src/lxc/lxc-setcap.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  22
  23 #
  24 # This script allows to set or remove the capabilities on the lxc tools.
  25 # When the capabilities are set, a non root user can manage the containers.
  26 #
  27
  28 LXC_ATTACH_CAPS="cap_sys_admin,cap_dac_override"
  29 LXC_CREATE_CAPS="cap_sys_admin"
  30 LXC_NETSTAT_CAPS="cap_sys_admin"
  31 LXC_INIT_CAPS="cap_sys_admin,cap_dac_override"
  32 LXC_COMMON_CAPS="cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override"
  33 LXC_UNSHARE_CAPS=$LXC_COMMON_CAPS
  34 LXC_START_CAPS="$LXC_COMMON_CAPS,cap_fowner,cap_sys_chroot,cap_setpcap"
  35 LXC_EXECUTE_CAPS=$LXC_START_CAPS
  36 LXC_RESTART_CAPS="$LXC_START_CAPS,cap_mknod"
  37 LXC_CHECKPOINT_CAPS="$LXC_COMMON_CAPS,cap_sys_ptrace,cap_mknod"
  38 LXC_DROP_CAPS=""
  39
  40 usage()
  41 {
  42     echo "lxc-setcap [-d] : set or remove capabilities on the lxc tools"
  43 }
  44
  45 lxc_setcaps()
  46 {
  47     setcap $LXC_ATTACH_CAPS=ep @BINDIR@/lxc-attach
  48     setcap $LXC_CREATE_CAPS=ep @BINDIR@/lxc-create
  49     setcap $LXC_EXECUTE_CAPS=ep @BINDIR@/lxc-execute
  50     setcap $LXC_START_CAPS=ep @BINDIR@/lxc-start
  51     setcap $LXC_RESTART_CAPS=ep @BINDIR@/lxc-restart
  52     setcap $LXC_UNSHARE_CAPS=ep @BINDIR@/lxc-unshare
  53     setcap $LXC_NETSTAT_CAPS=ep @BINDIR@/lxc-netstat
  54     setcap $LXC_CHECKPOINT_CAPS=ep @BINDIR@/lxc-checkpoint
  55     setcap $LXC_INIT_CAPS=ep @LXCINITDIR@/lxc-init
  56
  57     test -e @LXCPATH@ || mkdir -p @LXCPATH@
  58     chmod 0777 @LXCPATH@
  59 }
  60
  61 lxc_dropcaps()
  62 {
  63     setcap -r @BINDIR@/lxc-attach
  64     setcap -r @BINDIR@/lxc-create
  65     setcap -r @BINDIR@/lxc-execute
  66     setcap -r @BINDIR@/lxc-start
  67     setcap -r @BINDIR@/lxc-restart
  68     setcap -r @BINDIR@/lxc-unshare
  69     setcap -r @BINDIR@/lxc-netstat
  70     setcap -r @BINDIR@/lxc-checkpoint
  71     setcap -r @LXCINITDIR@/lxc-init
  72     chmod 0755 @LXCPATH@
  73 }
  74
  75 if [ "$(id -u)" != "0" ]; then
  76     echo "You have to be root to run this script"
  77     exit 1
  78 fi
  79
  80
  81 if [ $? != 0 ]; then
  82     usage
  83     exit 1
  84 fi
  85
  86 set -- $(getopt dh $*)
  87
  88 for i in $*; do
  89     case "$1" in
  90         -d)
  91             LXC_DROP_CAPS="yes"
  92             shift
  93             ;;
  94         -h)
  95             usage
  96             exit 0
  97             ;;
  98         --)
  99             shift
 100             break
 101             ;;
 102         *)
 103             usage
 104             exit 1
 105             ;;
 106     esac
 107 done;
 108
 109 if [ -z "$LXC_DROP_CAPS" ]; then
 110     lxc_setcaps
 111 else
 112     lxc_dropcaps
 113 fi