templates/lxc-busybox.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  22
  23 LXC_MAPPED_UID=
  24 LXC_MAPPED_GID=
  25 SSH=
  26
  27 # Make sure the usual locations are in PATH
  28 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  29
  30 am_in_userns() {
  31     [ -e /proc/self/uid_map ] || { echo no; return; }
  32     [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }
  33     line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
  34     [ "$line" = "0 0 4294967295" ] && { echo no; return; }
  35     echo yes
  36 }
  37
  38 in_userns=0
  39 [ $(am_in_userns) = "yes" ] && in_userns=1
  40
  41 copy_binary()
  42 {
  43     binary_path=`which $1`
  44     if [ $? -ne 0 ]; then
  45         echo "Unable to find $1 binary on the system"
  46         return 1
  47     fi
  48
  49     dir_path="${binary_path%/*}"
  50     echo /{,usr/}{,s}bin | grep $dir_path >/dev/null 2>&1
  51     if [ $? -ne 0 ]; then
  52         echo "Binary $1 is located at $binary_path and will not be copied"
  53         echo "($dir_path not supported)"
  54         return 1
  55     fi
  56
  57     cp $binary_path $rootfs/$binary_path
  58     if [ $? -ne 0 ]; then
  59         echo "Failed to copy $binary_path to rootfs"
  60         return 1
  61     fi
  62
  63     return 0
  64 }
  65
  66 install_busybox()
  67 {
  68     rootfs=$1
  69     name=$2
  70     res=0
  71     tree="\
  72 $rootfs/selinux \
  73 $rootfs/dev \
  74 $rootfs/home \
  75 $rootfs/root \
  76 $rootfs/etc \
  77 $rootfs/etc/init.d \
  78 $rootfs/bin \
  79 $rootfs/usr/bin \
  80 $rootfs/sbin \
  81 $rootfs/usr/sbin \
  82 $rootfs/proc \
  83 $rootfs/sys \
  84 $rootfs/mnt \
  85 $rootfs/tmp \
  86 $rootfs/var/log \
  87 $rootfs/usr/share/udhcpc \
  88 $rootfs/dev/pts \
  89 $rootfs/dev/shm \
  90 $rootfs/lib \
  91 $rootfs/usr/lib \
  92 $rootfs/lib64 \
  93 $rootfs/usr/lib64"
  94
  95     mkdir -p $tree || return 1
  96     chmod 755 $tree || return 1
  97
  98     pushd $rootfs/dev > /dev/null || return 1
  99
 100     # minimal devices needed for busybox
 101     if [ $in_userns -eq 1 ]; then
 102         for dev in tty console tty0 tty1 ram0 null urandom; do
 103             echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
 104         done
 105     else
 106         mknod -m 666 tty c 5 0       || res=1
 107         mknod -m 666 console c 5 1   || res=1
 108         mknod -m 666 tty0 c 4 0      || res=1
 109         mknod -m 666 tty1 c 4 0      || res=1
 110         mknod -m 666 tty5 c 4 0      || res=1
 111         mknod -m 600 ram0 b 1 0      || res=1
 112         mknod -m 666 null c 1 3      || res=1
 113         mknod -m 666 zero c 1 5      || res=1
 114         mknod -m 666 urandom c 1 9   || res=1
 115     fi
 116
 117     popd > /dev/null
 118
 119     # root user defined
 120     cat <<EOF >> $rootfs/etc/passwd
 121 root:x:0:0:root:/root:/bin/sh
 122 EOF
 123
 124     cat <<EOF >> $rootfs/etc/group
 125 root:x:0:root
 126 EOF
 127
 128     # mount everything
 129     cat <<EOF >> $rootfs/etc/init.d/rcS
 130 #!/bin/sh
 131 /bin/syslogd
 132 /bin/mount -a
 133 /bin/udhcpc
 134 EOF
 135
 136     # executable
 137     chmod 744 $rootfs/etc/init.d/rcS || return 1
 138
 139     # launch rcS first then make a console available
 140     # and propose a shell on the tty, the last one is
 141     # not needed
 142     cat <<EOF >> $rootfs/etc/inittab
