4.4BSD project.

sourcezap manages a local copy of the BSD source tree. It provides consistent ownership and permissions for the source tree, keeps a clean separation between root-only operations and unprivileged operations, and offers a simple clone, pull, and install workflow.

Every sourcezap command can be run as root. For the commands that touch the git source tree, sourcezap drops privileges to the dedicated _sourcezap user, so git never runs with elevated privileges. The default source tree is HardenedBSD, but sourcezap works with any git URL. The same workflow can manage the FreeBSD source tree by setting SOURCEZAP_CLONEURL.

Install

pkg(8)

pkg install sourcezap works on HardenedBSD.
sourcezap is also available from the HardenedBSD ports tree.

git(1)

The first step is to clone the repository.
Afterwards sourcezap can be installed (and deinstalled) through make:

git clone https://github.com/4-4BSD/sourcezap
cd sourcezap
make install
make deinstall

Quick start

Run as root or as a member of the _sourcezap group.
Delegate to the _sourcezap user.

##
# Run once
# As root
sysrc -f /boot/loader.conf mac_do_load="YES"
sysrc sourcezap_enable="YES"
kldload mac_do
sourcezap setup
service sourcezap start

##
# Everyday usage
# As root / member of _sourcezap group
# All commands delegated to _sourcezap user
sourcezap clone
sourcezap install
sourcezap pull

##
# Drop into a shell
# As root / member of the _sourcezap group
# Run as the _sourcezap user
sourcezap sh

Tunables

SOURCEZAP_CLONEURL

The git repository URL cloned by sourcezap clone.

Default:

https://rad.hardenedbsd.org/z2HLHXgL1xevBNQsf8BmQW7MpJmtm.git

SOURCEZAP_INSTALLDIR

The directory where the source tree is installed by sourcezap install.

Default:

/usr/src

mac_do(4)

The mac_do(4) policy must be loaded into the kernel before sourcezap can use mdo(1). Add it to /boot/loader.conf and reboot:

mac_do_load="YES"

Or load it manually without a reboot:

kldload mac_do

rc.d

The rc.d script manages the sourcezap mac_do(4) rules:

sysrc sourcezap_enable="YES"
service sourcezap start

Managing a different source tree

sourcezap is not limited to HardenedBSD. Set SOURCEZAP_CLONEURL to any git repository before running sourcezap clone, and the same clone, pull, and install workflow applies. Run the commands as root: clone and pull drop privileges to _sourcezap, while install stays root-only. For example, to manage the FreeBSD source tree:

export SOURCEZAP_CLONEURL=https://git.FreeBSD.org/src.git
sourcezap clone
sourcezap pull
sourcezap install

The GitHub mirror works too:

export SOURCEZAP_CLONEURL=https://github.com/freebsd/freebsd-src.git
sourcezap clone

When the HardenedBSD-specific branch is not present in the configured repository, sourcezap falls back to the repository's default branch.

Requirements

• mdo
• mac_do
• git
• rsync

License

BSD Zero Clause
See LICENSE