jvdias 0cd02a
#!/bin/bash
jvdias 0cd02a
# 
jvdias 0cd02a
# Script to control the bind-chroot ISC BIND named(8) server runtime environment.
jvdias 0cd02a
#
jvdias 0cd02a
# Usage:
jvdias 0cd02a
#  [ -e | --enable ] [ -d | --disable ] | [ -s --sync ]
jvdias 0cd02a
#
jvdias 0cd02a
#  -e | --enable:   enable the bind-chroot environment
jvdias 0cd02a
#  -d | --disable:  disable the bind-chroot environment
jvdias 0cd02a
#  -s | --sync:     sync files between the bind chroot and / environments,
jvdias 0cd02a
#                   so they are correct for the current state of the bind-chroot
jvdias 0cd02a
#                   (enabled / disabled)
jvdias 0cd02a
# $BIND_CHROOT_PREFIX, default /var/named/chroot, is the location of the chroot.
jvdias 0cd02a
# $BIND_DIR, default /var/named, is the default un-chrooted bind directory.
jvdias 0cd02a
#
jvdias 0cd02a
# Copyright(C) 2006 Jason Vas Dias <jvdias@redhat.com>, Red Hat, Inc.
jvdias 0cd02a
#
jvdias 0cd02a
#    This software is provided under the terms of the GNU
jvdias 0cd02a
#    General Public License (GPL), as published at: 
jvdias 0cd02a
#    http://www.gnu.org/licenses/gpl.html .
jvdias 0cd02a
#
jvdias 0cd02a
#
jvdias 0cd02a
BIND_CHROOT_PREFIX=${BIND_CHROOT_PREFIX:-@BIND_CHROOT_PREFIX@}
jvdias 0cd02a
BIND_DIR=${BIND_DIR:-@BIND_DIR@}
jvdias 0cd02a
jvdias 0cd02a
function usage()
jvdias 0cd02a
{
jvdias 0cd02a
  echo 'Usage:
jvdias 0cd02a
  -e | --enable:   enable the bind-chroot environment
jvdias 0cd02a
  -d | --disable:  disable the bind-chroot environment
jvdias 0cd02a
  -s | --sync:     sync files between the bind chroot and / environments,
jvdias 0cd02a
                   so they are correct for the current state of the bind-chroot
jvdias 0cd02a
                   (enabled / disabled)
jvdias 0cd02a
  $BIND_CHROOT_PREFIX, default /var/named/chroot, is the location of the chroot.
jvdias 0cd02a
  $BIND_DIR, default /var/named, is the default un-chrooted bind directory.
jvdias 0cd02a
';
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function rootdir()
jvdias 0cd02a
{
jvdias 0cd02a
    . /etc/sysconfig/named
jvdias 0cd02a
    if [ -n "$ROOTDIR" ]; then
jvdias 0cd02a
	BIND_CHROOT_PREFIX="$ROOTDIR";
jvdias 0cd02a
	BIND_CHROOT_PREFIX=`echo $BIND_CHROOT_PREFIX | sed 's#//*#/#g;s#/$##'`;
jvdias 0cd02a
	if [ -L "$BIND_CHROOT_PREFIX" ]; then
jvdias 0cd02a
	    BIND_CHROOT_PREFIX=`/usr/bin/readlink "$BIND_CHROOT_PREFIX"`;
jvdias 0cd02a
	fi
jvdias 0cd02a
	return 0;
jvdias 0cd02a
    fi;
jvdias 0cd02a
    return 1;