 143 ::sysinit:/etc/init.d/rcS
 144 tty1::respawn:/bin/getty -L tty1 115200 vt100
 145 console::askfirst:/bin/sh
 146 EOF
 147     # writable and readable for other
 148     chmod 644 $rootfs/etc/inittab || return 1
 149
 150     cat <<EOF >> $rootfs/usr/share/udhcpc/default.script
 151 #!/bin/sh
 152 case "\$1" in
 153     deconfig)
 154         ip addr flush dev \$interface
 155         ;;
 156
 157     renew|bound)
 158         # flush all the routes
 159         if [ -n "\$router" ]; then
 160             ip route del default 2> /dev/null
 161         fi
 162
 163         # check broadcast
 164         if [ -n "\$broadcast" ]; then
 165             broadcast="broadcast \$broadcast"
 166         fi
 167
 168         # add a new ip address
 169         ip addr add \$ip/\$mask \$broadcast dev \$interface
 170
 171         if [ -n "\$router" ]; then
 172             ip route add default via \$router dev \$interface
 173         fi
 174
 175         [ -n "\$domain" ] && echo search \$domain > /etc/resolv.conf
 176         for i in \$dns ; do
 177             echo nameserver \$i >> /etc/resolv.conf
 178         done
 179         ;;
 180 esac
 181 exit 0
 182 EOF
 183
 184     chmod 744 $rootfs/usr/share/udhcpc/default.script
 185
 186     return $res
 187 }
 188
 189 install_dropbear()
 190 {
 191     # copy dropbear binary
 192     copy_binary dropbear || return 1
 193
 194     # make symlinks to various ssh utilities
 195     utils="\
 196         $rootfs/usr/bin/dbclient \
 197         $rootfs/usr/bin/scp \
 198         $rootfs/usr/bin/ssh \
 199         $rootfs/usr/sbin/dropbearkey \
 200         $rootfs/usr/sbin/dropbearconvert \
 201     "
 202     echo $utils | xargs -n1 ln -s /usr/sbin/dropbear
 203
 204     # add necessary config files
 205     mkdir $rootfs/etc/dropbear
 206     dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1
 207     dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1
 208
 209     echo "'dropbear' ssh utility installed"
 210
 211     return 0
 212 }
 213
 214 install_openssh()
 215 {
 216     # tools to be installed
 217     server_utils="sshd"
 218     client_utils="\
 219         ssh \
 220         scp \
 221         "
 222     client_optional_utils="\
 223         sftp \
 224         ssh-add \
 225         ssh-agent \
 226         ssh-keygen \
 227         ssh-keyscan \
 228         ssh-argv0 \
 229         ssh-copy-id \
 230         "
 231
 232     # new folders used by ssh
 233     ssh_tree="\
 234 $rootfs/etc/ssh \
 235 $rootfs/var/empty/sshd \
 236 $rootfs/var/lib/empty/sshd \
 237 $rootfs/var/run/sshd \
 238 "
 239
 240     # create folder structure
 241     mkdir -p $ssh_tree
 242     if [ $? -ne 0 ]; then
 243         return 1
 244     fi
 245
 246     # copy binaries
 247     for bin in $server_utils $client_utils; do
 248         copy_binary $bin || return 1
 249     done
 250
 251     for bin in $client_optional_utils; do
 252         tool_path=`which $bin` && copy_binary $bin
 253     done
 254
 255     # add user and group
 256     cat <<EOF >> $rootfs/etc/passwd
 257 sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
 258 EOF
 259
 260     cat <<EOF >> $rootfs/etc/group
 261 sshd:x:74:
 262 EOF
 263
 264     # generate container keys
 265     ssh-keygen -t rsa -N "" -f $rootfs/etc/ssh/ssh_host_rsa_key >/dev/null 2>&1
 266     ssh-keygen -t dsa -N "" -f $rootfs/etc/ssh/ssh_host_dsa_key >/dev/null 2>&1
