templates/lxc-oracle.in

   1 #!/bin/bash
   2 #
   3 # Template script for generating Oracle Enterprise Linux container for LXC
   4 # based on lxc-fedora, lxc-ubuntu
   5 #
   6 # Copyright © 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
   7 # Copyright © 2012 Dwight Engen <dwight.engen@oracle.com>
   8 #
   9 # Modified for Oracle Linux 5
  10 # Wim Coekaerts <wim.coekaerts@oracle.com>
  11 #
  12 # Modified for Oracle Linux 6, combined OL4,5,6 into one template script
  13 # Dwight Engen <dwight.engen@oracle.com>
  14 #
  15 # This library is free software; you can redistribute it and/or
  16 # modify it under the terms of the GNU Lesser General Public
  17 # License as published by the Free Software Foundation; either
  18 # version 2.1 of the License, or (at your option) any later version.
  19 #
  20 # This library is distributed in the hope that it will be useful,
  21 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  23 # Lesser General Public License for more details.
  24 #
  25 # You should have received a copy of the GNU Lesser General Public
  26 # License along with this library; if not, write to the Free Software
  27 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  28 #
  29
  30 # use virbr0 that is setup by default by libvirtd
  31 lxc_network_type=veth
  32 lxc_network_link=virbr0
  33
  34 die()
  35 {
  36     echo "failed: $1"
  37     exit 1
  38 }
  39
  40 is_btrfs_subvolume()
  41 {
  42     if which btrfs >/dev/null 2>&1 && \
  43        btrfs subvolume list "$1" >/dev/null 2>&1; then
  44         return 0
  45     fi
  46     return 1
  47 }
  48
  49 # fix up the container_rootfs
  50 container_rootfs_configure()
  51 {
  52     echo "Configuring container for Oracle Linux $container_release_major.$container_release_minor"
  53
  54     # "disable" selinux in the guest. The policy in the container isn't
  55     # likely to match the hosts (unless host == guest exactly) and the
  56     # kernel can only be enforcing one policy.
  57     #
  58     # The OL 5 init honors /etc/selinux/config, but note that
  59     # this doesnt actually disable it if it's enabled in the host, since
  60     # libselinux::is_selinux_enabled() in the guest will check
  61     # /proc/filesystems and see selinuxfs, thus reporting that it is on
  62     # (ie. check the output of sestatus in the guest). We also replace
  63     # /usr/sbin/selinuxenabled with a symlink to /bin/false so that init
  64     # scripts (ie. mcstransd) that call that think selinux is disabled.
  65     mkdir -p $container_rootfs/selinux
  66     echo 0 > $container_rootfs/selinux/enforce
  67     if [ -e $container_rootfs/etc/selinux/config ]; then
  68         sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
  69     else
  70         mkdir -p $container_rootfs/etc/selinux
  71         echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
  72     fi
  73     sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
  74     sed -i 's|session[ \t]*required[ \t]*pam_selinux.so[ \t]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
  75     sed -i 's|session[ \t]*required[ \t]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/login
  76
  77     if [ -f $container_rootfs/usr/sbin/selinuxenabled ]; then
  78         mv $container_rootfs/usr/sbin/selinuxenabled $container_rootfs/usr/sbin/selinuxenabled.lxcorig
  79         ln -s /bin/false $container_rootfs/usr/sbin/selinuxenabled
  80     fi
  81
  82     # silence error in checking for selinux
  83     sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.sysinit
  84     sed -i 's|cat /proc/self/attr/current|cat /proc/self/attr/current 2>/dev/null|' $container_rootfs/etc/rc.d/rc.sysinit
  85
  86     # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
  87     # will report its name and be resolv'able by the hosts dnsmasq
  88     cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
  89 DEVICE=eth0
  90 BOOTPROTO=dhcp
  91 ONBOOT=yes
  92 HOSTNAME=$name
  93 DHCP_HOSTNAME=$name
  94 NM_CONTROLLED=no
  95 TYPE=Ethernet
  96 EOF
  97
  98     # avoid error in ol5 attempting to copy non-existent resolv.conf
  99     if [ $container_release_major = "5" ]; then
 100         sed -i 's|resolv.conf.predhclient|resolv.conf.predhclient 2>/dev/null|' $container_rootfs/sbin/dhclient-script
 101     fi
 102
 103     # set the hostname
 104     cat <<EOF > $container_rootfs/etc/sysconfig/network
 105 NETWORKING=yes
 106 NETWORKING_IPV6=no
 107 HOSTNAME=$name
 108 EOF
 109
 110     # disable interactive ovmd asking questions
 111     if [ -f $container_rootfs/etc/sysconfig/ovmd ]; then
 112         sed -i 's|INITIAL_CONFIG=yes|INITIAL_CONFIG=no|' $container_rootfs/etc/sysconfig/ovmd
 113     fi
 114
 115     # set minimal hosts
 116     echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
 117
 118     # disable ipv6 on ol6
 119     rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
 120
 121     # this file has to exist for libvirt/Virtual machine monitor to boot the container
 122     touch $container_rootfs/etc/mtab
 123