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function check_dirs()
jvdias 0cd02a
{
jvdias 0cd02a
    if [ -z "$BIND_CHROOT_PREFIX" ]; then
jvdias 0cd02a
	rootdir;
jvdias 0cd02a
	if [ -z "$BIND_CHROOT_PREFIX" ]; then
jvdias 0cd02a
	    usage;
jvdias 0cd02a
	    exit 1;
jvdias 0cd02a
	fi;
jvdias 0cd02a
    fi
jvdias 0cd02a
    BIND_DIR=`echo $BIND_DIR | sed 's#//*#/#g;s#/$##'`;
jvdias 0cd02a
    if [ -L "$BIND_DIR" ]; then
jvdias 0cd02a
	BIND_DIR=`/usr/bin/readlink "$BIND_DIR"`;
jvdias 0cd02a
    fi
jvdias 0cd02a
    BIND_CHROOT_PREFIX=`echo $BIND_CHROOT_PREFIX | sed 's#//*#/#g;s#/$##'`;
jvdias 0cd02a
    if [ -L "$BIND_CHROOT_PREFIX" ]; then
jvdias 0cd02a
	BIND_CHROOT_PREFIX=`/usr/bin/readlink "$BIND_CHROOT_PREFIX"`;
jvdias 0cd02a
    fi
jvdias 0cd02a
jvdias 0cd02a
    /bin/mkdir -p ${BIND_DIR}/{slaves,data};
jvdias 0cd02a
    /bin/chown root:named ${BIND_DIR};
jvdias 0cd02a
    /bin/chown named:named ${BIND_DIR}/{slaves,data};
jvdias 0cd02a
    /bin/chmod 750 ${BIND_DIR}
jvdias 0cd02a
    /bin/chmod 770 ${BIND_DIR}/{slaves,data};
jvdias 0cd02a
        
jvdias 7366a5
    mkdir -p ${BIND_CHROOT_PREFIX}/{etc,dev,var/{run/named,named/{slaves,data}}};
jvdias 7366a5
    /bin/chown root:named ${BIND_CHROOT_PREFIX}/{etc,dev,var/{run,named/}};
jvdias 7366a5
    /bin/chmod 750 ${BIND_CHROOT_PREFIX}/{,etc,dev,var,var/{run,named/}};
jvdias 0cd02a
    /bin/chown named:named ${BIND_CHROOT_PREFIX}/var/{run/named,named/{data,slaves}};
jvdias 7366a5
    /bin/chmod 770 ${BIND_CHROOT_PREFIX}/var/{run/named,named/{slaves,data}};        
jvdias 7366a5
jvdias 7366a5
    [ ! -e "${BIND_CHROOT_PREFIX}/dev/random" ] && /bin/mknod "${BIND_CHROOT_PREFIX}/dev/random" c 1 8 
jvdias 0cd02a
    [ ! -e "${BIND_CHROOT_PREFIX}/dev/zero" ] && /bin/mknod "${BIND_CHROOT_PREFIX}/dev/zero" c 1 5
jvdias 0cd02a
    [ ! -e "${BIND_CHROOT_PREFIX}/dev/null" ] && /bin/mknod "${BIND_CHROOT_PREFIX}/dev/null" c 1 3
jvdias 0cd02a
    [ ! -e "${BIND_CHROOT_PREFIX}/etc/localtime" ] &&  [ -e /etc/localtime ] && /bin/cp -fp /etc/localtime "${BIND_CHROOT_PREFIX}/etc/localtime";
jvdias 7366a5
    chmod 666 "${BIND_CHROOT_PREFIX}"/dev/{random,null,zero};
jvdias 505ab5
    if [ -d /selinux ] && [ -e /selinux/enforce ] && [ -x /usr/bin/chcon ]; then       
jvdias 7366a5
       for dev in random zero null; do
jvdias 7366a5
	   /usr/bin/chcon --reference=/dev/$dev ${BIND_CHROOT_PREFIX}/dev/$dev;
jvdias 7366a5
       done
jvdias 7366a5
    fi;
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
check_dirs;