 267
 268     # by default setup root password with no password
 269     cat <<EOF > $rootfs/etc/ssh/sshd_config
 270 Port 22
 271 Protocol 2
 272 HostKey /etc/ssh/ssh_host_rsa_key
 273 HostKey /etc/ssh/ssh_host_dsa_key
 274 UsePrivilegeSeparation yes
 275 KeyRegenerationInterval 3600
 276 ServerKeyBits 768
 277 SyslogFacility AUTH
 278 LogLevel INFO
 279 LoginGraceTime 120
 280 PermitRootLogin yes
 281 StrictModes yes
 282 RSAAuthentication yes
 283 PubkeyAuthentication yes
 284 IgnoreRhosts yes
 285 RhostsRSAAuthentication no
 286 HostbasedAuthentication no
 287 PermitEmptyPasswords yes
 288 ChallengeResponseAuthentication no
 289 EOF
 290
 291     echo "'OpenSSH' utility installed"
 292
 293     return 0
 294 }
 295
 296 configure_busybox()
 297 {
 298     rootfs=$1
 299
 300     which busybox >/dev/null 2>&1
 301
 302     if [ $? -ne 0 ]; then
 303         echo "busybox executable is not accessible"
 304         return 1
 305     fi
 306
 307     # copy busybox in the rootfs
 308     cp $(which busybox) $rootfs/bin
 309     if [ $? -ne 0 ]; then
 310         echo "failed to copy busybox in the rootfs"
 311         return 1
 312     fi
 313
 314     # symlink busybox for the commands it supports
 315     # it would be nice to just use "chroot $rootfs busybox --install -s /bin"
 316     # but that only works right in a chroot with busybox >= 1.19.0
 317     pushd $rootfs/bin > /dev/null || return 1
 318     ./busybox --help | grep 'Currently defined functions:' -A300 | \
 319       grep -v 'Currently defined functions:' | tr , '\n' | \
 320       xargs -n1 ln -s busybox
 321     popd > /dev/null
 322
 323     # relink /sbin/init
 324     ln $rootfs/bin/busybox $rootfs/sbin/init
 325
 326     # /etc/fstab must exist for "mount -a"
 327     touch $rootfs/etc/fstab
 328
 329     # passwd exec must be setuid
 330     chmod +s $rootfs/bin/passwd
 331     touch $rootfs/etc/shadow
 332
 333     # setting passwd for root
 334     CHPASSWD_FILE=$rootfs/root/chpasswd.sh
 335
 336     cat <<EOF >$CHPASSWD_FILE
 337 echo "setting root password to \"root\""
 338
 339 mount -n --bind /lib $rootfs/lib
 340 if [ \$? -ne 0 ]; then
 341     echo "Failed bind-mounting /lib at $rootfs/lib"
 342     exit 1
 343 fi
 344
 345 chroot $rootfs chpasswd <<EOFF 2>/dev/null
 346 root:root
 347 EOFF
 348
 349
 350 if [ \$? -ne 0 ]; then
 351     echo "Failed to change root password"
 352     exit 1
 353 fi
 354
 355 umount $rootfs/lib
 356
 357 EOF
 358
 359     lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE
 360     rm $CHPASSWD_FILE
 361
 362     return 0
 363 }
 364
 365 copy_configuration()
 366 {
 367     path=$1
 368     rootfs=$2
 369     name=$3
 370
 371 grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 372 cat <<EOF >> $path/config
 373 lxc.haltsignal = SIGUSR1
 374 lxc.rebootsignal = SIGTERM
 375 lxc.utsname = $name
 376 lxc.tty = 1
 377 lxc.pts = 1
 378 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 379
 380 # When using LXC with apparmor, uncomment the next line to run unconfined:
 381 #lxc.aa_profile = unconfined
 382
 383 lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 384 lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
 385 EOF
 386
 387     libdirs="\
 388         lib \
 389         usr/lib \
 390         lib64 \
 391         usr/lib64"
 392
 393     for dir in $libdirs; do