 124     # don't put devpts,proc, nor sysfs in here, it will already be mounted for us by lxc/libvirt
 125     cat <<EOF > $container_rootfs/etc/fstab
 126 EOF
 127
 128     # remove module stuff for iptables it just shows errors that are not
 129     # relevant in a container
 130     if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
 131         sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
 132         sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
 133     fi
 134
 135     # disable readahead in the container
 136     if [ $container_release_major = "6" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
 137         rm -f $container_rootfs/etc/init/readahead-collector.conf
 138         rm -f $container_rootfs/etc/init/readahead-disable-services.conf
 139         sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
 140     fi
 141
 142     if [ $container_release_major = "4" ]; then
 143         # enable fastboot always
 144         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.sysinit
 145         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.d/rc.sysinit
 146
 147         # dont attempt to set kernel parameters
 148         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.sysinit
 149         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.d/rc.sysinit
 150         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/network 2>/dev/null
 151         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/NetworkManager 2>/dev/null
 152     fi
 153
 154     # sem_open(3) checks that /dev/shm is SHMFS_SUPER_MAGIC, so make sure to mount /dev/shm (normally done by dracut initrd) as tmpfs
 155     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 156         echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.sysinit
 157         echo "mount -t tmpfs tmpfs /dev/shm" >>$container_rootfs/etc/rc.d/rc.sysinit
 158     fi
 159
 160     if [ $container_release_major = "6" ]; then
 161         sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.sysinit
 162         sed -i 's|mount -n -o remount /dev/shm >/dev/null 2>&1$|mount -t tmpfs tmpfs /dev/shm # LXC|' $container_rootfs/etc/rc.d/rc.sysinit
 163     fi
 164
 165     # no need to attempt to mount /
 166     sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.sysinit
 167     sed -i 's|mount -f /$|# LXC mount -f /|' $container_rootfs/etc/rc.d/rc.sysinit
 168     sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.sysinit
 169     sed -i 's|action \$"Remounting root filesystem|/bin/true # LXC action $"Remounting root filesystem|' $container_rootfs/etc/rc.d/rc.sysinit
 170
 171     # disable udev in the container
 172     if [ $container_release_major = "4" ]; then
 173         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.sysinit
 174         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.d/rc.sysinit
 175     else
 176         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
 177         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
 178     fi
 179
 180     # disable nash raidautorun in the container since no /dev/md*
 181     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 182         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
 183         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
 184     fi
 185
 186     # prevent rc.sysinit from attempting to loadkeys
 187     if [ \( $container_release_major = "4" -o $container_release_major = "5" \) -a -e $container_rootfs/etc/sysconfig/keyboard ]; then
 188         rm $container_rootfs/etc/sysconfig/keyboard
 189     fi
 190
 191     # dont use the hwclock, it messes up the host's time
 192     if [ $container_release_major = "4" ]; then
 193         sed -i 's|runcmd $"Syncing hardware clock|# LXC no hwclock runcmd $"Syncing hardware clock|' $container_rootfs/etc/rc.d/init.d/halt
 194     else
 195         sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
 196     fi
 197     sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.sysinit
 198     sed -i 's|^\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/rc.sysinit
 199     sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.sysinit
 200     sed -i 's|^/sbin/hwclock|# LXC /sbin/nohwclock|' $container_rootfs/etc/rc.d/rc.sysinit
 201
 202     # dont start lvm
 203     sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
 204     sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
 205
 206     # fix assumptions that plymouth is available
 207     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
 208     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
 209     rm -f $container_rootfs/etc/init/plymouth-shutdown.conf
 210     rm -f $container_rootfs/etc/init/quit-plymouth.conf
 211     rm -f $container_rootfs/etc/init/splash-manager.conf
 212
 213     # setup console and tty[1-4] for login. note that /dev/console and
 214     # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
 215     # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
 216     # lxc will maintain these links and bind mount ptys over /dev/lxc/*
 217     # since lxc.devttydir is specified in the config.