jvdias 0cd02a
jvdias 0cd02a
function replace_with_link()
jvdias 0cd02a
{ # replaces $dst second arg file  with link to $src first arg file
jvdias 0cd02a
    if [ $# -lt 2 ]; then
jvdias 0cd02a
	return 1;
jvdias 0cd02a
    fi;
jvdias 0cd02a
    src=$1
jvdias 0cd02a
    dst=$2    
jvdias 0cd02a
    if [ -z "$src" ] || [ -z "$dst" ] || [ "$src" = "$dst" ]; then
jvdias 0cd02a
       return 1;
jvdias 0cd02a
    fi
jvdias 0cd02a
    if [ ! -e "$src" ]; then
jvdias 0cd02a
       if [ ! -e "$dst" ]; then
jvdias 0cd02a
	   return 1;
jvdias 0cd02a
       else
jvdias 0cd02a
	   if [ -L "$dst" ]; then
jvdias 0cd02a
	       dstlnk=`/usr/bin/readlink "$dst"`;
jvdias 0cd02a
	       if [ ! -e "$dstlnk" ] ; then
jvdias 0cd02a
		   return 1;
jvdias 0cd02a
	       fi	       
jvdias 0cd02a
	       rm -f "$dst";
jvdias 0cd02a
	       /bin/cp -fp "$dstlnk" "$dst";
jvdias 0cd02a
	   fi;
jvdias 0cd02a
	   /bin/mv "$dst" "$src";
jvdias 0cd02a
       fi
jvdias 0cd02a
    fi
jvdias 0cd02a
    if [ -e "$dst" ]; then
jvdias 0cd02a
       if [ ! -L "$dst" ]; then
jvdias 0cd02a
	  if [ ! -s "$dst" ]; then
jvdias 0cd02a
	     /bin/rm -f "$dst";
jvdias 0cd02a
	  else	     
jvdias 0cd02a
	     if [ "$src" -nt "$dst" ] || [ ! "$dst" -nt "$src" ] ; then
jvdias 0cd02a
	        /bin/mv "$dst" "$dst".`/bin/date +'%Y-%m-%d_%H-%M-%S.%N'`;
jvdias 0cd02a
	     else # [ "$dst" -nt "$src" ]
jvdias 0cd02a
	        /bin/mv "$src" "$src".`/bin/date +'%Y-%m-%d_%H-%M-%S.%N'`;
jvdias 0cd02a
	        /bin/mv "$dst" "$src";
jvdias 0cd02a
	     fi;
jvdias 0cd02a
	  fi;
jvdias 0cd02a
       else
jvdias 0cd02a
          dstlnk=`/usr/bin/readlink "$dst"`
jvdias 0cd02a
	  if [ "$dstlnk" != $src ]; then
jvdias 0cd02a
	     /bin/rm -f $dst;
jvdias 0cd02a
	     if [ "$dstlnk" != "$dst" ] && [ -s $dstlnk ]; then
jvdias 0cd02a
		 if [ "$dstlnk" -nt "$src" ] || [ ! "$dstlnk" -nt "$src" ] ; then		     
jvdias 0cd02a
		     /bin/cp -fp "$dstlnk" "$dst".`/bin/date +'%Y-%m-%d_%H-%M-%S.%N'`;
jvdias 0cd02a
		 else
jvdias 0cd02a
		     /bin/mv "$src" "$src".`/bin/date +'%Y-%m-%d_%H-%M-%S.%N'`;
jvdias 0cd02a
		     /bin/cp -fp "$dstlnk" "$src";
jvdias 0cd02a
		 fi;
jvdias 0cd02a
	     fi;
jvdias 0cd02a
	  else
jvdias 0cd02a
	     return 0;
jvdias 0cd02a
	  fi;
jvdias 0cd02a
       fi;
jvdias 0cd02a
    fi; 
jvdias 0cd02a
    /bin/ln -sf "$src" "$dst";
jvdias 0cd02a
    return $?;
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function replace_with_file()
jvdias 0cd02a
{
jvdias 0cd02a
    if [ $# -lt 2 ]; then
jvdias 0cd02a
