templates/lxc-busybox.in

   1 #!/bin/sh
   2
   3 # Client script for LXC container images.
   4 #
   5 # Copyright @ Daniel Lezcano <daniel.lezcano@free.fr>
   6 # Copyright © 2018 Christian Brauner <christian.brauner@ubuntu.com>
   7 #
   8 #  This library is free software; you can redistribute it and/or
   9 #  modify it under the terms of the GNU Lesser General Public
  10 #  License as published by the Free Software Foundation; either
  11 #  version 2.1 of the License, or (at your option) any later version.
  12
  13 #  This library is distributed in the hope that it will be useful,
  14 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 #  Lesser General Public License for more details.
  17
  18 #  You should have received a copy of the GNU Lesser General Public
  19 #  License along with this library; if not, write to the Free Software
  20 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  21 #  USA
  22
  23 LXC_MAPPED_UID=
  24 LXC_MAPPED_GID=
  25
  26 BUSYBOX_EXE=`which busybox`
  27
  28 # Make sure the usual locations are in PATH
  29 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  30
  31 in_userns() {
  32   [ -e /proc/self/uid_map ] || { echo no; return; }
  33   while read -r line; do
  34     fields="$(echo "$line" | awk '{ print $1 " " $2 " " $3 }')"
  35     if [ "${fields}" = "0 0 4294967295" ]; then
  36       echo no;
  37       return;
  38     fi
  39     if echo "${fields}" | grep -q " 0 1$"; then
  40       echo userns-root;
  41       return;
  42     fi
  43   done < /proc/self/uid_map
  44
  45   [ "$(cat /proc/self/uid_map)" = "$(cat /proc/1/uid_map)" ] && { echo userns-root; return; }
  46   echo yes
  47 }
  48
  49 USERNS="$(in_userns)"
  50
  51 install_busybox()
  52 {
  53   rootfs="${1}"
  54   name="${2}"
  55   res=0
  56   fstree="\
  57 ${rootfs}/selinux \
  58 ${rootfs}/dev \
  59 ${rootfs}/home \
  60 ${rootfs}/root \
  61 ${rootfs}/etc \
  62 ${rootfs}/etc/init.d \
  63 ${rootfs}/bin \
  64 ${rootfs}/usr/bin \
  65 ${rootfs}/sbin \
  66 ${rootfs}/usr/sbin \
  67 ${rootfs}/proc \
  68 ${rootfs}/sys \
  69 ${rootfs}/mnt \
  70 ${rootfs}/tmp \
  71 ${rootfs}/var/log \
  72 ${rootfs}/var/run \
  73 ${rootfs}/usr/share/udhcpc \
  74 ${rootfs}/dev/pts \
  75 ${rootfs}/dev/shm \
  76 ${rootfs}/lib \
  77 ${rootfs}/usr/lib \
  78 ${rootfs}/lib64 \
  79 ${rootfs}/usr/lib64"
  80
  81   # shellcheck disable=SC2086
  82   mkdir -p ${fstree} || return 1
  83   # shellcheck disable=SC2086
  84   chmod 755 ${fstree} || return 1
  85
  86   # minimal devices needed for busybox
  87   if [ "${USERNS}" = "yes" ]; then
  88     for dev in tty console tty0 tty1 ram0 null urandom; do
  89       echo "lxc.mount.entry = /dev/${dev} dev/${dev} none bind,optional,create=file 0 0" >> "${path}/config"
  90     done
  91   else
  92     mknod -m 666 "${rootfs}/dev/tty" c 5 0       || res=1
  93     mknod -m 666 "${rootfs}/dev/console" c 5 1   || res=1
  94     mknod -m 666 "${rootfs}/dev/tty0" c 4 0      || res=1
  95     mknod -m 666 "${rootfs}/dev/tty1" c 4 0      || res=1
  96     mknod -m 666 "${rootfs}/dev/tty5" c 4 0      || res=1
  97     mknod -m 600 "${rootfs}/dev/ram0" b 1 0      || res=1
  98     mknod -m 666 "${rootfs}/dev/null" c 1 3      || res=1
  99     mknod -m 666 "${rootfs}/dev/zero" c 1 5      || res=1
 100     mknod -m 666 "${rootfs}/dev/urandom" c 1 9   || res=1
 101   fi
 102
 103   # make /tmp accessible to any user (with sticky bit)
 104   chmod 1777 "${rootfs}/tmp" || return 1
 105
 106   # root user defined
 107   cat <<EOF >> "${rootfs}/etc/passwd"
 108 root:x:0:0:root:/root:/bin/sh
 109 EOF
 110
 111   cat <<EOF >> "${rootfs}/etc/group"
 112 root:x:0:root
 113 EOF
 114
 115     # mount everything
 116   cat <<EOF >> "${rootfs}/etc/init.d/rcS"
 117 #!/bin/sh
 118 /bin/syslogd
 119 /bin/mount -a
 120 /bin/udhcpc
 121 EOF
 122
 123   # executable
 124   chmod 744 "${rootfs}/etc/init.d/rcS" || return 1
 125
 126   # launch rcS first then make a console available
 127   # and propose a shell on the tty, the last one is
 128   # not needed
 129   cat <<EOF >> "${rootfs}/etc/inittab"
 130 ::sysinit:/etc/init.d/rcS