 218
 219     # allow root login on console, tty[1-4], and pts/0 for libvirt
 220     echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
 221     echo "lxc/console"  >>$container_rootfs/etc/securetty
 222     echo "lxc/tty1"     >>$container_rootfs/etc/securetty
 223     echo "lxc/tty2"     >>$container_rootfs/etc/securetty
 224     echo "lxc/tty3"     >>$container_rootfs/etc/securetty
 225     echo "lxc/tty4"     >>$container_rootfs/etc/securetty
 226     echo "# For libvirt/Virtual Machine Monitor" >>$container_rootfs/etc/securetty
 227     echo "pts/0"        >>$container_rootfs/etc/securetty
 228
 229     # dont try to unmount /dev/lxc devices
 230     sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
 231
 232     # don't try to unmount swap
 233     sed -i 's|\[ -f /proc/swaps \]|# LXC [ -f /proc/swaps ]|' $container_rootfs/etc/init.d/halt
 234
 235     # start a getty on /dev/console, /dev/tty[1-4]
 236     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 237         sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty console' $container_rootfs/etc/inittab
 238         sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
 239         sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
 240     fi
 241
 242     if [ $container_release_major = "6" ]; then
 243         cat <<EOF > $container_rootfs/etc/init/console.conf
 244 # console - getty
 245 #
 246 # This service maintains a getty on the console from the point the system is
 247 # started until it is shut down again.
 248
 249 start on stopped rc RUNLEVEL=[2345]
 250 stop on runlevel [!2345]
 251
 252 respawn
 253 exec /sbin/mingetty /dev/console
 254 EOF
 255     fi
 256
 257     # lxc-shutdown sends SIGPWR to init, OL4 and OL5 have SysVInit, just
 258     # make it do shutdown now instead of delaying 2 minutes.  OL6 uses
 259     # upstart, so we create an upstart job to handle SIGPWR to shut down
 260     # cleanly.  We use "init 0" instead of shutdown -h now to avoid SELinux
 261     # permission denied when upstart's shutdown tries to connect to the
 262     # /com/ubuntu/upstart socket.
 263     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 264         sed -i 's|pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; |pf::powerfail:/sbin/shutdown -f -h now "|' $container_rootfs/etc/inittab
 265     else
 266         cat <<EOF > $container_rootfs/etc/init/power-status-changed.conf
 267 # power-status-changed - used to cleanly shut down the container
 268 #
 269 # This task is run whenever init receives SIGPWR
 270 # Used to shut down the machine.
