Skip to content

Commit 0f23e54

Browse files
AnirudhG07AnirudhG07
committed
installing auto
1 parent bace825 commit 0f23e54

3 files changed

Lines changed: 213 additions & 103 deletions

File tree

‎README.md‎

Lines changed: 9 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,13 @@ All enforcement happens at the kernel level - no wrapper scripts, no LD_PRELOAD
4646

4747
### Automatic Installation (Recommended)
4848

49-
You can run an interactive install script which will set you up for running the sandbox, from scratch by installing all dependencies(and asking permissions for it). Note that to enable BPF LSM, you may need to reboot as the installation script may guide you through, please do not ignore it.
49+
To install the sandbox command, please run the below script. You will have to install some dependencies like enabling BPF LSM. Note that to enable BPF LSM, you may need to reboot as the installation script may guide you through, please do not ignore it.
50+
51+
The sandbox will not be built since a prebuild binary from github will be installed, depending on the architecture of your machine.
52+
5053

5154
```bash
52-
git clone https://github.com/AnirudhG07/cmd_sandbox-rs.git
53-
cd cmd_sandbox-rs
54-
bash install.sh
55+
curl -fsSL https://raw.githubusercontent.com/AnirudhG07/cmd_sandbox-rs/main/install.sh | bash
5556
```
5657

5758
Then add to PATH (if not already):
@@ -70,31 +71,16 @@ cmd_sandbox help # Show help
7071

7172
### Manual Build
7273

73-
<details>
74-
<summary>If you prefer to build manually, check the below steps -
75-
</summary>
74+
You can run an interactive install script which will set you up for running the sandbox, from scratch by installing all dependencies(and asking permissions for it). Note that to enable BPF LSM, you may need to reboot as the installation script may guide you through, please do not ignore it.
7675

7776
```bash
78-
# Install Rust toolchains
79-
rustup toolchain install stable
80-
rustup toolchain install nightly --component rust-src
81-
cargo install bpf-linker
82-
83-
# Clone and build
8477
git clone https://github.com/AnirudhG07/cmd_sandbox-rs.git
8578
cd cmd_sandbox-rs
86-
cargo build --release
87-
88-
# Compile test helper binaries
89-
cd cmd-sandbox-tests/test_helpers
90-
gcc -o test_stack_limit test_stack_limit.c
91-
gcc -o test_kernel_access test_kernel_access.c
92-
gcc -o test_net_config test_net_config.c
93-
chmod +x test_*
94-
cd ../..
79+
bash install_manual.sh
9580
```
9681

97-
</details>
82+
Please follow all the steps to install all dependencies which will build the project locally in your computer which you can run.
83+
9884

9985
## Docker Container
10086

‎RELEASE.md‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎install.sh‎

Lines changed: 204 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ NC='\033[0m' # No Color
1414

1515
# GitHub repository info
1616
GITHUB_REPO="AnirudhG07/cmd_sandbox-rs"
17-
GITHUB_RELEASES_URL="https://api.github.com/repos/${GITHUB_REPO}/releases/latest"
17+
GITHUB_RELEASES_URL="https://api.github.com/repos/${GITHUB_REPO}/releases/tags/nightly"
1818

1919
echo -e "${BLUE}╔════════════════════════════════════════════════════════════════╗${NC}"
20-
echo -e "${BLUE}║ cmd_sandbox-rs Installer ║${NC}"
20+
echo -e "${BLUE}║ cmd_sandbox-rs Installer ║${NC}"
2121
echo -e "${BLUE}╚════════════════════════════════════════════════════════════════╝${NC}"
2222
echo ""
2323

@@ -104,22 +104,22 @@ echo -e "${GREEN}✓ All required dependencies found${NC}"
104104
echo ""
105105

106106
# Download pre-built binaries
107-
echo -e "${BLUE}[2/3] Downloading pre-built binaries from GitHub...${NC}"
107+
echo -e "${BLUE}[2/3] Downloading pre-built binaries from GitHub (nightly release)...${NC}"
108108

