
|
+
|
143
|
+
unless Jail.group_in_jail?(user_info[3])
|
144
|
+
group = File.read('/etc/group').grep(/:#{user_info[3]}:/).first
|
145
|
+
fd = File.open(@config.jail + '/etc/group', 'a')
|
146
|
+
fd.puts group
|
147
|
+
fd.close
|
148
|
+
end
|
149
|
+
end
|
150
|
+
true
|
151
|
+
end
|
152
|
+
|
153
|
+
def max_uid(passwd_file)
|
154
|
+
max = 0
|
155
|
+
raise ArgumentError unless File.exists?(passwd_file)
|
156
|
+
File.readlines(passwd_file).each { |l|
|
157
|
+
pass_entry = l.split(':')
|
158
|
+
next if pass_entry[2].to_i >= 65534
|
159
|
+
max = pass_entry[2].to_i if pass_entry[2].to_i > max
|
160
|
+
}
|
161
|
+
max
|
162
|
+
end
|
163
|
+
|
164
|
+
# add a user to the jail that's not in the root system's /etc/passwd
|
165
|
+
# assumes uid == gid
|
166
|
+
def add_user_not_in_root_system(user, uid=nil)
|
167
|
+
unless Jail.user_in_jail?(user)
|
168
|
+
uid ||= max_uid("#{@config.jail}/etc/passwd")+1
|
169
|
+
fd = File.open("#{@config.jail}/etc/passwd", 'a')
|
170
|
+
fd.puts "#{user}:x:#{uid}:#{uid}::/home/#{user}:/bin/bash"
|
171
|
+
fd.close
|
172
|
+
fd = File.open("#{@config.jail}/etc/group", 'a')
|
173
|
+
fd.puts "#{user}:x:#{uid}:"
|
174
|
+
fd.close
|
175
|
+
end
|
176
|
+
end
|
177
|
+
|
178
|
+
def process(cfg)
|
179
|
+
if cfg.kind_of?(Jail::Config)
|
180
|
+
cfg = @config.cfg
|
181
|
+
end
|
182
|
+
files = []
|
183
|
+
files += cfg[:system_binaries] if cfg[:system_binaries].kind_of?(Array)
|
184
|
+
files += cfg[:other_files] if cfg[:other_files].kind_of?(Array)
|
185
|
+
files += cfg[:copy_items] if cfg[:copy_items].kind_of?(Array)
|
186
|
+
files += Jail.add_common_items
|
187
|
+
files.each { |file| Jail.cp(file) }
|
188
|
+
if cfg.has_key?(:users)
|
189
|
+
cfg[:users].each { |user| Jail.add_user(user) } if cfg[:users].kind_of?(Array)
|
190
|
+
end
|
191
|
+
|
192
|
+
if cfg.has_key?(:mkdir)
|
193
|
+
if cfg[:mkdir].kind_of?(Array)
|
194
|
+
cfg[:mkdir].each { |dir|
|
195
|
+
d = "#{@config.jail}#{dir[:item]}"
|
196
|
+
FileUtils.mkdir_p d unless File.directory?(d)
|
197
|
+
if dir[:user].length > 0 && dir[:group].length > 0
|
198
|
+
FileUtils.chown(dir[:user], dir[:group], d)
|
199
|
+
FileUtils.chmod(dir[:mode], d) if dir.has_key?(:mode)
|
200
|
+
end
|
201
|
+
}
|
202
|
+
|
203
|
+
end
|
204
|
+
end
|
205
|
+
|
206
|
+
if cfg.has_key?(:symlinks)
|
207
|
+
if cfg[:symlinks].kind_of?(Array)
|
208
|
+
cfg[:symlinks].each { |i|
|
209
|
+
begin
|
210
|
+
i[:force] ||= nil
|
211
|
+
unless i.has_key?(:source) && i.has_key?(:destination)
|
212
|
+
raise StandardError, ":source and :destination must be provided when creating a symlink"
|
213
|
+
end
|
214
|
+
unless File.exists?i[:source]
|
215
|
+
raise StandardError, ":source file/directory not found"
|
216
|
+
end
|
217
|
+
if i[:force]
|
218
|
+
FileUtils.ln_sf(i[:source], "#{@config.jail}/#{i[:destination]}")