 271
 272 start on power-status-changed
 273
 274 exec init 0
 275 EOF
 276     fi
 277
 278     # there might be other services that are useless but the below set is a good start
 279     # some of these might not exist in the image, so we silence chkconfig complaining
 280     # about the service file not being found
 281     for service in \
 282         acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd       \
 283         ip6tables irqbalance iscsi iscsid isdn kdump kudzu              \
 284         lm_sensors lvm2-monitor mdmonitor microcode_ctl                 \
 285         ntpd pcmcia postfix sendmail udev-post xfs ;
 286     do
 287         chroot $container_rootfs chkconfig 2>/dev/null $service off
 288     done
 289
 290     for service in rsyslog ;
 291     do
 292         chroot $container_rootfs chkconfig 2>/dev/null $service on
 293     done
 294
 295     # create required devices. note that /dev/console will be created by lxc
 296     # or libvirt itself to be a symlink to the right pty.
 297     # take care to not nuke /dev in case $container_rootfs isn't set
 298     dev_path="$container_rootfs/dev"
 299     if [ $container_rootfs != "/" -a -d $dev_path ]; then
 300         rm -rf $dev_path
 301         mkdir -p $dev_path
 302         if which chcon >/dev/null 2>&1 ; then
 303             # ensure symlinks created in /dev have the right context
 304             chcon -t device_t $dev_path
 305         fi
 306     fi
 307     mknod -m 666  $dev_path/null c 1 3
 308     mknod -m 666  $dev_path/zero c 1 5
 309     mknod -m 666  $dev_path/random c 1 8
 310     mknod -m 666  $dev_path/urandom c 1 9
 311     mkdir -m 755  $dev_path/pts
 312     mkdir -m 1777 $dev_path/shm
 313     mknod -m 666  $dev_path/tty c 5 0
 314     mknod -m 666  $dev_path/tty0 c 4 0
 315     mknod -m 666  $dev_path/tty1 c 4 1
 316     mknod -m 666  $dev_path/tty2 c 4 2
 317     mknod -m 666  $dev_path/tty3 c 4 3
 318     mknod -m 666  $dev_path/tty4 c 4 4
 319     mknod -m 666  $dev_path/full c 1 7
 320     mknod -m 600  $dev_path/initctl p
 321
 322     # set selinux labels same as host
 323     if which chcon >/dev/null 2>&1 ; then
 324         for node in null zero random urandom pts shm \
 325                     tty tty0 tty1 tty2 tty3 tty4 full ;
 326         do
 327             chcon --reference /dev/$node $dev_path/$node 2>/dev/null
 328         done
 329     fi
 330
 331     # ensure /dev/ptmx refers to the newinstance devpts of the container, or
 332     # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
 333     rm -f $container_rootfs/dev/ptmx
 334     ln -s pts/ptmx $container_rootfs/dev/ptmx
 335
 336     # start with a clean /var/log/messages
 337     rm -f $container_rootfs/var/log/messages
 338
 339     # add oracle user, set root password
 340     chroot $container_rootfs useradd -m -s /bin/bash oracle
 341     echo "oracle:oracle" | chroot $container_rootfs chpasswd
 342     echo "root:root" | chroot $container_rootfs chpasswd
 343     echo -e "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m"
 344     echo -e "Added container user:\033[1mroot\033[0m password:\033[1mroot\033[0m"
 345 }
 346
 347 # create the container's lxc config file
 348 container_config_create()
 349 {
 350     echo "Create configuration file $cfg_dir/config"
 351     # generate a hwaddr for the container with a high mac address
 352     # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
 353     local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
 354                       head -1 |awk '{print $2}' | cut -c1-10 |\
 355                       sed 's/\(..\)/\1:/g; s/.$//'`"
 356     mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
 357     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 358 # Container configuration for Oracle Linux $container_release_major.$container_release_minor
 359 lxc.arch = $arch
 360 lxc.utsname = $name
 361 lxc.devttydir = lxc
 362 lxc.tty = 4
 363 lxc.pts = 1024
 364 lxc.mount.auto = proc:mixed sys:ro
 365 lxc.hook.clone = @DATADIR@/lxc/hooks/clonehostname
 366 # Uncomment these if you don't run anything that needs the capability, and
 367 # would like the container to run with less privilege.