109-
# Try to get latest release info
109+
# Try to get nightly release info
110110
if command_exists curl; then
111111
RELEASE_INFO=$(curl -sL "$GITHUB_RELEASES_URL" 2>/dev/null || echo "")
112112
else
113113
RELEASE_INFO=$(wget -qO- "$GITHUB_RELEASES_URL" 2>/dev/null || echo "")
114114
fi
115115

116116
if [ -z "$RELEASE_INFO" ]; then
117-
echo -e "${RED}✗ Could not fetch release information from GitHub${NC}"
117+
echo -e "${RED}✗ Could not fetch nightly release information from GitHub${NC}"
118118
echo -e "${YELLOW}This might be because:${NC}"
119-
echo -e "${YELLOW} - No releases have been published yet${NC}"
119+
echo -e "${YELLOW} - Nightly build hasn't been published yet${NC}"
120120
echo -e "${YELLOW} - Network connectivity issues${NC}"
121121
echo ""
122-
echo "Please check: https://github.com/${GITHUB_REPO}/releases"
122+
echo "Please check: https://github.com/${GITHUB_REPO}/releases/tag/nightly"
123123
exit 1
124124
fi
125125

@@ -129,18 +129,19 @@ DOWNLOAD_URL=$(echo "$RELEASE_INFO" | grep -o "https://.*cmd-sandbox-${ARCH_SUFF
129129
if [ -z "$DOWNLOAD_URL" ]; then
130130
echo -e "${RED}✗ No pre-built binary found for architecture: ${ARCH}${NC}"
131131
echo ""
132-
echo "Please check: https://github.com/${GITHUB_REPO}/releases"
132+
echo "Please check: https://github.com/${GITHUB_REPO}/releases/tag/nightly"
133133
echo ""
134134
echo "Or build from source:"
135135
echo " git clone https://github.com/${GITHUB_REPO}.git"
136-
echo " cd curl_sandbox-rs"
136+
echo " cd cmd_sandbox-rs"
137137
echo " cargo build --release"
138138
exit 1
139139
fi
140140

141141
RELEASE_TAG=$(echo "$RELEASE_INFO" | grep -o '"tag_name": *"[^"]*"' | head -1 | sed 's/"tag_name": *"\(.*\)"/\1/')
142142

143-
echo -e "${GREEN}✓ Found release: $RELEASE_TAG${NC}"
143+
echo -e "${GREEN}✓ Found nightly build${NC}"
144+
echo -e "${BLUE} Release: $RELEASE_TAG${NC}"
144145
echo -e "${BLUE} URL: $DOWNLOAD_URL${NC}"
145146
echo ""
146147

@@ -257,7 +258,199 @@ chmod +x "$INSTALL_DIR/cmd_sandbox"
257258
cd /
258259
rm -rf "$TEMP_DIR"
259260