 131 tty1::respawn:/bin/getty -L tty1 115200 vt100
 132 console::askfirst:/bin/sh
 133 EOF
 134   # writable and readable for other
 135   chmod 644 "${rootfs}/etc/inittab" || return 1
 136
 137   # Look for the pathname of "default.script" from the help of udhcpc
 138   DEF_SCRIPT=`${BUSYBOX_EXE} udhcpc -h 2>&1 | grep -- '-s,--script PROG' | cut -d'/' -f2- | cut -d')' -f1`
 139   DEF_SCRIPT_DIR=`dirname /${DEF_SCRIPT}`
 140   mkdir -p ${rootfs}/${DEF_SCRIPT_DIR}
 141   chmod 644 ${rootfs}/${DEF_SCRIPT_DIR} || return 1
 142
 143   cat <<EOF >> ${rootfs}/${DEF_SCRIPT}
 144 #!/bin/sh
 145 case "\$1" in
 146   deconfig)
 147     ip addr flush dev \$interface
 148     ;;
 149
 150   renew|bound)
 151     # flush all the routes
 152     if [ -n "\$router" ]; then
 153       ip route del default 2> /dev/null
 154     fi
 155
 156     # check broadcast
 157     if [ -n "\$broadcast" ]; then
 158       broadcast="broadcast \$broadcast"
 159     fi
 160
 161     # add a new ip address
 162     ip addr add \$ip/\$mask \$broadcast dev \$interface
 163
 164     if [ -n "\$router" ]; then
 165       ip route add default via \$router dev \$interface
 166     fi
 167
 168     [ -n "\$domain" ] && echo search \$domain > /etc/resolv.conf
 169     for i in \$dns ; do
 170       grep "nameserver \$i" /etc/resolv.conf > /dev/null 2>&1
 171       if [ \$? -ne 0 ]; then
 172         echo nameserver \$i >> /etc/resolv.conf
 173       fi
 174     done
 175     ;;
 176 esac
 177 exit 0
 178 EOF
 179
 180  chmod 744 ${rootfs}/${DEF_SCRIPT}
 181
 182  return "${res}"
 183 }
 184
 185 configure_busybox()
 186 {
 187   rootfs="${1}"
 188
 189   # copy busybox in the rootfs
 190   if ! cp "${BUSYBOX_EXE}" "${rootfs}/bin"; then
 191     echo "ERROR: Failed to copy busybox binary" 1>&2
 192     return 1
 193   fi
 194
 195   # symlink busybox for the commands it supports
 196   # it would be nice to just use "chroot $rootfs busybox --install -s /bin"
 197   # but that only works right in a chroot with busybox >= 1.19.0
 198   (
 199     cd "${rootfs}/bin" || return 1
 200     ./busybox --list | grep -v busybox | xargs -n1 ln -s busybox
 201   )
 202
 203   # relink /sbin/init
 204   ln "${rootfs}/bin/busybox" "${rootfs}/sbin/init"
 205
 206   # /etc/fstab must exist for "mount -a"
 207   touch "${rootfs}/etc/fstab"
 208
 209   # passwd exec must be setuid
 210   chmod +s "${rootfs}/bin/passwd"
 211   touch "${rootfs}/etc/shadow"
 212
 213   return 0
 214 }
 215
 216 copy_configuration()
 217 {
 218   path="${1}"
 219   rootfs="${2}"
 220   name="${3}"
 221
 222 grep -q "^lxc.rootfs.path" "${path}/config" 2>/dev/null || echo "lxc.rootfs.path = ${rootfs}" >> "${path}/config"
 223 cat <<EOF >> "${path}/config"
 224 lxc.signal.halt = SIGUSR1
 225 lxc.signal.reboot = SIGTERM
 226 lxc.uts.name = "${name}"
 227 lxc.tty.max = 1
 228 lxc.pty.max = 1
 229 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 230
 231 # When using LXC with apparmor, uncomment the next line to run unconfined:
 232 #lxc.apparmor.profile = unconfined
 233
 234 lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 235 lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
 236 EOF
 237
 238   libdirs="\
 239     lib \
 240     usr/lib \
 241     lib64 \
 242     usr/lib64"
 243
 244   for dir in ${libdirs}; do
 245     if [ -d "/${dir}" ] && [ -d "${rootfs}/${dir}" ]; then
 246       echo "lxc.mount.entry = /${dir} ${dir} none ro,bind 0 0" >> "${path}/config"
 247     fi
 248   done
 249   echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >> "${path}/config"
 250 }
 251
 252 remap_userns()
 253 {
 254  path="${1}"
 255
 256  if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
 257    chown "${LXC_MAPPED_UID}" "${path}/config" > /dev/null 2>&1
 258    chown -R root "${path}/rootfs" > /dev/null 2>&1
 259  fi
 260
 261  if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
 262    chgrp "${LXC_MAPPED_GID}" "${path}/config" > /dev/null 2>&1
 263    chgrp -R root "${path}/rootfs" > /dev/null 2>&1
 264  fi
 265 }
 266
 267 usage() {
 268   cat <<EOF
 269 LXC busybox image builder
 270
 271 Special arguments:
 272
 273   [ -h | --help ]: Print this help message and exit.