 368 #
 369 # Dropping sys_admin disables container root from doing a lot of things
 370 # that could be bad like re-mounting lxc fstab entries rw for example,
 371 # but also disables some useful things like being able to nfs mount, and
 372 # things that are already namespaced with ns_capable() kernel checks, like
 373 # hostname(1).
 374 # lxc.cap.drop = sys_admin
 375 # lxc.cap.drop = net_raw          # breaks dhcp/ping
 376 # lxc.cap.drop = setgid           # breaks login (initgroups/setgroups)
 377 # lxc.cap.drop = dac_read_search  # breaks login (pam unix_chkpwd)
 378 # lxc.cap.drop = setuid           # breaks sshd,nfs statd
 379 # lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
 380 # lxc.cap.drop = audit_write
 381 #
 382 lxc.cap.drop = mac_admin mac_override setfcap setpcap
 383 lxc.cap.drop = sys_module sys_nice sys_pacct
 384 lxc.cap.drop = sys_rawio sys_time
 385 EOF
 386     grep -q "^lxc.rootfs" $cfg_dir/config 2>/dev/null || echo "lxc.rootfs = $container_rootfs" >> $cfg_dir/config
 387
 388     if [ $container_release_major != "4" ]; then
 389         echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
 390     fi
 391
 392     echo "# Networking" >>$cfg_dir/config
 393     # see if the network settings were already specified
 394     lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
 395     if [ -z "$lxc_network_type" -a                      \
 396         \( $host_distribution = "OracleServer" -o       \
 397            $host_distribution = "Fedora" \) ]; then
 398             echo "lxc.network.type = veth" >>$cfg_dir/config
 399             echo "lxc.network.flags = up" >>$cfg_dir/config
 400             echo "lxc.network.link = virbr0" >>$cfg_dir/config
 401     fi
 402
 403     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 404 lxc.network.name = eth0
 405 lxc.network.mtu = 1500
 406 lxc.network.hwaddr = $hwaddr
 407 # Control Group devices: all denied except those whitelisted
 408 lxc.cgroup.devices.deny = a
 409 lxc.cgroup.devices.allow = c 1:3 rwm    # /dev/null
 410 lxc.cgroup.devices.allow = c 1:5 rwm    # /dev/zero
 411 lxc.cgroup.devices.allow = c 1:7 rwm    # /dev/full
 412 lxc.cgroup.devices.allow = c 5:0 rwm    # /dev/tty
 413 lxc.cgroup.devices.allow = c 1:8 rwm    # /dev/random
 414 lxc.cgroup.devices.allow = c 1:9 rwm    # /dev/urandom
 415 lxc.cgroup.devices.allow = c 136:* rwm  # /dev/tty[1-4] ptys and lxc console
 416 lxc.cgroup.devices.allow = c 5:2 rwm    # /dev/ptmx pty master
 417 EOF
 418 }
 419
 420 container_rootfs_clone()
 421 {
 422     if is_btrfs_subvolume $template_rootfs; then
 423         # lxc-create already made $container_rootfs a btrfs subvolume, but
 424         # in this case we want to snapshot the original subvolume so we we
 425         # have to delete the one that lxc-create made
 426         btrfs subvolume delete $container_rootfs
 427         btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
 428     else
 429         echo "Copying rootfs ..."
 430         cp -axT $template_rootfs $container_rootfs || die "copy template"
 431     fi
 432 }
 433
 434 container_rootfs_create()
 435 {
 436     cmds="rpm wget yum"
 437     if [ $container_release_major -lt "6" ]; then
 438         if [ $host_distribution = "Ubuntu" -o $host_distribution = "Debian" ]; then
 439             db_dump_cmd="db5.1_dump"
 440             db_load_cmd="db4.3_load"
 441         fi
 442         if [ $host_distribution = "OracleServer" -o \
 443              $host_distribution = "Fedora" ]; then
 444             db_dump_cmd="db_dump"
 445             db_load_cmd="db43_load"
 446         fi
 447
 448         cmds="$cmds $db_dump_cmd $db_load_cmd file"
 449     fi
 450     for cmd in $cmds; do
 451         which $cmd >/dev/null 2>&1
 452         if [ $? -ne 0 ]; then
 453             die "The $cmd command is required, please install it"
 454         fi
 455     done
 456
 457     mkdir -p @LOCALSTATEDIR@/lock/subsys/lxc
 458     (
 459         flock -x 200
 460         if [ $? -ne 0 ]; then
 461             die "The template is busy."