260-
echo -e "${GREEN}✓ Installation complete!${NC}"
261+
echo -e "${GREEN}✓ Binaries installed successfully!${NC}"
262+
echo ""
263+
264+
# Check kernel requirements (NECESSARY)
265+
echo -e "${BLUE}[Checking System Requirements]${NC}"
266+
echo ""
267+
268+
KERNEL_ISSUES=()
269+
270+
# Check kernel version
271+
KERNEL_MAJOR=$(echo "$KERNEL_VERSION" | cut -d. -f1)
272+
KERNEL_MINOR=$(echo "$KERNEL_VERSION" | cut -d. -f2)
273+
274+
if [ "$KERNEL_MAJOR" -lt 5 ] || ([ "$KERNEL_MAJOR" -eq 5 ] && [ "$KERNEL_MINOR" -lt 7 ]); then
275+
echo -e "${RED}✗ Kernel version: $KERNEL_VERSION (requires 5.7+)${NC}"
276+
KERNEL_ISSUES+=("Kernel version too old (need 5.7+)")
277+
else
278+
echo -e "${GREEN}✓ Kernel version: $KERNEL_VERSION${NC}"
279+
fi
280+
281+
# Check BPF LSM
282+
BPF_LSM_ENABLED=false
283+
if [ -f /proc/cmdline ]; then
284+
if grep -q "lsm=.*bpf" /proc/cmdline || grep -q "bpf" /sys/kernel/security/lsm 2>/dev/null; then
285+
echo -e "${GREEN}✓ BPF LSM is enabled${NC}"
286+
BPF_LSM_ENABLED=true
287+
else
288+
echo -e "${RED}✗ BPF LSM is NOT enabled${NC}"
289+
KERNEL_ISSUES+=("BPF LSM not enabled in kernel")
290+
fi
291+
fi
292+
293+
# Check cgroup v2
294+
if mount | grep -q "cgroup2"; then
295+
echo -e "${GREEN}✓ cgroup v2 is mounted${NC}"
296+
else
297+
echo -e "${YELLOW}⚠ cgroup v2 is NOT mounted${NC}"
298+
KERNEL_ISSUES+=("cgroup v2 not mounted")
299+
fi
300+
301+
echo ""
302+
303+
# Function to ask for permission
304+
ask_permission() {
305+
local prompt="$1"
306+
echo -e "${YELLOW}${prompt}${NC}"
307+
read -p "Continue? (y/n): " -n 1 -r
308+
echo
309+
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
310+
return 1
311+
fi
312+
return 0
313+
}
314+
315+
# If there are kernel issues, offer to fix them
316+
if [ ${#KERNEL_ISSUES[@]} -ne 0 ]; then
317+
echo -e "${YELLOW}═══════════════════════════════════════════════════════════════${NC}"
318+
echo -e "${YELLOW} System Configuration Required${NC}"
319+
echo -e "${YELLOW}═══════════════════════════════════════════════════════════════${NC}"
320+
echo ""
321+
322+
for issue in "${KERNEL_ISSUES[@]}"; do
323+
echo -e " ${RED}✗${NC} $issue"
324+
done
325+
echo ""
326+
327+
if [ "$BPF_LSM_ENABLED" = false ]; then
328+
echo -e "${RED}BPF LSM is NOT enabled - this is CRITICAL!${NC}"
329+
echo ""
330+
echo "The sandbox will NOT work without BPF LSM enabled."
331+
echo ""
332+
echo "Actions that will be performed:"
333+
echo " 1. Backup your current GRUB configuration"
334+
echo " 2. Edit /etc/default/grub to add BPF LSM"
335+
echo " 3. Update GRUB bootloader"
336+
echo " 4. You will need to REBOOT your system"
337+
echo ""
338+
echo -e "${YELLOW}Current LSMs: $(cat /sys/kernel/security/lsm 2>/dev/null || echo 'unknown')${NC}"
339+
echo ""
340+
echo "We will add 'bpf' to your existing LSM configuration."
341+
echo ""
342+
343+
if ask_permission "Configure BPF LSM now? (requires sudo and REBOOT)"; then
344+
echo ""
345+
echo -e "${BLUE}Configuring BPF LSM...${NC}"
346+
347+
# Backup GRUB config
348+
echo -e "${BLUE}Creating backup of /etc/default/grub...${NC}"
349+
sudo cp /etc/default/grub /etc/default/grub.backup.$(date +%Y%m%d_%H%M%S)
350+
echo -e "${GREEN}✓ Backup created${NC}"
351+
352+
# Get current LSM setting
353+
CURRENT_LSM=$(cat /sys/kernel/security/lsm 2>/dev/null || echo "")
354+
355+
if [ -n "$CURRENT_LSM" ]; then
356+
# Add bpf to existing LSMs
357+
NEW_LSM="${CURRENT_LSM},bpf"
358+
else
359+
# Default LSM configuration with bpf
360+
