jail

hi list,

i have build and test a run-jail for rsbac_jail.
i use the old adamantix-jail-configs for setup the jail than.
here you can download it. 
http://kasten-edv.de/download/rsbac/etc_rsbac_jail.tar.bz2
for this services exists a config 
http://kasten-edv.de/download/rsbac/etc_rsbac_jail/

when download it must to move the configfiles to
/etc/rsbac/jail

here is the configparser
http://svn.kasten-edv.de/svn/rsbac/trunk/lib/jail_configparser.py
and the script
http://svn.kasten-edv.de/svn/rsbac/trunk/bin/run-jail.py



the run-jail.py has this
# path to add where the file jail_configparser.py is
sys.path.append('/security/rsbac-manager/lib')
from jail_configparser import JailParser 

i did softlinking the run-jail.py to /bin/run-jail so the initscritp use only run-jail.

you have to sys.path.append to correct so the jail_configparser.py can be found.

than also the jail_flags should more complet.
this is in the moment only tested that apache2 will work.

self.jail_flags = {
                "allow-dev-read": "-d",
                "allow-dev-write": "-D",
                "allow-external-ipc": "-i",

                }

also this should be execute.
echo debug_jail_log_missing 1 > /proc/rsbac-info/debug 
echo debug_cap_log_missing 1 > /proc/rsbac-info/debug 


now i should have a possibility to test the jail for the apache2 
is not all perfect, but the config can easy modified so that only the
jail_configparser.py have to build new.
when i start apache2 it take a moment to ready to work.
i dont no why, but i see the parent process for apache2 is start and
the change the second one is take a while.

so far

grüsse
jens

_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac

--- apache2_orginal	2008-07-01 14:33:17.000000000 +0200
+++ apache2	2008-07-02 18:11:08.000000000 +0200
@@ -115,6 +115,8 @@
         	      fi
 		 done
 	fi
+	echo "sleeping a bit, otherwise the port is blocking from dieing apache"
+	sleep 2
 }
 
 # Stupid hack to keep lintian happy. (Warrk! Stupidhack!).
@@ -126,7 +128,9 @@
 		#ssl_scache shouldn't be here if we're just starting up.
 		[ -f /var/run/apache2/ssl_scache ] && rm -f /var/run/apache2/*ssl_scache*
 		log_begin_msg "Starting web server (apache2)..."
-		if $APACHE2CTL start; then
+#		if $APACHE2CTL start; then
+		$ENV run-jail apache2 /usr/sbin/apache2ctl start
+		if [ "$?" -eq 0 ]; then
                         log_end_msg 0
                 else
                         log_end_msg 1
@@ -148,7 +152,9 @@
                 fi
                 log_begin_msg "Reloading web server config..."
 		if pidof_apache; then
-                    if $APACHE2CTL graceful $2 ; then
+		    $ENV run-jail apache2 /usr/sbin/apache2ctl graceful reload
+                    #if $APACHE2CTL graceful $2 ; then
+		    if [ "$?" -eq 0 ]; then
                         log_end_msg 0
                     else
                         log_end_msg 1
@@ -160,7 +166,9 @@
 		if ! apache_sync_stop; then
                         log_end_msg 1
                 fi
-		if $APACHE2CTL start; then
+		$ENV run-jail apache2 /usr/sbin/apache2ctl start
+		if [ "$?" -eq 0 ]; then
+#		if $APACHE2CTL start; then
                         log_end_msg 0
                 else
                         log_end_msg 1