 394         if [ -d "/$dir" ] && [ -d "$rootfs/$dir" ]; then
 395             echo "lxc.mount.entry = /$dir $dir none ro,bind 0 0" >> $path/config
 396         fi
 397     done
 398     echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
 399 }
 400
 401 remap_userns()
 402 {
 403     path=$1
 404
 405     if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
 406         chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
 407         chown -R root $path/rootfs >/dev/null 2>&1
 408     fi
 409
 410     if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
 411         chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
 412         chgrp -R root $path/rootfs >/dev/null 2>&1
 413     fi
 414 }
 415
 416 usage()
 417 {
 418     cat <<EOF
 419 $1 -h|--help -p|--path=<path> -s|--ssh={dropbear,openssh}
 420 EOF
 421     return 0
 422 }
 423
 424 options=$(getopt -o hp:n:s: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid:,ssh: -- "$@")
 425 if [ $? -ne 0 ]; then
 426     usage $(basename $0)
 427     exit 1
 428 fi
 429 eval set -- "$options"
 430
 431 while true
 432 do
 433     case "$1" in
 434         -h|--help)      usage $0 && exit 0;;
 435         -p|--path)      path=$2; shift 2;;
 436         --rootfs)       rootfs=$2; shift 2;;
 437         -n|--name)      name=$2; shift 2;;
 438         --mapped-uid)   LXC_MAPPED_UID=$2; shift 2;;
 439         --mapped-gid)   LXC_MAPPED_GID=$2; shift 2;;
 440         -s|--ssh)       SSH=$2; shift 2;;
 441         --)             shift 1; break ;;
 442         *)              break ;;
 443     esac
 444 done
 445
 446 if [ "$(id -u)" != "0" ]; then
 447     echo "This script should be run as 'root'"
 448     exit 1
 449 fi
 450
 451 if [ -z "$path" ]; then
 452     echo "'path' parameter is required"
 453     exit 1
 454 fi
 455
 456 # detect rootfs
 457 config="$path/config"
 458 if [ -z "$rootfs" ]; then
 459     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 460         rootfs=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $config)
 461     else
 462         rootfs=$path/rootfs
 463     fi
 464 fi
 465
 466 install_busybox $rootfs $name
 467 if [ $? -ne 0 ]; then
 468     echo "failed to install busybox's rootfs"
 469     exit 1
 470 fi
 471
 472 configure_busybox $rootfs
 473 if [ $? -ne 0 ]; then
 474     echo "failed to configure busybox template"
 475     exit 1
 476 fi
 477
 478 copy_configuration $path $rootfs $name
 479 if [ $? -ne 0 ]; then
 480     echo "failed to write configuration file"
 481     exit 1
 482 fi
 483
 484 remap_userns $path
 485 if [ $? -ne 0 ]; then
 486     echo "failed to remap files to user"
 487     exit 1
 488 fi
 489
 490 if [ -n "$SSH" ]; then
 491     case "$SSH" in
 492         "dropbear")
 493             install_dropbear
 494             if [ $? -ne 0 ]; then
 495                 echo "Unable to install 'dropbear' ssh utility"
 496                 exit 1
 497             fi ;;
 498         "openssh")
 499             install_openssh
 500             if [ $? -ne 0 ]; then
 501                 echo "Unable to install 'OpenSSH' utility"
 502                 exit 1
 503             fi ;;
 504         *)
 505             echo "$SSH: unrecognized ssh utility"
 506             exit 1
 507     esac
 508 else
 509     which dropbear >/dev/null 2>&1
 510     if [ $? -eq 0 ]; then
 511         install_dropbear
 512     fi
 513 fi