 462         fi
 463
 464         echo "Downloading release $container_release_major.$container_release_minor for $basearch"
 465
 466         # get yum repo file
 467         if [ -n "$repourl" ]; then
 468             yum_url=$repourl
 469         else
 470             yum_url=http://public-yum.oracle.com
 471         fi
 472         if   [ $container_release_major = "4" ]; then
 473             repofile=public-yum-el4.repo
 474         elif [ $container_release_major = "5" ]; then
 475             repofile=public-yum-el5.repo
 476         elif [ $container_release_major = "6" ]; then
 477             repofile=public-yum-ol6.repo
 478         else
 479             die "Unsupported release $container_release_major"
 480         fi
 481         mkdir -p $container_rootfs/etc/yum.repos.d
 482         wget -q $yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
 483         if [ $? -ne 0 ]; then
 484             die "Failed to download repo file $yum_url/$repofile"
 485         fi
 486
 487         # yum will take $basearch from host, so force the arch we want
 488         sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
 489
 490         # replace url if they specified one
 491         if [ -n "$repourl" ]; then
 492             sed -i "s|baseurl=http://public-yum.oracle.com/repo|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
 493             sed -i "s|gpgkey=http://public-yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
 494         fi
 495
 496         # disable all repos, then enable the repo for the version we are installing.
 497         if [ $container_release_minor = "latest" ]; then
 498             if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 499                 repo="el"$container_release_major"_"$container_release_minor
 500             else
 501                 repo="ol"$container_release_major"_"$container_release_minor
 502             fi
 503         elif [ $container_release_major = "6" ]; then
 504             if   [ $container_release_minor = "0" ]; then
 505                 repo="ol"$container_release_major"_ga_base"
 506             else
 507                 repo="ol"$container_release_major"_u"$container_release_minor"_base"
 508             fi
 509         elif [ $container_release_major = "5" ]; then
 510             if   [ $container_release_minor = "0" ]; then
 511                 repo="el"$container_release_major"_ga_base"
 512             elif [ $container_release_minor -lt "6" ]; then
 513                 repo="el"$container_release_major"_u"$container_release_minor"_base"
 514             else
 515                 repo="ol"$container_release_major"_u"$container_release_minor"_base"
 516             fi
 517         elif [ $container_release_major = "4" -a $container_release_minor -gt "5" ]; then
 518             repo="el"$container_release_major"_u"$container_release_minor"_base"
 519         else
 520             die "Unsupported release $container_release_major.$container_release_minor"
 521         fi
 522         sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
 523         sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
 524
 525         # create rpm db, download and yum install minimal packages
 526         mkdir -p $container_rootfs/var/lib/rpm
 527         rpm --root $container_rootfs --initdb
 528         yum_args="--installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
 529         min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils oraclelinux-release"
 530
 531         # we unshare the mount namespace because yum installing the ol4
 532         # packages causes $rootfs/proc to be mounted on
 533         lxc-unshare -s MOUNT yum -- $yum_args install $min_pkgs $user_pkgs
 534         if [ $? -ne 0 ]; then
 535             die "Failed to download and install the rootfs, aborting."