|
219
|
+
else
|
220
|
+
FileUtils.ln_s(i[:source], "#{@config.jail}/#{i[:destination]}")
|
221
|
+
end
|
222
|
+
rescue => e
|
223
|
+
p "issue creating symlink: #{e.inspect}"
|
224
|
+
end
|
225
|
+
}
|
226
|
+
end
|
227
|
+
end
|
228
|
+
|
229
|
+
if cfg.has_key?(:chown)
|
230
|
+
if cfg[:chown].kind_of?(Array)
|
231
|
+
cfg[:chown].each { |i|
|
232
|
+
begin
|
233
|
+
FileUtils.chown_R(i[:user], i[:group], "#{@config.jail}#{i[:item]}") if File.exists?("#{@config.jail}#{i[:item]}")
|
234
|
+
rescue => e
|
235
|
+
p "issue chown: #{e.inspect}"
|
236
|
+
end
|
237
|
+
}
|
238
|
+
end
|
239
|
+
end
|
240
|
+
|
241
|
+
if cfg.has_key?(:add_non_system_users)
|
242
|
+
if cfg[:add_non_system_users].kind_of?(Array)
|
243
|
+
cfg[:add_non_system_users].each { |user|
|
244
|
+
add_user_not_in_root_system(user)
|
245
|
+
}
|
246
|
+
end
|
247
|
+
end
|
248
|
+
|
249
|
+
|
250
|
+
end
|
251
|
+
|
252
|
+
def perform
|
253
|
+
if Jail.create
|
254
|
+
@config.dep_order.reverse.each { |i| process(i) }
|
255
|
+
process(@config)
|
256
|
+
end
|
257
|
+
end
|
258
|
+
|
259
|
+
module_function :create, :has_jailkit?, :cp, :exec, :add_user, :process, :perform
|
260
|
+
module_function :user_in_jail?, :add_common_items, :group_in_jail?, :max_uid, :add_user_not_in_root_system
|
261
|
+
end
|
262
|
+
|
data/lib/cp_dep_libs.rb
ADDED
@@ -0,0 +1,21 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
require 'find'
|
8
|
+
|
9
|
+
module Jail
|
10
|
+
def self.cp_dep_libs(src, jail_dir)
|
11
|
+
if File.directory?(src) && File.directory?(jail_dir)
|
12
|
+
Find.find(src) { |entry|
|
13
|
+
next if File.directory?(entry)
|
14
|
+
stat = File.stat(entry)
|
15
|
+
if entry =~ /\.so/ || stat.executable?
|
16
|
+
`jk_cp -f -j #{jail_dir} #{entry}`
|
17
|
+
end
|
18
|
+
}
|
19
|
+
end
|
20
|
+
end
|
21
|
+
end
|
data/lib/file.rb
ADDED
@@ -0,0 +1,24 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
require 'fileutils'
|
8
|
+
require 'find'
|
9
|
+
|
10
|
+
module FileUtils
|
11
|
+
def self.clone_perms(src, dest)
|
12
|
+
if File.directory?(src) && File.directory?(dest)
|
13
|
+
Find.find(src) { |entry|
|
14
|
+
next if entry =~ /^\/proc/
|
15
|
+
begin
|
16
|
+
stat = File.stat(entry)
|
17
|
+
FileUtils.chmod(stat.mode, "#{dest}#{entry}")
|
18
|
+
FileUtils.chown(stat.uid, stat.gid, "#{dest}#{entry}")
|
19
|
+
rescue => e
|
20
|
+
end
|
21
|
+
}
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /opt/cyberconnect/nginx
|
9
|
+
- /bin/sh
|
10
|
+
:users:
|
11
|
+
- www-data
|
@@ -0,0 +1,10 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:system_binaries:
|
8
|
+
- /usr/local/ruby-enterprise-1.8.7-2011.03/bin/ruby
|
9
|
+
:other_files:
|
10
|
+
- /usr/local/ruby-enterprise-1.8.7-2011.03
|
@@ -0,0 +1,47 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /usr/sbin/mysqld
