refactor core moving files to core/rootfs
move helper scripts to /opt/lib from /opt/bin therein refactor creating a user and installing UCI shellmaster
David Kebler
parent
d89001bc51
commit
f8d0c78bf6
|
|
@ -7,11 +7,13 @@
|
|||
%
|
||||
if ! { [ "$VERBOSE" = "core" ] || [ "$VERBOSE" = "all" ]; }; then unset VERBOSE; fi
|
||||
|
||||
echo "**************************************"
|
||||
echo "****** Building UCI Image Core ******"
|
||||
|
||||
echo copying core rootfs to image
|
||||
/bin/cp -R -f -p rootfs/. /
|
||||
. /opt/lib/verbose.lib
|
||||
|
||||
echo "**************************************"
|
||||
echo "****** Building UCI Image Core ******"
|
||||
quiet echo core build directory
|
||||
quiet pwd
|
||||
quiet ls -la
|
||||
|
|
|
|||
12
core/core.sh
12
core/core.sh
|
|
@ -10,6 +10,8 @@ if [[ -f ./build.env ]]; then
|
|||
source ./build.env
|
||||
fi
|
||||
source $LIB_DIR/verbose.lib
|
||||
|
||||
[[ -f ./custom-core.sh ]] && echo "sourcing custom core script" && source "./custom-core.sh"
|
||||
echo appending pkg commands to core_run.env
|
||||
echo appending sourcing of $ENV_DIR/run.env if it exists
|
||||
cat <<ENV >> /opt/core_run.env
|
||||
|
|
@ -21,14 +23,16 @@ quiet cat /opt/core_run.env
|
|||
mkdir -p /etc/profile.d
|
||||
echo creating login sourcing file for core_run.env in /etc/profile.d
|
||||
echo "source /opt/core_run.env" > /etc/profile.d/01-core-run-env.sh
|
||||
quiet ls -la /etc/profile.d
|
||||
|
||||
# if UCI_SHELL is set then USER must be login user
|
||||
[[ $USER_PW ]] && export USER=${USER:-host}
|
||||
if [[ $USER ]]; then
|
||||
export UHID=${UHID:-1000}
|
||||
chown -R -h $UHID:$UHID /opt $VOLUME_DIRS
|
||||
/bin/bash user.sh
|
||||
$LIB_DIR/user-create
|
||||
fi
|
||||
[[ $UCI_SHELL ]] && /bin/bash uci-shell.sh
|
||||
|
||||
[[ $UCI_SHELL ]] && $LIB_DIR/uci-shell
|
||||
quiet ls -la /etc/profile.d
|
||||
quiet cat /etc/profile
|
||||
ls -la /opt
|
||||
echo "done ------------- CORE INSTALLATION ------------"
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
# do not add code here for non-interative login shell
|
||||
# rather put additional non-interactive profile script code in files in /etc/profile.d
|
||||
|
||||
# this files is sourced for all login shells and also interactive non-login shells via /etc/bash.bashrc
|
||||
# more info see http://www.linuxfromscratch.org/blfs/view/svn/postlfs/profile.html
|
||||
|
||||
# interactive non-login and login shells will call the BASH_SHELL_LOAD script below
|
||||
# non-interative login shells only source /etc/profile.d
|
||||
# in profile.d is 03-startup.sh which will call
|
||||
# any of the scripts in a repo's startup subdirectory
|
||||
# non-interactive non-login shells are not handled here only via /etc/bash.bashrc
|
||||
# interactive login
|
||||
|
||||
|
||||
([ -n "$SSH_CONNECTION" ] || [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ]) && export SSH_SESSION=true
|
||||
[[ $- == *i* ]] && export SHELL_INTERACTIVE=true
|
||||
shopt -q login_shell && export SHELL_LOGIN=true
|
||||
[ $EUID -eq 0 ] && export USER_ROOT=true
|
||||
|
||||
# uncomment for debugging non-interactive login shell, i.e. $ . /etc/profile
|
||||
#unset SHELL_INTERACTIVE
|
||||
|
||||
#uncomment these for debugging.