 536         fi
 537
 538         # rsyslog and pam depend on coreutils for some common commands in
 539         # their POSTIN scriptlets, but coreutils wasn't installed yet. now
 540         # that coreutils is installed, reinstall the packages so their POSTIN
 541         # runs right. similarly, libutempter depends on libselinux.so.1 when
 542         # it runs /usr/sbin/groupadd, so reinstall it too
 543         redo_pkgs=""
 544         if [ $container_release_major = "5" ]; then
 545             if   [ $container_release_minor = "latest" ]; then
 546                 redo_pkgs="pam rsyslog libutempter"
 547             elif [ $container_release_minor -lt 2 ]; then
 548                 redo_pkgs="pam"
 549             elif [ $container_release_minor -lt 6 ]; then
 550                 redo_pkgs="pam rsyslog"
 551             elif [ $container_release_minor -gt 5 ]; then
 552                 redo_pkgs="pam rsyslog libutempter"
 553             fi
 554         fi
 555         # shadow utils fails on ol4 and ol6.1
 556         if [ $container_release_major = "4" -o \
 557              $container_release_major = "6" -a $container_release_minor = "1" ]; then
 558             redo_pkgs="shadow-utils"
 559         fi
 560         if [ x"$redo_pkgs" != x ]; then
 561             rpm --root $container_rootfs --nodeps -e $redo_pkgs
 562             yum $yum_args install $redo_pkgs
 563             if [ $? -ne 0 ]; then
 564                 die "Unable to reinstall packages"
 565             fi
 566         fi
 567
 568         # these distributions put the rpm database in a place the guest is
 569         # not expecting it, so move it
 570         if [ $host_distribution = "Ubuntu" -o $host_distribution = "Debian" ]; then
 571             mv $container_rootfs/$HOME/.rpmdb/* $container_rootfs/var/lib/rpm
 572         fi
 573
 574         # if the native rpm created the db with Hash version 9, we need to
 575         # downgrade it to Hash version 8 for use with OL5.x
 576         db_version=`file $container_rootfs/var/lib/rpm/Packages | \
 577                     grep -o 'version [0-9]*' |awk '{print $2}'`
 578         if [ $container_release_major -lt "6" -a $db_version != "8" ]; then
 579             echo "Fixing (downgrading) rpm database from version $db_version"
 580             rm -f $container_rootfs/var/lib/rpm/__db*
 581             for db in $container_rootfs/var/lib/rpm/* ; do
 582                 $db_dump_cmd $db |$db_load_cmd $db.new
 583                 mv $db.new $db
 584             done
 585         fi
 586
 587         # the host rpm may not be the same as the guest, rebuild the db with
 588         # the guest rpm version
 589         echo "Rebuilding rpm database"
 590         rm -f $container_rootfs/var/lib/rpm/__db*
 591         chroot $container_rootfs rpm --rebuilddb >/dev/null 2>&1
 592
 593     ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-oracle-$name
 594 }
 595
 596 container_release_get()
 597 {
 598     if [ -f $1/etc/oracle-release ]; then
 599         container_release_version=`cat $1/etc/oracle-release |awk '/^Oracle/ {print $5}'`
 600         container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 601         container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 602     elif grep -q "Enterprise Linux AS" $1/etc/redhat-release; then
 603         container_release_major=`cat $1/etc/redhat-release |awk '{print $7}'`
 604         container_release_minor=`cat $1/etc/redhat-release |awk '{print $10}' |tr -d ")"`
 605         container_release_version="$container_release_major.$container_release_minor"
 606     elif grep -q "Enterprise Linux Server" $1/etc/redhat-release; then
 607         container_release_version=`cat $1/etc/redhat-release |awk '{print $7}'`
 608         container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 609         container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 610     else
 611         echo "Unable to determine container release version"
 612         exit 1
 613     fi
 614 }
 615
 616 usage()
 617 {
 618     cat <<EOF
 619   -a|--arch=<arch>        architecture (ie. i386, x86_64)
 620   -R|--release=<release>  release to download for the new container