|
9
|
+
- /usr/bin/mysqlhotcopy
|
10
|
+
- /bin/sh
|
11
|
+
- /etc/mysql
|
12
|
+
- /usr/share/mysql
|
13
|
+
- /usr/share/mysql-common
|
14
|
+
- /usr/bin/perl
|
15
|
+
- /usr/share/perl
|
16
|
+
- /usr/share/perl5
|
17
|
+
- /usr/lib/perl
|
18
|
+
- /usr/lib/perl5
|
19
|
+
- /var/lib/mysql/mysql
|
20
|
+
:mkdir:
|
21
|
+
- :item: /var/run/mysqld
|
22
|
+
:user: mysql
|
23
|
+
:group: root
|
24
|
+
- :item: /usr/lib/mysql
|
25
|
+
:user: mysql
|
26
|
+
:group: root
|
27
|
+
- :item: /usr/lib/mysql/plugin
|
28
|
+
:user: mysql
|
29
|
+
:group: root
|
30
|
+
- :item: /usr/local/share
|
31
|
+
:user: root
|
32
|
+
:group: root
|
33
|
+
:symlinks:
|
34
|
+
-
|
35
|
+
:source: /usr/lib/perl
|
36
|
+
:destination: /usr/local/lib/perl
|
37
|
+
:force: true
|
38
|
+
-
|
39
|
+
:source: /usr/share/perl
|
40
|
+
:destination: /usr/local/share/perl
|
41
|
+
:force: true
|
42
|
+
:users:
|
43
|
+
- mysql
|
44
|
+
:chown:
|
45
|
+
- :item: /var/lib/mysql
|
46
|
+
:user: mysql
|
47
|
+
:group: root
|
@@ -0,0 +1,36 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /usr/bin/beanstalkd
|
9
|
+
- /bin/uname
|
10
|
+
- /usr/bin/env
|
11
|
+
- /bin/sh
|
12
|
+
- /usr/bin/which
|
13
|
+
- /bin/bash
|
14
|
+
- /usr/bin/nohup
|
15
|
+
- /etc/debian_version
|
16
|
+
- /var/lib/gems/1.9.1/gems/passenger-3.0.8/
|
17
|
+
- /var/lib/gems/1.9.1/specifications/passenger-3.0.8.gemspec
|
18
|
+
:depends_on:
|
19
|
+
- ubuntu_mysqld.yaml
|
20
|
+
- ubuntu_sshd.yaml
|
21
|
+
- ubuntu_ruby191.yaml
|
22
|
+
- nginx.yaml
|
23
|
+
:mkdir:
|
24
|
+
- :item: /proc
|
25
|
+
:user: root
|
26
|
+
:group: root
|
27
|
+
:mode: 0755
|
28
|
+
- :item: /dev
|
29
|
+
:user: root
|
30
|
+
:group: root
|
31
|
+
:mode: 0755
|
32
|
+
- :item: /tmp
|
33
|
+
:user: root
|
34
|
+
:group: root
|
35
|
+
:mode: 0777
|
36
|
+
|
@@ -0,0 +1,17 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /usr/bin/ruby1.8
|
9
|
+
- /usr/bin/gem1.8
|
10
|
+
- /usr/local/lib/site_ruby
|
11
|
+
- /usr/lib/ruby/1.9.1
|
12
|
+
- /usr/lib/ruby/gems/1.8/
|
13
|
+
- /usr/lib/ruby/1.8
|
14
|
+
- /var/lib/gems/1.9.1
|
15
|
+
- /var/lib/gems/1.8
|
16
|
+
- /bin/sh
|
17
|
+
- /bin/bash
|
@@ -0,0 +1,22 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /usr/bin/ruby1.9.1
|
9
|
+
- /usr/bin/gem1.9.1
|
10
|
+
- /usr/local/lib/site_ruby
|
11
|
+
- /usr/lib/ruby/1.9.1
|
12
|
+
- /bin/sh
|
13
|
+
- /bin/bash
|
14
|
+
:symlinks:
|
15
|
+
-
|
16
|
+
:source: /usr/bin/ruby1.9.1
|
17
|
+
:destination: /usr/bin/ruby
|
18
|
+
:force: true
|
19
|
+
-
|
20
|
+
:source: /usr/bin/gem1.9.1
|
21
|
+
:destination: /usr/bin/gem
|
22
|
+
:force: true
|
@@ -0,0 +1,13 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
:copy_items:
|
8
|
+
- /usr/sbin/sshd
|
9
|
+
- /etc/ssh
|
10
|
+
- /bin/sh
|
11
|
+
- /bin/bash
|
12
|
+
:users:
