templates/lxc-busybox.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  22
  23 am_in_userns() {
  24     [ -e /proc/self/uid_map ] || { echo no; return; }
  25     [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }
  26     line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
  27     [ "$line" = "0 0 4294967295" ] && { echo no; return; }
  28     echo yes
  29 }
  30
  31 in_userns=0
  32 [ $(am_in_userns) = "yes" ] && in_userns=1
  33
  34 install_busybox()
  35 {
  36     rootfs=$1
  37     name=$2
  38     res=0
  39     tree="\
  40 $rootfs/selinux \
  41 $rootfs/dev \
  42 $rootfs/home \
  43 $rootfs/root \
  44 $rootfs/etc \
  45 $rootfs/etc/init.d \
  46 $rootfs/bin \
  47 $rootfs/usr/bin \
  48 $rootfs/sbin \
  49 $rootfs/usr/sbin \
  50 $rootfs/proc \
  51 $rootfs/sys \
  52 $rootfs/mnt \
  53 $rootfs/tmp \
  54 $rootfs/var/log \
  55 $rootfs/usr/share/udhcpc \
  56 $rootfs/dev/pts \
  57 $rootfs/dev/shm \
  58 $rootfs/lib \
  59 $rootfs/usr/lib \
  60 $rootfs/lib64 \
  61 $rootfs/usr/lib64"
  62
  63     mkdir -p $tree || return 1
  64     chmod 755 $tree || return 1
  65
  66     pushd $rootfs/dev > /dev/null || return 1
  67
  68     # minimal devices needed for busybox
  69     if [ $in_userns -eq 1 ]; then
  70         for dev in tty console tty0 tty1 tty5 ram0 null urandom; do
  71             touch $rootfs/dev/$dev
  72             echo "/dev/$dev dev/$dev    none bind 0 0" >> $path/fstab
  73         done
  74     else
  75         mknod -m 666 tty c 5 0       || res=1
  76         mknod -m 666 console c 5 1   || res=1
  77         mknod -m 666 tty0 c 4 0      || res=1
  78         mknod -m 666 tty1 c 4 0      || res=1
  79         mknod -m 666 tty5 c 4 0      || res=1
  80         mknod -m 600 ram0 b 1 0      || res=1
  81         mknod -m 666 null c 1 3      || res=1
  82         mknod -m 666 zero c 1 5      || res=1
  83         mknod -m 666 urandom c 1 9   || res=1
  84     fi
  85
  86     popd > /dev/null
  87
  88     # root user defined
  89     cat <<EOF >> $rootfs/etc/passwd
  90 root:x:0:0:root:/root:/bin/sh
  91 EOF
  92
  93     cat <<EOF >> $rootfs/etc/group
  94 root:x:0:root
  95 EOF
  96
  97     # mount everything
  98     cat <<EOF >> $rootfs/etc/init.d/rcS
  99 #!/bin/sh
 100 /bin/syslogd
 101 /bin/mount -a
 102 /bin/udhcpc
 103 EOF
 104
 105     # executable
 106     chmod 744 $rootfs/etc/init.d/rcS || return 1
 107
 108     # mount points
 109     cat <<EOF >> $rootfs/etc/fstab
 110 shm   /dev/shm   tmpfs   defaults     0      0
 111 EOF
 112
 113     # writable and readable for other
 114     chmod 644 $rootfs/etc/fstab || return 1
 115
 116     # launch rcS first then make a console available
 117     # and propose a shell on the tty, the last one is
 118     # not needed
 119     cat <<EOF >> $rootfs/etc/inittab
 120 ::sysinit:/etc/init.d/rcS
 121 tty1::respawn:/bin/getty -L tty1 115200 vt100
 122 console::askfirst:/bin/sh
 123 EOF
 124     # writable and readable for other
 125     chmod 644 $rootfs/etc/inittab || return 1
 126
 127     cat <<EOF >> $rootfs/usr/share/udhcpc/default.script
 128 #!/bin/sh
 129 case "\$1" in
 130     deconfig)
 131         ip addr flush dev \$interface
 132         ;;
 133
 134     renew|bound)
 135         # flush all the routes
 136         if [ -n "\$router" ]; then
 137             ip route del default 2> /dev/null
 138         fi
 139
 140         # check broadcast
 141         if [ -n "\$broadcast" ]; then
 142             broadcast="broadcast \$broadcast"
 143         fi
 144
 145         # add a new ip address
 146         ip addr add \$ip/\$mask \$broadcast dev \$interface
 147
 148         if [ -n "\$router" ]; then
 149             ip route add default via \$router dev \$interface
 150         fi
 151
 152         [ -n "\$domain" ] && echo search \$domain > /etc/resolv.conf
 153         for i in \$dns ; do
 154             echo nameserver \$i >> /etc/resolv.conf
 155         done
 156         ;;
 157 esac
 158 exit 0
 159 EOF
 160
 161     chmod 744 $rootfs/usr/share/udhcpc/default.script
 162
 163     return $res
 164 }
 165
 166 configure_busybox()
 167 {
 168     rootfs=$1
 169
 170     which busybox >/dev/null 2>&1
 171
 172     if [ $? -ne 0 ]; then
 173         echo "busybox executable is not accessible"
 174         return 1
 175     fi
 176
 177     file $(which busybox) | grep -q "statically linked"
 178     if [ $? -ne 0 ]; then
 179         echo "warning : busybox is not statically linked."
 180         echo "warning : The template script may not correctly"
 181         echo "warning : setup the container environment."