 621   --rootfs=<path>         rootfs path
 622   -r|--rpms=<rpm name>    additional rpms to install into container
 623   -u|--url=<url>          replace yum repo url (ie. local yum mirror)
 624   -t|--templatefs=<path>  copy/clone rootfs at path instead of downloading
 625   -h|--help
 626
 627 Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
 628 EOF
 629     return 0
 630 }
 631
 632 options=$(getopt -o hp:n:a:R:r:u:t: -l help,rootfs:,path:,name:,arch:,release:,rpms:,url:,templatefs: -- "$@")
 633 if [ $? -ne 0 ]; then
 634     usage $(basename $0)
 635     exit 1
 636 fi
 637
 638 arch=$(uname -m)
 639 eval set -- "$options"
 640 while true
 641 do
 642     case "$1" in
 643         -h|--help)              usage $0 && exit 0;;
 644         -p|--path)              cfg_dir=$2; shift 2;;
 645         --rootfs)               container_rootfs=$2; shift 2;;
 646         -n|--name)              name=$2; shift 2;;
 647         -a|--arch)              arch=$2; shift 2;;
 648         -R|--release)           container_release_version=$2; shift 2;;
 649         -r|--rpms)              user_pkgs=$2; shift 2;;
 650         -u|--url)               repourl=$2; shift 2;;
 651         -t|--templatefs)        template_rootfs=$2; shift 2;;
 652         --)                     shift 1; break ;;
 653         *)                      break ;;
 654     esac
 655 done
 656
 657 # make sure mandatory args are given and valid
 658 if [ "$(id -u)" != "0" ]; then
 659     echo "This script should be run as 'root'"
 660     exit 1
 661 fi
 662
 663 if [ -z $name ]; then
 664     echo "Container name must be given"
 665     usage
 666     exit 1
 667 fi
 668
 669 if [ -z $cfg_dir ]; then
 670     echo "Configuration directory must be given, check lxc-create"
 671     usage
 672     exit 1
 673 fi
 674
 675 basearch=$arch
 676 if [ "$arch" = "i686" ]; then
 677     basearch="i386"
 678 fi
 679
 680 if [ "$arch" != "i386" -a "$arch" != "x86_64" ]; then
 681     echo "Bad architecture given, check lxc-create"
 682     usage
 683     exit 1
 684 fi
 685
 686 if which lsb_release >/dev/null 2>&1; then
 687     host_distribution=`lsb_release --id |awk '{print $3}'`
 688     host_release_version=`lsb_release --release |awk '{print $2}'`
 689     host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 690     host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 691 else
 692     if   [ -f /etc/fedora-release ]; then
 693        host_distribution="Fedora"
 694        host_release_version=`cat /etc/fedora-release |awk '{print $3}'`
 695        host_release_major=$host_release_version
 696        host_release_minor=0
 697     elif [ -f /etc/oracle-release ]; then
 698        host_distribution="OracleServer"
 699        host_release_version=`cat /etc/oracle-release |awk '{print $5}'`
 700        host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 701        host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 702     else
 703        echo "Unable to determine host distribution, ensure lsb_release is installed"
 704        exit 1
 705     fi
 706 fi
 707 echo "Host is $host_distribution $host_release_version"
 708
 709 if [ -z "$container_rootfs" ]; then
 710     container_rootfs="$cfg_dir/rootfs"
 711 fi
 712
 713 if [ -n "$template_rootfs" ]; then
 714     container_release_get $template_rootfs
 715 else
 716     if [ -z "$container_release_version" ]; then
 717         if [ $host_distribution = "OracleServer" ]; then
 718             container_release_version=$host_release_version
 719         else
 720             echo "No release specified with -R, defaulting to 6.4"
 721             container_release_version="6.4"
 722         fi
 723     fi
 724     container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 725     container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 726 fi
 727
 728 container_config_create
 729 if [ -n "$template_rootfs" ]; then
 730     container_rootfs_clone
 731 else
 732     container_rootfs_create
 733 fi
 734
 735 container_release_get $container_rootfs
 736
 737 container_rootfs_configure
 738
 739 echo "Container : $container_rootfs"
 740 echo "Config    : $cfg_dir/config"
 741 echo "Network   : eth0 ($lxc_network_type) on $lxc_network_link"