Compare commits

...

6 Commits

Author SHA1 Message Date
Lockszmith 869e35970d Typo 2024-05-08 15:58:03 -04:00
Lockszmith fd170a03f2 Add rpm --restore shadow-utils to podman/rootless README.md 2024-05-08 15:48:53 -04:00
Jip-Hop 1108dbe5be
Update issue templates 2024-05-08 18:40:20 +02:00
Jip-Hop 2255039f55
Merge pull request #162 from Jip-Hop/develop
Update README.md
2024-05-07 20:10:50 +02:00
Jip-Hop d66c9cb31f Update README.md 2024-05-07 20:07:45 +02:00
Max Nordlund 487b0cde68
Follow Debian guidelines for launching editors (#157)
* Follow Debian guidelines for launching editors

When jailmaker wants to ask the user to edit a file, mostly a jail
config, it currently uses `nano`. This is not how a program is supposed
to work according to [Debian's guidelines]. This changes the hardcoded
`nano` to look up the correct editor to use using environmental
variables.

[1]: https://www.debian.org/doc/debian-policy/ch-customized-programs.html#editors-and-pagers

* Bump version to 1.3.0

---------

Co-authored-by: Jip-Hop <2871973+Jip-Hop@users.noreply.github.com>
2024-05-07 20:02:36 +02:00
5 changed files with 84 additions and 15 deletions

35
.github/ISSUE_TEMPLATE/bug_report.md vendored Normal file
View File

@ -0,0 +1,35 @@
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: bug
assignees: ''
---
**READ THIS FIRST**
[How to ask for help? (including discussion vs issue)](https://github.com/Jip-Hop/jailmaker/discussions/135)
**Describe the bug**
A clear and concise description of what the bug is.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Run command '....'
3. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Jailmaker:**
- Version [e.g. 1.3.0]
**TrueNAS SCALE:**
- Version [e.g. 24.04.0]
**Additional context**
Add any other context about the problem here.

View File

@ -0,0 +1,23 @@
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: enhancement
assignees: ''
---
**READ THIS FIRST**
[How to ask for help? (including discussion vs issue)](https://github.com/Jip-Hop/jailmaker/discussions/135)
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.

View File

@ -27,7 +27,7 @@ Despite what the word 'jail' implies, jailmaker's intended use case is to create
## Installation
Beginning with 24.04 (Dragonfish), TrueNAS SCALE includes the systemd-nspawn containerization program in the base system. Technically there's nothing to install. You only need the `jlmkr.py` script file in the right place. [Instructions with screenshots](https://www.truenas.com/docs/scale/scaletutorials/apps/sandboxes/) are provided on the TrueNAS website. Start by creating a new dataset called `jailmaker` with the default settings (from TrueNAS web interface). Then login as the root user and download `jlmkr.py`.
Beginning with 24.04 (Dragonfish), TrueNAS SCALE includes the systemd-nspawn containerization program in the base system. Technically there's nothing to install. You only need the `jlmkr.py` script file in the right place. [Instructions with screenshots](https://www.truenas.com/docs/scale/scaletutorials/apps/sandboxes/) are provided on the TrueNAS website. Start by creating a new dataset called `jailmaker` with the default settings (from TrueNAS web interface). Then login as the root user and download `jlmkr.py`. If you login as non-root user (e.g. as admin), **you must become root first** by executing `sudo su`.
```shell
cd /mnt/mypool/jailmaker
@ -114,7 +114,7 @@ jlmkr exec myjail bash -c 'echo test; echo $RANDOM;'
jlmkr edit myjail
```
Once you've created a jail, it will exist in a directory inside the `jails` dir next to `jlmkr.py`. For example `/mnt/mypool/jailmaker/jails/myjail` if you've named your jail `myjail`. You may edit the jail configuration file, e.g. using the `jlmkr edit myjail` command (which uses the nano text editor). You'll have to stop the jail and start it again with `jlmkr` for these changes to take effect.
Once you've created a jail, it will exist in a directory inside the `jails` dir next to `jlmkr.py`. For example `/mnt/mypool/jailmaker/jails/myjail` if you've named your jail `myjail`. You may edit the jail configuration file using the `jlmkr edit myjail` command. This opens the config file in your favorite editor, as determined by following [Debian's guidelines](https://www.debian.org/doc/debian-policy/ch-customized-programs.html#editors-and-pagers) on the matter. You'll have to stop the jail and start it again with `jlmkr` for these changes to take effect.
### Remove Jail

