src/lxc/lxc-setcap.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22
  23 #
  24 # This script allows to set or remove the capabilities on the lxc tools.
  25 # When the capabilities are set, a non root user can manage the containers.
  26 #
  27
  28 LXC_ATTACH_CAPS="cap_sys_admin,cap_dac_override"
  29 LXC_CREATE_CAPS="cap_sys_admin"
  30 LXC_NETSTAT_CAPS="cap_sys_admin"
  31 LXC_INIT_CAPS="cap_sys_admin,cap_dac_override"
  32 LXC_COMMON_CAPS="cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override"
  33 LXC_UNSHARE_CAPS=$LXC_COMMON_CAPS
  34 LXC_START_CAPS="$LXC_COMMON_CAPS,cap_fowner,cap_sys_chroot,cap_setpcap"
  35 LXC_EXECUTE_CAPS=$LXC_START_CAPS
  36 LXC_RESTART_CAPS="$LXC_START_CAPS,cap_mknod"
  37 LXC_CHECKPOINT_CAPS="$LXC_COMMON_CAPS,cap_sys_ptrace,cap_mknod"
  38 LXC_DROP_CAPS=""
  39
  40 usage() {
  41     echo "usage: $(basename $0) [-d]" >&2
  42 }
  43
  44 help() {
  45     usage
  46     echo >&2
  47     echo "Set or drop file capabilities on the lxc tools." >&2
  48     echo >&2
  49     echo "Options:" >&2
  50     echo "  -d   drop file capabilities" >&2
  51 }
  52
  53 lxc_setcaps()
  54 {
  55     setcap $LXC_ATTACH_CAPS=ep @BINDIR@/lxc-attach
  56     setcap $LXC_CREATE_CAPS=ep @BINDIR@/lxc-create
  57     setcap $LXC_EXECUTE_CAPS=ep @BINDIR@/lxc-execute
  58     setcap $LXC_START_CAPS=ep @BINDIR@/lxc-start
  59     setcap $LXC_RESTART_CAPS=ep @BINDIR@/lxc-restart
  60     setcap $LXC_UNSHARE_CAPS=ep @BINDIR@/lxc-unshare
  61     setcap $LXC_NETSTAT_CAPS=ep @BINDIR@/lxc-netstat
  62     setcap $LXC_CHECKPOINT_CAPS=ep @BINDIR@/lxc-checkpoint
  63     setcap $LXC_INIT_CAPS=ep @LXCINITDIR@/lxc-init
  64
  65     test -e @LXCPATH@ || mkdir -p @LXCPATH@
  66     chmod 0777 @LXCPATH@
  67 }
  68
  69 lxc_dropcaps()
  70 {
  71     setcap -r @BINDIR@/lxc-attach
  72     setcap -r @BINDIR@/lxc-create
  73     setcap -r @BINDIR@/lxc-execute
  74     setcap -r @BINDIR@/lxc-start
  75     setcap -r @BINDIR@/lxc-restart
  76     setcap -r @BINDIR@/lxc-unshare
  77     setcap -r @BINDIR@/lxc-netstat
  78     setcap -r @BINDIR@/lxc-checkpoint
  79     setcap -r @LXCINITDIR@/lxc-init
  80
  81     chmod 0755 @LXCPATH@
  82 }
  83
  84 shortoptions='hd'
  85 longoptions='help'
  86
  87 getopt=$(getopt -o $shortoptions --longoptions  $longoptions -- "$@")
  88 if [ $? != 0 ]; then
  89     usage
  90     exit 1
  91 fi
  92
  93 eval set -- "$getopt"
  94
  95 while true; do
  96     case "$1" in
  97         -d)
  98             LXC_DROP_CAPS="yes"
  99             shift
 100             ;;
 101         -h|--help)
 102             help
 103             exit 0
 104             ;;
 105         --)
 106             shift
 107             break
 108             ;;
 109         *)
 110             usage
 111             exit 1
 112             ;;
 113     esac
 114 done;
 115
 116 if [ "$(id -u)" != "0" ]; then
 117    echo "$(basename $0): must be run as root" >&2
 118    exit 1
 119 fi
 120
 121 if [ -z "$LXC_DROP_CAPS" ]; then
 122     lxc_setcaps
 123 else
 124     lxc_dropcaps
 125 fi