 182     fi
 183
 184     # copy busybox in the rootfs
 185     cp $(which busybox) $rootfs/bin
 186     if [ $? -ne 0 ]; then
 187         echo "failed to copy busybox in the rootfs"
 188         return 1
 189     fi
 190
 191     # symlink busybox for the commands it supports
 192     # it would be nice to just use "chroot $rootfs busybox --install -s /bin"
 193     # but that only works right in a chroot with busybox >= 1.19.0
 194     pushd $rootfs/bin > /dev/null || return 1
 195     ./busybox --help | grep 'Currently defined functions:' -A300 | \
 196       grep -v 'Currently defined functions:' | tr , '\n' | \
 197       xargs -n1 ln -s busybox
 198     popd > /dev/null
 199
 200     # relink /sbin/init
 201     ln $rootfs/bin/busybox $rootfs/sbin/init
 202
 203     # passwd exec must be setuid
 204     chmod +s $rootfs/bin/passwd
 205     touch $rootfs/etc/shadow
 206
 207     # setting passwd for root
 208     CHPASSWD_FILE=$rootfs/root/chpasswd.sh
 209
 210     cat <<EOF >$CHPASSWD_FILE
 211 echo "setting root password to \"root\""
 212
 213 mount -n --bind /lib $rootfs/lib
 214 if [ \$? -ne 0 ]; then
 215     echo "Failed bind-mounting /lib at $rootfs/lib"
 216     exit 1
 217 fi
 218
 219 chroot $rootfs chpasswd <<EOFF 2>/dev/null
 220 root:root
 221 EOFF
 222
 223
 224 if [ \$? -ne 0 ]; then
 225     echo "Failed to change root password"
 226     exit 1
 227 fi
 228
 229 umount $rootfs/lib
 230
 231 EOF
 232
 233     lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE
 234     rm $CHPASSWD_FILE
 235
 236     # add ssh functionality if dropbear package available on host
 237     which dropbear >/dev/null 2>&1
 238     if [ $? -eq 0 ]; then
 239         # copy dropbear binary
 240         cp $(which dropbear) $rootfs/usr/sbin
 241         if [ $? -ne 0 ]; then
 242             echo "Failed to copy dropbear in the rootfs"
 243             return 1
 244         fi
 245
 246         # make symlinks to various ssh utilities
 247         utils="\
 248             $rootfs/usr/bin/dbclient \
 249             $rootfs/usr/bin/scp \
 250             $rootfs/usr/bin/ssh \
 251             $rootfs/usr/sbin/dropbearkey \
 252             $rootfs/usr/sbin/dropbearconvert \
 253         "
 254         echo $utils | xargs -n1 ln -s /usr/sbin/dropbear
 255
 256         # add necessary config files
 257         mkdir $rootfs/etc/dropbear
 258         dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key &> /dev/null
 259         dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key &> /dev/null
 260
 261         echo "'dropbear' ssh utility installed"
 262     fi
 263
 264     return 0
 265 }
 266
 267 copy_configuration()
 268 {
 269     path=$1
 270     rootfs=$2
 271     name=$3
 272
 273 grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 274 cat <<EOF >> $path/config
 275 lxc.utsname = $name
 276 lxc.tty = 1
 277 lxc.pts = 1
 278 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 279
 280 # When using LXC with apparmor, uncomment the next line to run unconfined:
 281 #lxc.aa_profile = unconfined
 282 EOF
 283
 284     libdirs="\
 285         lib \
 286         usr/lib \
 287         lib64 \
 288         usr/lib64"
 289
 290     for dir in $libdirs; do
 291         if [ -d "/$dir" ] && [ -d "$rootfs/$dir" ]; then
 292             echo "lxc.mount.entry = /$dir $dir none ro,bind 0 0" >> $path/config
 293         fi
 294     done
 295     echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
 296     echo "lxc.mount.auto = proc:mixed sys" >>$path/config
 297 }
 298
 299 usage()
 300 {
 301     cat <<EOF
 302 $1 -h|--help -p|--path=<path>
 303 EOF
 304     return 0
 305 }
 306
 307 options=$(getopt -o hp:n: -l help,rootfs:,path:,name: -- "$@")
 308 if [ $? -ne 0 ]; then
 309     usage $(basename $0)
 310     exit 1
 311 fi
 312 eval set -- "$options"
 313
 314 while true
 315 do
 316     case "$1" in
 317         -h|--help)      usage $0 && exit 0;;
 318         -p|--path)      path=$2; shift 2;;
 319         --rootfs)       rootfs=$2; shift 2;;
 320         -n|--name)      name=$2; shift 2;;
 321         --)             shift 1; break ;;
 322         *)              break ;;
 323     esac
 324 done
 325
 326 if [ "$(id -u)" != "0" ]; then
 327     echo "This script should be run as 'root'"
 328     exit 1
 329 fi
 330
 331 if [ -z "$path" ]; then
 332     echo "'path' parameter is required"
 333     exit 1
 334 fi
 335
 336 # detect rootfs
 337 config="$path/config"
 338 if [ -z "$rootfs" ]; then
 339     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 340         rootfs=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $config)
 341     else
 342         rootfs=$path/rootfs
 343     fi
 344 fi
 345
 346 install_busybox $rootfs $name
 347 if [ $? -ne 0 ]; then
 348     echo "failed to install busybox's rootfs"
 349     exit 1
 350 fi
 351
 352 configure_busybox $rootfs
 353 if [ $? -ne 0 ]; then
 354     echo "failed to configure busybox template"
 355     exit 1
 356 fi
 357
 358 copy_configuration $path $rootfs $name
 359 if [ $? -ne 0 ]; then
 360     echo "failed to write configuration file"
 361     exit 1
 362 fi