57726f
#!/bin/bash
57726f
57726f
ROOTDIR="$1"
57726f
CONFIG_FILES="${3:-/etc/named-chroot.files}"
57726f
57726f
usage()
57726f
{
57726f
  echo
57726f
  echo 'This script setups chroot environment for BIND'
57726f
  echo 'Usage: setup-named-chroot.sh ROOTDIR <on|off> [chroot.files]'
57726f
}
57726f
57726f
if ! [ "$#" -ge 2 -a "$#" -le 3 ]; then
57726f
  echo 'Wrong number of arguments'
57726f
  usage
57726f
  exit 1
57726f
fi
57726f
57726f
# Exit if ROOTDIR doesn't exist
57726f
if ! [ -d "$ROOTDIR" ]; then
57726f
  echo "Root directory $ROOTDIR doesn't exist"
57726f
  usage
57726f
  exit 1
57726f
fi
57726f
57726f
if ! [ -r "$CONFIG_FILES" ]; then
57726f
  echo "Files list $CONFIG_FILES doesn't exist" 2>&1
57726f
  usage
57726f
  exit 1
57726f
fi
57726f
57726f
dev_create()
57726f
{
57726f
  DEVNAME="$ROOTDIR/dev/$1"
57726f
  shift
57726f
  if ! [ -e "$DEVNAME" ]; then
57726f
    /bin/mknod -m 0664 "$DEVNAME" $@
57726f
    /bin/chgrp named "$DEVNAME"
57726f
    if [ -x /usr/sbin/selinuxenabled -a -x /sbin/restorecon ]; then
57726f
      /usr/sbin/selinuxenabled && /sbin/restorecon "$DEVNAME" > /dev/null || :
57726f
    fi
57726f
  fi
57726f
}
57726f
57726f
dev_chroot_prep()
57726f
{
57726f
  dev_create random  c 1 8
57726f
  dev_create urandom c 1 9
57726f
  dev_create zero    c 1 5
57726f
  dev_create null    c 1 3
57726f
}
57726f
57726f
files_comment_filter()
57726f
{
57726f
  if [ -d "$1" ]; then
57726f
    grep -v '^[[:space:]]*#' "$1"/*.files
57726f
  else
57726f
    grep -v '^[[:space:]]*#' "$1"
57726f
  fi
57726f
}
57726f
57726f
mount_chroot_conf()
57726f
{
57726f
  if [ -n "$ROOTDIR" ]; then
57726f
    # Check devices are prepared
57726f
    dev_chroot_prep
57726f
    files_comment_filter "$CONFIG_FILES" | while read -r all; do
57726f
      # Skip nonexistant files
57726f
      [ -e "$all" ] || continue
57726f
57726f
      # If mount source is a file
57726f
      if ! [ -d "$all" ]; then
57726f
        # mount it only if it is not present in chroot or it is empty
57726f
        if ! [ -e "$ROOTDIR$all" ] || [ `stat -c'%s' "$ROOTDIR$all"` -eq 0 ]; then
57726f
          touch "$ROOTDIR$all"
57726f
          mount --bind "$all" "$ROOTDIR$all"
57726f
        fi
57726f
      else
57726f
        # Mount source is a directory. Mount it only if directory in chroot is
57726f
        # empty.
57726f
        if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
57726f
          mount --bind --make-private "$all" "$ROOTDIR$all"
57726f
        fi
57726f
      fi
57726f
    done
57726f
  fi
57726f
}
57726f
57726f
umount_chroot_conf()
57726f
{
57726f
  if [ -n "$ROOTDIR" ]; then
57726f
    files_comment_filter "$CONFIG_FILES" | while read -r all; do
57726f
      # Check if file is mount target. Do not use /proc/mounts because detecting
57726f
      # of modified mounted files can fail.
57726f
      if mount | grep -q '.* on '"$ROOTDIR$all"' .*'; then
57726f
        umount "$ROOTDIR$all"
57726f
        # Remove temporary created files
57726f
        [ -f "$all" ] && rm -f "$ROOTDIR$all"
57726f
      fi
57726f
    done
57726f
  fi
57726f
}
57726f
57726f
case "$2" in
57726f
  on)
57726f
    mount_chroot_conf
57726f
    ;;
57726f
  off)
57726f
    umount_chroot_conf
57726f
    ;;
57726f
  *)
57726f
    echo 'Second argument has to be "on" or "off"'
57726f
    usage
57726f
    exit 1
57726f
esac
57726f
57726f
exit 0