 274
 275 LXC internal arguments:
 276
 277   [ --name <name> ]: The container name
 278   [ --path <path> ]: The path to the container
 279   [ --rootfs <rootfs> ]: The path to the container's rootfs (default: config or <path>/rootfs)
 280   [ --mapped-uid <map> ]: A uid map (user namespaces)
 281   [ --mapped-gid <map> ]: A gid map (user namespaces)
 282
 283 BUSYBOX template specific arguments:
 284
 285   [ --busybox-path <path> ]: busybox pathname (default: ${BUSYBOX_EXE})
 286
 287 EOF
 288   return 0
 289 }
 290
 291 if ! options=$(getopt -o hp:n: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid:,busybox-path: -- "$@"); then
 292   usage
 293   exit 1
 294 fi
 295 eval set -- "$options"
 296
 297 while true
 298 do
 299   case "$1" in
 300     -h|--help)    usage && exit 0;;
 301     -n|--name)    name=$2; shift 2;;
 302     -p|--path)    path=$2; shift 2;;
 303     --rootfs)     rootfs=$2; shift 2;;
 304     --mapped-uid) LXC_MAPPED_UID=$2; shift 2;;
 305     --mapped-gid) LXC_MAPPED_GID=$2; shift 2;;
 306     --busybox-path) BUSYBOX_EXE=$2; shift 2;;
 307     --)           shift 1; break ;;
 308     *)            break ;;
 309   esac
 310 done
 311
 312 # Check that we have all variables we need
 313 if [ -z "${name}" ] || [ -z "${path}" ]; then
 314     echo "ERROR: Please pass the name and path for the container" 1>&2
 315     exit 1
 316 fi
 317
 318 # Make sure busybox is present
 319 if [ -z "${BUSYBOX_EXE}" ]; then
 320     echo "ERROR: Please pass a pathname for busybox binary" 1>&2
 321     exit 1
 322 fi
 323 if [ ! -x "${BUSYBOX_EXE}" ]; then
 324     echo "ERROR: Failed to find busybox binary (${BUSYBOX_EXE})" 1>&2
 325     exit 1
 326 fi
 327
 328 # detect rootfs
 329 config="$path/config"
 330 if [ -z "$rootfs" ]; then
 331   if grep -q '^lxc.rootfs.path' "${config}" 2> /dev/null ; then
 332     rootfs=$(awk -F= '/^lxc.rootfs.path =/{ print $2 }' "${config}")
 333   else
 334     rootfs="${path}/rootfs"
 335   fi
 336 fi
 337
 338 if ! install_busybox "${rootfs}" "${name}"; then
 339   echo "ERROR: Failed to install rootfs" 1>&2
 340   exit 1
 341 fi
 342
 343 if ! configure_busybox "${rootfs}"; then
 344   echo "ERROR: Failed to configure busybox" 1>&2
 345   exit 1
 346 fi
 347
 348 if ! copy_configuration "${path}" "${rootfs}" "${name}"; then
 349   echo "ERROR: Failed to write config file" 1>&2
 350   exit 1
 351 fi
 352
 353 if ! remap_userns "${path}"; then
 354   echo "ERROR: Failed to change idmappings" 1>&2
 355   exit 1
 356 fi