photo
Jordan Sissel
geek

Wed, 07 Feb 2007

Mini-FreeBSD script

I wrote a script a while ago to build a very tiny freebsd world. It's extremely fast and only builds a freebsd image in approximately 10 megs of space. It lets you quickly create new jail enviroments or system images for small embedded platforms.

If you look at the script itself, you'll get an idea of what it installs. I used a variant of this script to build the system I run on my Soekris net4501 which runs FreeBSD and is under 20 megs.

There are lots of "make a small freebsd system" scripts, but most of the ones I've found rely heavily on 'buildworld' and what not. This takes a live system and copies the binaries you need, then uses ldd(1) to track down required libraries.

view minibsd.sh

Example usage:

kenya(~/t) % rm -rf ./soekris/
kenya(~/t) % time sudo ./minibsd.sh
sudo ./minibsd.sh   0.16s user 0.65s system 61% cpu 1.326 total
kenya(~/t) % sudo chroot ./soekris /bin/sh
# pwd
/
# exit
Simple jail config (rc.conf):
jail_enable="YES"
jail_list="test"
jail_test_rootdir="/home/jls/t/soekris"
jail_test_hostname="test"
jail_test_ip="10.1.1.1"
jail_test_interface="tl1"
Put something simple in this jail's rc.conf (/home/jls/t/soekris/etc/rc.conf):
sshd_enable="YES"
sendmail_enable="NONE"
Let's test the jail now:
kenya(~/t) % sudo /etc/rc.d/jail start
Configuring jails:.
Starting jails: 
At this point, it's probably hung (assuming you enabled sshd). If you hit CTRL+T you'll see what command has the foreground and what it's doing.* This is because it's prompting you (output is directed to JAILROOT/var/log/console.log) for entropy for the ssh-keygen. Smash a few keys then hit enter. It'll finish eventually.
kenya(~/t) % sockstat -4 | grep 10.1.1.1:22 
root     sshd       2258  3  tcp4   10.1.1.1:22           *:*
Our sshd is running happily inside that jail we made. This whole process took about 5 minutes.

* FreeBSD's CTRL+T terminal handler feature has to be the best thing ever invented. I wish Linux had something like this. Here's what hitting CTRL+T when running cat looks like:

kenya(~) % cat
load: 0.45  cmd: cat 2324 [ttyin] 0.00u 0.00s 0% 600k
load: 0.42  cmd: cat 2324 [ttyin] 0.00u 0.00s 0% 600k
It clearly shows you the command name, the pid, and the syscall-type-thing it's doing. Clearly cat is waiting for input from the tty. <3 FreeBSD.

Comments: 10 (view comments)
Tags: , , ,
Permalink: /geekery/mini-freebsd-script
posted at: 03:27


10 responses to 'Mini-FreeBSD script'

Wesley Shields posted at Wed Feb 7 11:29:01 2007...
Jail's console.log is no longer within the jail per the recent security patch.  BTW, I like your approach of using ldd(1) to track down dependencies.  :)

Adam posted at Sat Feb 10 05:27:48 2007...
That is a very clever trick (both of them, even!). I think this is why I continuously read your blog, you always find an interesting way to solve a problem. I recall your shell parallelization technique and the invalid bounce-back rejection script. Great stuff.

Tyler Weaver posted at Wed Feb 14 13:20:11 2007...
This is a great tip!  I am always looking for ways to improve upon my jailing enviroment.

Adam posted at Sat Aug 11 15:19:29 2007...
This script totally burned me. Twice, but one was more my fault than the other.

If the directory does not exist, realpath fails and $DESTDIR becomes null. As a result, when cleanetc runs, you lose any configurations you had in /etc/ that come with the base system. That hurt. Not to mention whatever installs. I'm not sure if the system is currently bootable -- I don't want to reboot and find out the hardway :/

Also, since I don't have sudo, I got an error the first time I ran it. I checked to see which command didn't run, stupidly copy and pasted into my shell (again, without $DESTDIR), and lost my configures and this time also /etc/passwd and /etc/master.passwd. Whoops!

Adam posted at Sat Aug 11 15:20:28 2007...
Wait, I misspoke-- /etc/namedb/named.conf appears intact. Still not sure it it's bootable, though!

Adam posted at Sat Aug 11 15:25:40 2007...
Hmm, apparently realpath doesn't like trailing slashes. I guess that's the error, not the script. Sorry for speaking rashly! But maybe this is something to keep in mind.

Jordan Sissel posted at Sat Aug 11 16:37:49 2007...
@Adam,

Ouch! That really sucks, sorry for that. I've updated the script to mkdir $DESTDIR and make sure realpath succeeds.

null posted at Sun Sep 16 13:21:23 2007...
test

4mat posted at Tue Nov 6 16:38:17 2007...
Very cool script however one question in mind is that once the jail gets populated, how do you go on upgrading in jail environment in the future? Do you re-run the script to write over the existing files/directories? Please let me know or email me back, thanks :)

4mat posted at Tue Nov 6 16:39:22 2007...
Very cool script however one question in mind is that once the jail gets populated, how do you go on upgrading in jail environment in the future? Do you re-run the script to write over the existing files/directories? Please let me know or email me back, thanks :)


Leave a reply

You need javascript enabled to use this form. Anti-spam efforts ongoing. Also, if the comment doesn't show up, it's because the form expired. Go back and copy your comment, reload the form, and resubmit. Apologies if this is a hassle, I'm just playing with antispam methods right now. If this insists on not working, please email me about it.

Name (required)
E-mail (optional, if you want me to be able to email you back)
URL (also optional)
Comment:


Search this site

Navigation

Metadata

Home About Resume My Code (SVN)

Articles

ARP Security Dynamic DNS with DHCP OpenLDAP+Kerberos+SASL PPP over SSH SSH Security: /bin/false Week of Unix Tools Work Efficiency

Projects

fex firefox tabsearch firefox urledit grok keynav liboverride newpsm (FreeBSD) nis2ldap pam_captcha poor man's backup Solaris audio utility xboxproxy xdotool xmlpresenter xpathtool misc scripts

Presentations

Yahoo! Hack Day '06 Unix Essentials Vi/Vim Essentials

Tag Cloud

Calendar

< February 2007 >
SuMoTuWeThFrSa
     1 2 3
4 5 6 7 8 910
11121314151617
18192021222324
25262728   

Friends

BarCamp Kent Brewster Tantek Çelik John Resig Wesley Shields Tyler Shields

Technorati