NEW_LSM="lockdown,yama,integrity,apparmor,bpf"
361+
fi
362+
363+
echo -e "${BLUE}Adding BPF LSM to kernel parameters...${NC}"
364+
365+
# Check if lsm= already exists in GRUB_CMDLINE_LINUX
366+
if sudo grep -q 'GRUB_CMDLINE_LINUX.*lsm=' /etc/default/grub; then
367+
# Replace existing lsm= parameter
368+
sudo sed -i "s/lsm=[^ \"]*/lsm=${NEW_LSM}/" /etc/default/grub
369+
else
370+
# Add lsm= parameter
371+
sudo sed -i "s/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"lsm=${NEW_LSM} /" /etc/default/grub
372+
fi
373+
374+
echo -e "${GREEN}✓ GRUB configuration updated${NC}"
375+
echo ""
376+
377+
# Update GRUB
378+
echo -e "${BLUE}Updating GRUB bootloader...${NC}"
379+
if [ -f /etc/debian_version ]; then
380+
sudo update-grub
381+
elif [ -f /etc/fedora-release ] || [ -f /etc/redhat-release ]; then
382+
sudo grub2-mkconfig -o /boot/grub2/grub.cfg
383+
else
384+
echo -e "${YELLOW}Unknown distribution. Please run update-grub manually.${NC}"
385+
fi
386+
echo -e "${GREEN}✓ GRUB updated${NC}"
387+
echo ""
388+
389+
echo -e "${GREEN}══════════════════════════════════════════════════════════════${NC}"
390+
echo -e "${GREEN} BPF LSM Configuration Complete!${NC}"
391+
echo -e "${GREEN}══════════════════════════════════════════════════════════════${NC}"
392+
echo ""
393+
echo -e "${RED}IMPORTANT: You MUST reboot your system for changes to take effect.${NC}"
394+
echo ""
395+
echo "After reboot, verify with:"
396+
echo -e " ${YELLOW}cat /sys/kernel/security/lsm${NC}"
397+
echo ""
398+
echo "It should include 'bpf' in the output."
399+
echo ""
400+
401+
read -p "Reboot now? (y/n): " -n 1 -r
402+
echo
403+
if [[ $REPLY =~ ^[Yy]$ ]]; then
404+
echo -e "${BLUE}Rebooting in 5 seconds... (Ctrl+C to cancel)${NC}"
405+
sleep 5
406+
sudo reboot
407+
else
408+
echo -e "${YELLOW}Please reboot manually for changes to take effect.${NC}"
409+
echo ""
410+
echo "After reboot, run 'cmd_sandbox run' to start the sandbox."
411+
exit 0
412+
fi
413+
else
414+
echo -e "${YELLOW}Skipping BPF LSM configuration.${NC}"
415+
echo ""
416+
echo "To enable BPF LSM manually:"
417+
echo ""
418+
echo " 1. Edit GRUB configuration:"
419+
echo -e " ${YELLOW}sudo nano /etc/default/grub${NC}"
420+
echo ""
421+
echo " 2. Add/modify GRUB_CMDLINE_LINUX to include:"
422+
echo -e " ${YELLOW}lsm=lockdown,yama,integrity,apparmor,bpf${NC}"
423+
echo " (adjust based on your current LSMs)"
424+
echo ""
425+
echo " 3. Update GRUB:"
426+
echo -e " ${YELLOW}sudo update-grub${NC} # Debian/Ubuntu"
427+
echo -e " ${YELLOW}sudo grub2-mkconfig -o /boot/grub2/grub.cfg${NC} # Fedora/RHEL"
428+
echo ""
429+
echo " 4. Reboot:"
430+
echo -e " ${YELLOW}sudo reboot${NC}"
431+
echo ""
432+
fi
433+
fi
434+
435+
# Check cgroup v2
436+
if ! mount | grep -q "cgroup2"; then
437+
echo -e "${YELLOW}⚠ cgroup v2 is not mounted.${NC}"
438+
echo ""
439+
echo "Most modern distributions enable this by default."
440+
echo "Check your distribution documentation for enabling cgroup v2."
441+
echo ""
442+
echo -e "${YELLOW}This is required for memory and CPU limits.${NC}"
443+
echo ""
444+
fi
445+
446+
# Check kernel version
447+
if [ "$KERNEL_MAJOR" -lt 5 ] || ([ "$KERNEL_MAJOR" -eq 5 ] && [ "$KERNEL_MINOR" -lt 7 ]); then
448+
echo -e "${RED}Your kernel version is too old.${NC}"
449+
echo "Please upgrade to kernel 5.7 or newer."
450+
echo ""
451+
fi
452+
fi
453+
261454
echo ""
262455

263456
# Final instructions

0 commit comments

Comments
 (0)