First draft of chroot implementation for Debian

- RHEL chroot code has been moved into a bind::chroot::package class - Debian family (and probably other families) can use the `bind::chroot::manual` class to enable chroot for bind using the method described here: https://wiki.debian.org/Bind9#Bind_Chroot
2017-08-16 11:19:48 +02:00
parent bcaafc05e1
commit 44bb1b0e0e
14 changed files with 194 additions and 76 deletions
@@ -0,0 +1,60 @@
+class bind::chroot::manual(
+    $chroot_dir            = $::bind::defaults::chroot_dir,
+) inherits bind::defaults {
+    exec { 'mkdir-p-$chroot_dir':
+      command => "mkdir -p ${::bind::defaults::chroot_dir}",
+      path    => ['/bin', '/usr/bin'],
+      unless  => "test -d ${::bind::defaults::chroot_dir}",
+    }
+    # Creating system dirs under chroot dir:
+    file { ["${::bind::defaults::chroot_dir}",
+            "${::bind::defaults::chroot_dir}/etc",
+            "${::bind::defaults::chroot_dir}/dev",
+            "${::bind::defaults::chroot_dir}/var",
+            "${::bind::defaults::chroot_dir}/var/cache",
+            "${::bind::defaults::chroot_dir}/var/run"]:
+      ensure  => directory,
+      mode    => '0660',
+      require => Exec['mkdir-p-$chroot_dir'],
+    }
+
+    file { ["${::bind::defaults::chroot_dir}/var/cache/bind",
+            "${::bind::defaults::chroot_dir}/var/run/named"]:
+      ensure => directory,
+      mode   => '0775',
+      group  => $::bind::defaults::bind_group,
+      require => Exec['mkdir-p-$chroot_dir'],
+    }
+
+    exec { 'mknod-dev-null':
+      command => "mknod ${::bind::defaults::chroot_dir}/dev/null c 1 3",
+      path    => ['/bin', '/usr/bin'],
+      unless  => "test -d ${::bind::defaults::chroot_dir}/dev/null",
+    }
+    exec { 'mknod-dev-random':
+      command => "mknod ${::bind::defaults::chroot_dir}/dev/random c 1 8",
+      path    => ['/bin', '/usr/bin'],
+      unless  => "test -d ${::bind::defaults::chroot_dir}/dev/random",
+    }
+    exec { 'mknod-dev-urandom':
+      command => "mknod ${::bind::defaults::chroot_dir}/dev/urandom c 1 9",
+      path    => ['/bin', '/usr/bin'],
+      unless  => "test -d ${::bind::defaults::chroot_dir}/dev/urandom",
+    }
+    file { [ "${::bind::defaults::chroot_dir}/dev/null",
+             "${::bind::defaults::chroot_dir}/dev/random",
+             "${::bind::defaults::chroot_dir}/dev/urandom"]:
+      mode    => '0660',
+      require => [ Exec['mknod-dev-null'], Exec['mknod-dev-random'], Exec['mknod-dev-urandom'] ],
+    }
+    exec { 'mv-etc-bind-into-jailed-etc':
+        command => "mv ${::bind::defaults::confdir} ${::bind::defaults::chroot_dir}",
+        path    => ['/bin', '/usr/bin'],
+        unless  => "test -d ${::bind::defaults::chroot_dir}${::bind::defaults::confdir}",
+        require => [ File["${::bind::defaults::chroot_dir}/etc"] ]
+    }
+    #-> file { '/etc/bind':
+    #    ensure  => link,
+    #    target  => "${::bind::defaults::chroot_dir}/${::bind::defaults::confdir}",
+    #}
+}
@@ -0,0 +1,21 @@
+class bind::chroot::package(
+    $chroot_dir            = $::bind::defaults::chroot_dir,
+) inherits bind::defaults {
+    package { 'bind-chroot':
+      ensure  => latest,
+    }
+    service { 'bind':
+        ensure     => running,
+        name       => 'named-chroot',
+        enable     => true,
+        hasrestart => true,
+        hasstatus  => true,
+    }
+    # On RHEL Family, there is a dedicated service named-chroot and we need
+    # to stop/disable 'named' service:
+    service { 'bind-without-chroot':
+        ensure => stopped,
+        name   => $::bind::defaults::bind_service,
+        enable => false,
+    }
+}