|
||||
# echo ---- sourcing system /etc/profile ---
|
||||
# [[ $USER_ROOT ]] && echo 'Root User' || echo 'Non Root User'
|
||||
# [[ $SHELL_INTERACTIVE ]] && echo 'Interactive' || echo 'Not interactive'
|
||||
# [[ $SHELL_LOGIN ]] && echo 'Login shell' || echo 'Not login shell'
|
||||
# [[ $SSH_SESSION ]] && echo ssh remote user || echo local user
|
||||
# echo ---------------------
|
||||
|
||||
# Set the initial path
|
||||
export PATH=/bin:/usr/bin:/usr/local/bin
|
||||
# set directory for base shell repo
|
||||
export BASH_SHELL_BASE=/shell
|
||||
# now bootstrap by souring the shell repo envinroment
|
||||
source $BASH_SHELL_BASE/shell.env
|
||||
# set $BASH_SAFE_MODE=true in shell.env to disable UCI interactive shell from loading
|
||||
# TODO see if $NO_BASH_SHELL_SSH=true in user or host directory (at the remote machine)
|
||||
# if so don't source the load command below and make just a simple prompt.
|
||||
if [[ $SHELL_INTERACTIVE ]]; then
|
||||
if [[ ! $BASH_SAFE_MODE ]]; then
|
||||
# echo interactive shell loading $BASH_SHELL_LOAD
|
||||
source "$BASH_SHELL_LOAD"
|
||||
else
|
||||
# safe mode
|
||||
# just set a simple prompt instead
|
||||
NORMAL="\[\e[0m\]"
|
||||
RED="\[\e[1;31m\]"
|
||||
GREEN="\[\e[1;32m\]"
|
||||
YELLOW='\e[1;33m'
|
||||
if [[ $EUID == 0 ]] ; then
|
||||
PS1="${YELLOW}SAFE:$RED\u [ $NORMAL\w$RED ]# $NORMAL"
|
||||
else
|
||||
PS1="${YELLOW}SAFE:$GREEN \u [ $NORMAL\w$GREEN ]\$ $NORMAL"
|
||||
fi
|
||||
unset RED GREEN NORMAL YELLOW
|
||||
fi
|
||||
else
|
||||
# this is non-interactive login (e.g. at user machine login)
|
||||
if [[ $EUID -ne 0 ]] && [[ ! $SSH_SESSION ]]; then
|
||||
export LOGIN_LOG=$HOME/logs/login.log
|
||||
mkdir -p $HOME/logs
|
||||
touch $LOGIN_LOG
|
||||
llog () {
|
||||
echo "$@" >> $LOGIN_LOG 2>&1
|
||||
}
|
||||
export -f llog
|
||||
llog "$(env | grep BASH)"
|
||||
echo "$(date)" > $LOGIN_LOG
|
||||
llog "non-interactive login shell for $USER"
|
||||
if [ -d /etc/profile.d ]; then
|
||||
for i in /etc/profile.d/*.sh; do
|
||||
if [ -r $i ]; then
|
||||
llog "sourcing $i"
|
||||
source $i
|
||||
fi
|
||||
done
|
||||
unset i
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# root login setup only, put in if block
|
||||
if [ $EUID -eq 0 ] ; then # if root user
|
||||
echo login profile, root specific setup
|
||||
export PATH=$PATH:/sbin:/usr/sbin:/usr/local/sbin
|
||||
unset HISTFILE
|
||||
fi
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
# this runs startups for bash shell base system
|
||||
# don't run statup if user logs in via su
|
||||
if [ "$SHELL" = "/bin/bash" ] && [ "${BASH_SHELL_STARTUP}" ] && [ "$(ps -o comm= $PPID)" != "su" ]; then
|
||||
# uncomment for debugging
|
||||
if [[ -f $BASH_SHELL_STARTUP ]] && [[ $EUID -ne 0 ]]; then
|
||||
llog "sourcing startup script $BASH_SHELL_STARTUP"
|
||||
# (${BASH_SHELL_STARTUP}) &
|
||||
source ${BASH_SHELL_STARTUP}
|
||||
fi
|
||||
fi
|
||||
|
|
@ -1,18 +1,23 @@
|
|||
#!/bin/bash
|
||||
source /opt/core_run.env
|
||||
case "$1" in
|
||||
|
||||
cmd=$1
|
||||
|
||||
# [[ $DEVELOPMENT && $cmd == "${ENTRYPOINT_CMD:-start}" ]] && echo "development mode enabled, idling container" && cmd=idle
|
||||
|
||||
case "$cmd" in
|
||||
|
||||
maphostid)
|
||||
shift 1
|
||||
/bin/bash -l -c '$BIN_DIR/map-host-id $@' $0 "$@"
|
||||