View File

@ -4,7 +4,7 @@
with full access to all files via bind mounts, \
thanks to systemd-nspawn!"""
__version__ = "1.2.1"
__version__ = "1.3.0"
__disclaimer__ = """USE THIS SCRIPT AT YOUR OWN RISK!
IT COMES WITHOUT WARRANTY AND IS NOT SUPPORTED BY IXSYSTEMS."""
@ -123,7 +123,6 @@ SCRIPT_NAME = os.path.basename(SCRIPT_PATH)
SCRIPT_DIR_PATH = os.path.dirname(SCRIPT_PATH)
COMMAND_NAME = os.path.basename(__file__)
SYMLINK_NAME = "jlmkr"
TEXT_EDITOR = "nano"
# Only set a color if we have an interactive tty
if sys.stdout.isatty():
@ -1021,6 +1020,17 @@ def agree_with_default(config, key, question):
config.my_set(key, agree(question, default_answer))
def get_text_editor():
def get_from_environ(key):
if editor := os.environ.get(key):
return shutil.which(editor)
return get_from_environ("VISUAL") \
or get_from_environ("EDITOR") \
or shutil.which("editor") \
or shutil.which("/usr/bin/editor") \
or "nano"
def interactive_config():
config = KeyValueParser()
config.read_string(DEFAULT_CONFIG)
@ -1049,7 +1059,7 @@ def interactive_config():
input("Press Enter to open the text editor.")
with tempfile.NamedTemporaryFile(mode="w+t") as f:
subprocess.call([TEXT_EDITOR, f.name])
subprocess.call([get_text_editor(), f.name])
f.seek(0)
# Start over with a new KeyValueParser to parse user config
config = KeyValueParser()
@ -1506,19 +1516,13 @@ def edit_jail(jail_name):
return 1
jail_config_path = get_jail_config_path(jail_name)
if not shutil.which(TEXT_EDITOR):
eprint(
f"Unable to edit config file: {jail_config_path}.",
f"\nThe {TEXT_EDITOR} text editor is not available",
)
return 1
returncode = subprocess.run(
[TEXT_EDITOR, get_jail_config_path(jail_name)]
[get_text_editor(), jail_config_path]
).returncode
if returncode != 0:
eprint("An error occurred while editing the jail config.")
eprint(f"An error occurred while editing {jail_config_path}.")
return returncode
if jail_is_running(jail_name):
@ -1922,7 +1926,7 @@ def main():
),
dict(
name="edit",
help=f"edit jail config with {TEXT_EDITOR} text editor",
help=f"edit jail config with {get_text_editor()} text editor",
func=edit_jail,
),
dict(

View File

@ -36,6 +36,9 @@ Start the jail with `jlmkr start mypodmanjail` and open a shell session inside t
Then inside the jail setup the new rootless user:
```bash
# podman rootless requires the shaodw-utils
rpm --restore shadow-utils
# Create new user
adduser rootless
# Set password for user
@ -117,7 +120,11 @@ Resources mentioning `add_key keyctl bpf`
- https://bbs.archlinux.org/viewtopic.php?id=252840
- https://wiki.archlinux.org/title/systemd-nspawn
- https://discourse.nixos.org/t/podman-docker-in-nixos-container-ideally-in-unprivileged-one/22909/12
Resources mentioning `@keyring`
- https://github.com/systemd/systemd/issues/17606
- https://github.com/systemd/systemd/blob/1c62c4fe0b54fb419b875cb2bae82a261518a745/src/shared/seccomp-util.c#L604
`@keyring` also includes `request_key` but doesn't include `bpf`
- `@keyring` also includes `request_key` but doesn't include `bpf`
Podman documentation mentioning `shadow-utils`:
- https://docs.podman.io/en/latest/markdown/podman-run.1.html#rootless-containers