|
13
|
+
- sshd
|
@@ -0,0 +1,13 @@
|
|
1
|
+
# Authod: Cliff Cyphers
|
2
|
+
# Published as part of the cyberconnect's platform mainly used
|
3
|
+
# in hosting rails applications.
|
4
|
+
# Licesnse: GPLv3: http://www.gnu.org/licenses/gpl.html
|
5
|
+
|
6
|
+
|
7
|
+
require "test/unit"
|
8
|
+
require "containerize_me"
|
9
|
+
|
10
|
+
class TestContainerizeMe < Test::Unit::TestCase
|
11
|
+
def test_sanity
|
12
|
+
end
|
13
|
+
end
|
metadata
ADDED
@@ -0,0 +1,97 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: containerize_me
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
prerelease:
|
5
|
+
version: 0.1.1
|
6
|
+
platform: ruby
|
7
|
+
authors:
|
8
|
+
- Cliff Cyphers
|
9
|
+
autorequire:
|
10
|
+
bindir: bin
|
11
|
+
cert_chain: []
|
12
|
+
|
13
|
+
date: 2011-08-23 00:00:00 Z
|
14
|
+
dependencies:
|
15
|
+
- !ruby/object:Gem::Dependency
|
16
|
+
name: platform_helpers
|
17
|
+
prerelease: false
|
18
|
+
requirement: &id001 !ruby/object:Gem::Requirement
|
19
|
+
none: false
|
20
|
+
requirements:
|
21
|
+
- - ">="
|
22
|
+
- !ruby/object:Gem::Version
|
23
|
+
version: "0"
|
24
|
+
type: :runtime
|
25
|
+
version_requirements: *id001
|
26
|
+
- !ruby/object:Gem::Dependency
|
27
|
+
name: hoe
|
28
|
+
prerelease: false
|
29
|
+
requirement: &id002 !ruby/object:Gem::Requirement
|
30
|
+
none: false
|
31
|
+
requirements:
|
32
|
+
- - ~>
|
33
|
+
- !ruby/object:Gem::Version
|
34
|
+
version: "2.12"
|
35
|
+
type: :development
|
36
|
+
version_requirements: *id002
|
37
|
+
description: Containerize Me is intended to provide a cross distro linux means for easily defining charactieristics of a chroot jail in yaml format. While there are other Linux tools out there aiming at delivering similar solutions often times they differ between distros. With containerize_me it's easy to get hosting setup in chroot jail's in a matter of minutes from any Linux distro.
|
38
|
+
email:
|
39
|
+
- cliff.cyphers@gmail.com
|
40
|
+
executables:
|
41
|
+
- containerize_me
|
42
|
+
extensions: []
|
43
|
+
|
44
|
+
extra_rdoc_files:
|
45
|
+
- History.txt
|
46
|
+
- Manifest.txt
|
47
|
+
- README.txt
|
48
|
+
files:
|
49
|
+
- .autotest
|
50
|
+
- History.txt
|
51
|
+
- Manifest.txt
|
52
|
+
- README.txt
|
53
|
+
- Rakefile
|
54
|
+
- bin/containerize_me
|
55
|
+
- lib/containerize_me.rb
|
56
|
+
- lib/constants.rb
|
57
|
+
- lib/file.rb
|
58
|
+
- lib/cp_dep_libs.rb
|
59
|
+
- test/test_containerize_me.rb
|
60
|
+
- templates/ubuntu_rails_hosting_stack.yaml
|
61
|
+
- templates/ubuntu_mysqld.yaml
|
62
|
+
- templates/ubuntu_ruby191.yaml
|
63
|
+
- templates/ubuntu_ruby18.yaml
|
64
|
+
- templates/nginx.yaml
|
65
|
+
- templates/ruby-enterprise-passenger.yaml
|
66
|
+
- templates/ubuntu_sshd.yaml
|
67
|
+
- .gemtest
|
68
|
+
homepage: http://cyberconnect.biz/opensource
|
69
|
+
licenses: []
|
70
|
+
|
71
|
+
post_install_message:
|
72
|
+
rdoc_options:
|
73
|
+
- --main
|
74
|
+
- README.txt
|
75
|
+
require_paths:
|
76
|
+
- lib
|
77
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
78
|
+
none: false
|
79
|
+
requirements:
|
80
|
+
- - ">="
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: "0"
|
83
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
84
|
+
none: false
|
85
|
+
requirements:
|
86
|
+
- - ">="
|
87
|
+
- !ruby/object:Gem::Version
|
88
|
+
version: "0"
|
89
|
+
requirements: []
|
90
|
+
|
91
|
+
rubyforge_project: containerize_me
|
92
|
+
rubygems_version: 1.8.8
|
93
|
+
signing_key:
|
94
|
+
specification_version: 3
|
95
|
+
summary: Containerize Me is intended to provide a cross distro linux means for easily defining charactieristics of a chroot jail in yaml format
|
96
|
+
test_files:
|
97
|
+
- test/test_containerize_me.rb
|