/bin/bash -l -c '$:LIB_DIR/map-host-id $@' $0 "$@"
|
||||
;;
|
||||
idle)
|
||||
echo container put in idle mode, use docker terminal to access
|
||||
sleep infinity
|
||||
;;
|
||||
image)
|
||||
shift 1
|
||||
/bin/bash -l -c '$BIN_DIR/image-info $@' $0 "$@"
|
||||
/bin/bash -l -c '$LIB_DIR/image-info $@' $0 "$@"
|
||||
;;
|
||||
shell)
|
||||
shift 1
|
||||
|
|
@ -29,7 +34,7 @@ cat | /bin/bash -l
|
|||
;;
|
||||
${ENTRYPOINT_CMD:-start})
|
||||
shift 1
|
||||
/bin/bash -l -c '${ENTRYPOINT_CMD_PATH:-$BIN_DIR/start} $@' $0 "$@"
|
||||
/bin/bash -l -c '${ENTRYPOINT_CMD_PATH:-$BIN_DIR/${ENTRYPOINT_CMD:-start}} $@' $0 "$@"
|
||||
;;
|
||||
*)
|
||||
echo "--- command passed to container: $* ---"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,29 @@
|
|||
#!/bin/bash
|
||||
echo -e "\n------------ ADD UCI-SHELL ---------------"
|
||||
/bin/cp -R -f -p shell/. /shell
|
||||
ls -la /
|
||||
ls -ls /shell
|
||||
# mkdir -p /shell
|
||||
# _url=https://git.kebler.net/bash/shell-base.git
|
||||
# git clone $_url /shell
|
||||
|
||||
source /shell/base/install/install.sh
|
||||
usermod --shell /bin/bash root
|
||||
|
||||
if [[ $USER_PW ]]; then
|
||||
echo adding shell for login user $USER
|
||||
homedir=$( getent passwd "$USER" | cut -d: -f6 )
|
||||
mkdir -p $homedir/shell
|
||||
uci_bash_shell_install $USER
|
||||
chown -R :$USER /shell
|
||||
chmod -R g+r /shell
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /shell
|
||||
chown -R :host $homedir/shell
|
||||
chmod -R g+rw $homedir/shell
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /home/$USER/shell
|
||||
else
|
||||
uci_bash_shell_install
|
||||
fi
|
||||
|
||||
echo "----------- uci shell install complete ------"
|
||||
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
#!/bin/bash
|
||||
USER=${1:-$USER}
|
||||
USER_PW=${2-$USER_PW}
|
||||
UHID=${UHID:-1000}
|
||||
|
||||
# TODO make SUDO conditional on USER_SUDO=true
|
||||
|
||||
if [[ $USER ]]; then
|
||||
echo "------- Adding USER: $USER with ID: $UHID ------"
|
||||
|
||||
cat <<DOC >> /etc/login.defs
|
||||
SYS_UID_MAX $UHID"
|
||||
SYS_GID_MAX $UHID"
|
||||
DOC
|
||||
|
||||
source $LIB_DIR/verbose.lib
|
||||
# echo loading acl package
|
||||
# silence $INSTALL_PKGS acl
|
||||
groupadd -g $UHID $USER
|
||||
# user passwords implies system (sudo) login user
|
||||
|
||||
if [[ $USER_PW ]]; then
|
||||
echo "$USER is being created as a login user"
|
||||
useradd -rm -s /bin/bash -G $USER,$([[ $(getent group sudo) ]] && echo sudo || echo wheel) -g $USER -u $UHID $USER
|
||||
echo $USER groups: $(groups $USER)
|
||||
chpasswd <<< "${USER}:${USER_PW}"
|
||||
|
||||
# SUDOERS Setup
|
||||
cat <<SUDO >> /etc/sudoers.d/01-sudo-wheel
|
||||
Defaults lecture = never
|
||||
%wheel ALL=(ALL:ALL) ALL
|
||||
%sudo ALL=(ALL:ALL) ALL
|
||||
SUDO
|
||||
chmod 440 /etc/sudoers.d/01-sudo-wheel
|
||||
|
||||
cat <<USER >> /etc/sudoers.d/02-$USER
|
||||
$USER ALL = NOPASSWD:/bin/chown
|
||||
$USER ALL = NOPASSWD:/bin/chmod
|
||||
USER
|
||||
chmod 440 /etc/sudoers.d/02-$USER
|
||||
if [[ -f $USER-permits ]]; then
|
||||
echo "--- $USER-permits file supplied copying to /etc/sudoers.d ---"
|
||||
cat $USER-permits
|
||||
cat $USER-permits >> /etc/sudoers.d/02-$USER
|
||||
fi
|
||||
else
|
||||
echo $USER will be a non login user
|
||||