	return 1;
jvdias 0cd02a
    fi;
jvdias 0cd02a
    src=$1;
jvdias 0cd02a
    dst=$2;
jvdias 0cd02a
    if [ -z "$src" ] || [ -z "$dst" ] || [ "$src" = "$dst" ]; then
jvdias 0cd02a
       return 1;
jvdias 0cd02a
    fi
jvdias 0cd02a
    if [ ! -e "$src" ]; then
jvdias 0cd02a
       if [ -e "$dst" ]; then
jvdias 0cd02a
	  /bin/rm -f $dst;
jvdias 0cd02a
       fi;
jvdias 0cd02a
       return 1;
jvdias 0cd02a
    fi;
jvdias 0cd02a
    if [ -e "$dst" ]; then
jvdias 0cd02a
       if [ ! -L "$dst" ]; then
jvdias 0cd02a
	   /bin/mv "$dst" "$dst".`/bin/date +'%Y-%m-%d_%H-%M-%S.%N'`;
jvdias 0cd02a
       else
jvdias 0cd02a
	   /bin/rm -f "$dst";
jvdias 0cd02a
       fi;
jvdias 0cd02a
    fi;
jvdias 0cd02a
    /bin/mv -f "$src" "$dst";
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function enable_bind_chroot()
jvdias 0cd02a
{
jvdias 7366a5
    if /bin/egrep -q '^ROOTDIR=' /etc/sysconfig/named; then
jvdias 0cd02a
	/bin/sed -i -e 's#^ROOTDIR=.*$#ROOTDIR='${BIND_CHROOT_PREFIX}'#' /etc/sysconfig/named ;
jvdias 0cd02a
    else
jvdias 0cd02a
	echo 'ROOTDIR='${BIND_CHROOT_PREFIX} >> /etc/sysconfig/named;
jvdias 0cd02a
    fi
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function disable_bind_chroot()
jvdias 0cd02a
{
jvdias 0cd02a
    /bin/sed -i -e '/^ROOTDIR=/d' /etc/sysconfig/named;    
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
function sync_files()
jvdias 0cd02a
{
jvdias 0cd02a
    shopt -q nullglob;
jvdias 0cd02a
    ng=$?
jvdias 0cd02a
    shopt -s nullglob;
jvdias 0cd02a
    pfx=''
jvdias 053216
    changed=`/bin/mktemp /tmp/XXXXXX`;
jvdias 053216
    rm -f $changed
jvdias 0cd02a
    if rootdir ; then # chroot is enabled
jvdias 0cd02a
	/usr/bin/find /{etc/{named.*,rndc.*},${BIND_DIR#/}{/*,/data/*,/slaves/*}}  -maxdepth 0 -type f |
jvdias 0cd02a
	while read f;
jvdias 0cd02a
        do
jvdias 0cd02a
	    replace_with_link ${BIND_CHROOT_PREFIX}/$f $f;
jvdias 053216
	    [ ! -e $changed ] && touch $changed;
jvdias 0cd02a
	done;
jvdias 0cd02a
	pfx=${BIND_CHROOT_PREFIX}
jvdias 0cd02a
    else              # chroot is disabled	
jvdias 0cd02a
	/usr/bin/find /var/named/chroot/{etc/{named.*,rndc.*},var/named{/*,/data/*,/slaves/*}} -maxdepth 0 |
jvdias 0cd02a
	while read f; 
jvdias 0cd02a
	do
jvdias 0cd02a
	    if [ ! -d "$f" ]; then
jvdias 0cd02a
		replace_with_file $f ${f#$BIND_CHROOT_PREFIX};
jvdias 053216
		[ ! -e $changed ] && touch $changed;
jvdias 0cd02a
	    fi;
jvdias 0cd02a
	done
jvdias 0cd02a
    fi;
jvdias 053216
    if [ ! -e ${pfx}/etc/rndc.key ]; then
jvdias 053216
	   echo 'key "rndckey" {
jvdias 053216
	algorithm	hmac-md5;
jvdias 053216
	secret		"'`/usr/sbin/dns-keygen`'";
jvdias 053216
};'     > /etc/rndc.key;
jvdias 053216
    elif /bin/egrep -q '@KEY@' /etc/rndc.key; then
jvdias 053216
	/bin/sed -i -e 's^@KEY@^'`/usr/sbin/dns-keygen`'^' /etc/rndc.key ;
jvdias 053216
    fi
jvdias 0cd02a
    chown root:named ${pfx}/var/named/* >/dev/null 2>&1;
jvdias 0cd02a
    chmod 750 ${pfx}/var/named  >/dev/null 2>&1;
jvdias 0cd02a
    chmod 640 ${pfx}/var/named/* >/dev/null 2>&1;
jvdias 0cd02a
    chown named:named ${pfx}/var/named/{data{,/*},slaves{,*/}} >/dev/null 2>&1;
jvdias 0cd02a
    chmod 770 ${pfx}/var/named/{data,slaves} >/dev/null 2>&1;
jvdias 505ab5
    chmod 640 ${pfx}/var/named/{data/*,slaves/*} >/dev/null 2>&1;
jvdias 053216
    if [ -e $changed ]; then
jvdias 053216
	if [ -e /selinux/enforce ] && [ -x /sbin/restorecon ]; then
jvdias 053216
	    if [ -n "$pfx" ]; then
jvdias 053216
		/sbin/restorecon -R $pfx/etc $pfx/var/named $pfx/var/run/named >/dev/null 2>&1;
jvdias 053216
		if [ -e $pfx/etc/localtime ] && [ -e /etc/localtime ] ; then 
jvdias 053216
		   /usr/bin/chcon --reference=/etc/localtime $pfx/etc/localtime >/dev/null 2>&1;
jvdias 053216
		fi;		
jvdias 053216
	    else
jvdias 053216
		/sbin/restorecon /etc/{named,rndc}.* >/dev/null 2>&1;
jvdias 053216
		/usr/bin/chcon --reference=/etc/named.conf /etc/named.* >/dev/null 2>&1;
jvdias 053216
		/sbin/restorecon -e /var/named/chroot /var/named{/,/data/,/slaves/}* >/dev/null 2>&1;
jvdias 053216
	    fi;
jvdias 053216
	fi;
jvdias 053216
	/sbin/service named condrestart
jvdias 053216
	rm -f $changed;
jvdias 053216
    fi;
jvdias 053216
    if [ $ng -eq 1 ]; then
jvdias 053216
	shopt -u nullglob;
jvdias 053216
    fi;
jvdias 0cd02a
}
jvdias 0cd02a
jvdias 0cd02a
case $1 in 
jvdias 0cd02a
    -e|--enable)
jvdias 0cd02a
	enable_bind_chroot;
jvdias 0cd02a
	sync_files;
jvdias 0cd02a
	exit $?;
jvdias 0cd02a
	;;
jvdias 0cd02a
    -d|--disable)
jvdias 0cd02a
	disable_bind_chroot;
jvdias 0cd02a
	sync_files;
jvdias 7366a5
	/bin/umount ${BIND_CHROOT_PREFIX}/proc >/dev/null 2>&1 || :;
jvdias 7366a5
	/bin/umount ${BIND_CHROOT_PREFIX}/var/run/dbus >/dev/null 2>&1 || :;
jvdias 0cd02a
	exit $?;
jvdias 0cd02a
	;;
jvdias 0cd02a
    -s|--sync)
jvdias 0cd02a
        sync_files;
jvdias 0cd02a
	exit $?;
jvdias 0cd02a
	;;
jvdias 0cd02a
    -q)
jvdias 0cd02a
	;;
jvdias 0cd02a
    *)
jvdias 0cd02a
	usage;
jvdias 0cd02a
	exit 1;
jvdias 0cd02a
esac