mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-21 06:45:29 -06:00
69 lines
2.5 KiB
Bash
Executable file
69 lines
2.5 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
brctl addbr br0
|
|
ifconfig br0 10.10.20.1/29 up
|
|
# NAT masquerade
|
|
iptables -t nat -A POSTROUTING -o eth0 -s 10.10.20.0/29 -j MASQUERADE
|
|
# port forwarding
|
|
# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 10.10.20.2:80
|
|
|
|
brctl addbr br1
|
|
ifconfig br1 10.10.30.1/24 up
|
|
brctl addbr br2
|
|
ifconfig br2 10.10.40.1/24 up
|
|
brctl addbr br3
|
|
ifconfig br3 10.10.50.1/24 up
|
|
brctl addbr br4
|
|
ifconfig br4 10.10.60.1/24 up
|
|
ip link add link eth0 name eth0.5 type vlan id 5
|
|
/sbin/ifconfig eth0.5 10.10.205.10/24 up
|
|
ip link add link eth0 name eth0.6 type vlan id 6
|
|
/sbin/ifconfig eth0.6 10.10.206.10/24 up
|
|
ip link add link eth0 name eth0.7 type vlan id 7
|
|
/sbin/ifconfig eth0.7 10.10.207.10/24 up
|
|
|
|
|
|
# build a very small chroot
|
|
ROOTDIR="/tmp/chroot" # default chroot directory
|
|
DEFAULT_FILES="/bin/bash /bin/sh " # basic chroot files
|
|
DEFAULT_FILES+="/etc/passwd /etc/nsswitch.conf /etc/group "
|
|
DEFAULT_FILES+=`find /lib -name libnss*` # files required by glibc
|
|
DEFAULT_FILES+=" /bin/cp /bin/ls /bin/cat /bin/ps /bin/netstat /bin/ping /sbin/ifconfig /usr/bin/touch /bin/ip /bin/hostname /bin/grep /usr/bin/dig /usr/bin/openssl /usr/bin/id /usr/bin/getent /usr/bin/whoami /usr/bin/wc /usr/bin/wget /bin/umount"
|
|
|
|
rm -fr $ROOTDIR
|
|
mkdir -p $ROOTDIR/{root,bin,lib,lib64,usr,home,etc,dev/shm,tmp,var/run,var/tmp,var/lock,var/log,proc}
|
|
chmod 777 $ROOTDIR/tmp
|
|
mkdir -p $ROOTDIR/etc/firejail
|
|
mkdir -p $ROOTDIR/home/netblue/.config/firejail
|
|
chown netblue:netblue $ROOTDIR/home/netblue
|
|
chown netblue:netblue $ROOTDIR/home/netblue/.config
|
|
cp /home/netblue/.Xauthority $ROOTDIR/home/netblue/.
|
|
cp -a /etc/skel $ROOTDIR/etc/.
|
|
mkdir $ROOTDIR/home/someotheruser
|
|
mkdir $ROOTDIR/boot
|
|
mkdir $ROOTDIR/selinux
|
|
cp /etc/passwd $ROOTDIR/etc/.
|
|
cp /etc/group $ROOTDIR/etc/.
|
|
cp /etc/hosts $ROOTDIR/etc/.
|
|
cp /etc/hostname $ROOTDIR/etc/.
|
|
mkdir -p $ROOTDIR/usr/lib/x86_64-linux-gnu
|
|
cp -a /usr/lib/x86_64-linux-gnu/openssl-1.0.0 $ROOTDIR/usr/lib/x86_64-linux-gnu/.
|
|
cp -a /usr/lib/ssl $ROOTDIR/usr/lib/.
|
|
touch $ROOTDIR/var/log/syslog
|
|
touch $ROOTDIR/var/tmp/somefile
|
|
SORTED=`for FILE in $* $DEFAULT_FILES; do echo " $FILE "; ldd $FILE | grep -v dynamic | cut -d " " -f 3; done | sort -u`
|
|
for FILE in $SORTED
|
|
do
|
|
cp --parents $FILE $ROOTDIR
|
|
done
|
|
cp --parents /lib64/ld-linux-x86-64.so.2 $ROOTDIR
|
|
cp --parents /lib/ld-linux.so.2 $ROOTDIR
|
|
cp ../src/tools/unchroot $ROOTDIR/.
|
|
touch $ROOTDIR/this-is-my-chroot
|
|
|
|
cd $ROOTDIR; find .
|
|
mkdir -p usr/lib/firejail/
|
|
cp /usr/lib/firejail/libtrace.so usr/lib/firejail/.
|
|
|
|
|
|
echo "To enter the chroot directory run: firejail --chroot=$ROOTDIR"
|