# home_dir=${USER_HOME:-/home/$USER}
|
||||
# mkdir -p $home_dir
|
||||
useradd -rM -s /sbin/nologin -G $USER -g $USER -u $UHID $USER -p '*' -d /dev/null
|
||||
# usermod -p '*' $USER
|
||||
# -d $home_dir
|
||||
# chown $USER:$USER $home_dir
|
||||
fi
|
||||
# shellcheck enable=add-default-case
|
||||
# chmod -R g+rw /opt
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /opt
|
||||
cat /etc/passwd | grep $USER
|
||||
id $USER
|
||||
echo "done------- Adding USER: $USER ------"
|
||||
|
||||
fi
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
#!/bin/bash
|
||||
echo -e "\n------------ ADD UCI-SHELL ---------------"
|
||||
mkdir -p /shell
|
||||
_url=https://git.kebler.net/bash/shell-base.git
|
||||
git clone $_url /shell
|
||||
source /shell/install/install.sh
|
||||
|
||||
|
||||
if [[ $USER_PW ]]; then
|
||||
echo adding shell for login user $USER
|
||||
mkdir -p /home/$USER/shell
|
||||
uci_bash_shell_install $USER
|
||||
chown -R $USER:$USER /shell
|
||||
chmod -R g+rw /shell
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /shell
|
||||
chown -R :host /home/$USER/shell
|
||||
chmod -R g+rw /home/$USER/shell
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /home/$USER/shell
|
||||
else
|
||||
uci_bash_shell_install
|
||||
fi
|
||||
|
||||
echo "----------- uci shell install complete ------"
|
||||
|
||||
58
core/user.sh
58
core/user.sh
|
|
@ -1,58 +0,0 @@
|
|||
#!/bin/bash
|
||||
USER=${1:-$USER}
|
||||
USER_PW=${2-$USER_PW}
|
||||
UHID=${UHID:-1000}
|
||||
|
||||
if [[ $USER ]]; then
|
||||
echo "------- Adding USER: $USER with ID: $UHID ------"
|
||||
|
||||
cat <<DOC >> /etc/login.defs
|
||||
SYS_UID_MAX $UHID"
|
||||
SYS_GID_MAX $UHID"
|
||||
DOC
|
||||
|
||||
source $LIB_DIR/verbose.lib
|
||||
# echo loading acl package
|
||||
# silence $INSTALL_PKGS acl
|
||||
groupadd -g $UHID $USER
|
||||
# user passwords implies system (sudo) login user
|
||||
if [[ $USER_PW ]]; then
|
||||
echo "login system user being created"
|
||||
useradd -rm -s /bin/bash -G $USER,$([[ $(getent group sudo) ]] && echo sudo || echo wheel) -g $USER -u $UHID $USER
|
||||
echo $USER groups: $(groups $USER)
|
||||
chpasswd <<< "${USER}:${USER_PW}"
|
||||
|
||||
# SUDOERS Setup
|
||||
cat <<SUDO >> /etc/sudoers.d/01-sudo-wheel
|
||||
Defaults lecture = never
|
||||
%wheel ALL=(ALL:ALL) ALL
|
||||
%sudo ALL=(ALL:ALL) ALL
|
||||
SUDO
|
||||
chmod 440 /etc/sudoers.d/01-sudo-wheel
|
||||
|
||||
cat <<USER >> /etc/sudoers.d/02-$USER
|
||||
$USER ALL = NOPASSWD:/bin/chown
|
||||
$USER ALL = NOPASSWD:/bin/chmod
|
||||
USER
|
||||
chmod 440 /etc/sudoers.d/02-$USER
|
||||
if [[ -f $USER-permits ]]; then
|
||||
echo "--- $USER-permits file supplied copying to /etc/sudoers.d ---"
|
||||
cat $USER-permits
|
||||
cat $USER-permits >> /etc/sudoers.d/02-$USER
|
||||
fi
|
||||
else
|
||||
home_dir=$([[ $USER_HOME ]] && echo "$USER_HOME" || echo "/opt/user" )
|
||||
mkdir -p $home_dir
|
||||
useradd -s /sbin/nologin -G $USER -g $USER -u $UHID $USER -d $home_dir
|
||||
chown $USER:$USER $home_dir
|
||||
fi
|
||||
# shellcheck enable=add-default-case
|
||||
# chmod -R g+rw /opt
|
||||
# setfacl -d --set u::rwx,g::rwx,o::- /opt
|
||||
cat /etc/passwd | grep $USER
|
||||
echo "done------- Adding USER: $USER ------"
|
||||
fi
|
||||
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue