From d796284d8bb483a89bf3d65d198a890a62090d96 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Tue, 17 Nov 2015 15:06:35 -0400 Subject: Added Chroot.noServices property. --- src/Propellor/Property/Chroot.hs | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'src/Propellor/Property/Chroot.hs') diff --git a/src/Propellor/Property/Chroot.hs b/src/Propellor/Property/Chroot.hs index 8d1a2388..a763a56b 100644 --- a/src/Propellor/Property/Chroot.hs +++ b/src/Propellor/Property/Chroot.hs @@ -8,6 +8,7 @@ module Propellor.Property.Chroot ( ChrootBootstrapper(..), Debootstrapped(..), ChrootTarball(..), + noServices, inChroot, -- * Internal use provisioned', @@ -27,6 +28,7 @@ import qualified Propellor.Property.Systemd.Core as Systemd import qualified Propellor.Property.File as File import qualified Propellor.Shim as Shim import Propellor.Property.Mount +import Utility.FileMode import qualified Data.Map as M import Data.List.Utils @@ -247,6 +249,22 @@ mungeloc = replace "/" "_" chrootDesc :: Chroot -> String -> String chrootDesc (Chroot loc _ _) desc = "chroot " ++ loc ++ " " ++ desc +-- | Adding this property to a chroot prevents daemons and other services +-- from being started, which is often something you want to prevent when +-- building a chroot. +-- +-- This is accomplished by installing a script +-- that does not let any daemons be started by packages that use +-- invoke-rc.d. Reverting the property removes the script. +noServices :: RevertableProperty NoInfo +noServices = setup teardown + where + f = "/usr/sbin/policy-rc.d" + script = [ "#!/bin/sh", "exit 101" ] + setup = File.mode f (combineModes (readModes ++ executeModes)) + `requires` File.hasContent f script + teardown = File.notPresent f + -- | Check if propellor is currently running within a chroot. -- -- This allows properties to check and avoid performing actions that -- cgit v1.2.3