templates/lxc-oracle.in

   1 #!/bin/bash
   2 #
   3 # Template script for generating Oracle Enterprise Linux container for LXC
   4 # based on lxc-fedora, lxc-ubuntu
   5 #
   6 # Copyright © 2011 Wim Coekaerts <wim.coekaerts@oracle.com>
   7 # Copyright © 2012 Dwight Engen <dwight.engen@oracle.com>
   8 #
   9 # Modified for Oracle Linux 5
  10 # Wim Coekaerts <wim.coekaerts@oracle.com>
  11 #
  12 # Modified for Oracle Linux 6, combined OL5,6 into one template script
  13 # Dwight Engen <dwight.engen@oracle.com>
  14 #
  15 # This library is free software; you can redistribute it and/or
  16 # modify it under the terms of the GNU Lesser General Public
  17 # License as published by the Free Software Foundation; either
  18 # version 2.1 of the License, or (at your option) any later version.
  19 #
  20 # This library is distributed in the hope that it will be useful,
  21 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  23 # Lesser General Public License for more details.
  24 #
  25 # You should have received a copy of the GNU Lesser General Public
  26 # License along with this library; if not, write to the Free Software
  27 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28 #
  29
  30 # use virbr0 that is setup by default by libvirtd
  31 lxc_network_type=veth
  32 lxc_network_link=virbr0
  33
  34 die()
  35 {
  36     echo "failed: $1"
  37     exit 1
  38 }
  39
  40 is_btrfs_subvolume()
  41 {
  42     if which btrfs >/dev/null 2>&1 && \
  43        btrfs subvolume list "$1" >/dev/null 2>&1; then
  44         return 0
  45     fi
  46     return 1
  47 }
  48
  49 # fix up the container_rootfs
  50 container_rootfs_configure()
  51 {
  52     echo "Configuring container for Oracle Linux $container_release_major.$container_release_minor"
  53
  54     # "disable" selinux. init in OL 5 honors /etc/selinux/config. note that
  55     # this doesnt actually disable it if it's enabled in the host, since
  56     # libselinux::is_selinux_enabled() in the guest will check
  57     # /proc/filesystems and see selinuxfs, thus reporting that it is on
  58     # (ie. check the output of sestatus in the guest)
  59     mkdir -p $container_rootfs/selinux
  60     echo 0 > $container_rootfs/selinux/enforce
  61     if [ -e $container_rootfs/etc/selinux/config ]; then
  62         sed -i 's|SELINUX=enforcing|SELINUX=disabled|' $container_rootfs/etc/selinux/config
  63     else
  64         echo "SELINUX=disabled" >$container_rootfs/etc/selinux/config
  65     fi
  66     sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*close|#session required pam_selinux.so close|' $container_rootfs/etc/pam.d/login
  67     sed -i 's|session[ ]*required[ ]*pam_selinux.so[ ]*open|#session required pam_selinux.so open|' $container_rootfs/etc/pam.d/login
  68     sed -i 's|session[ ]*required[ ]*pam_loginuid.so|#session required pam_loginuid.so|' $container_rootfs/etc/pam.d/login
  69
  70
  71     # configure the network to use dhcp. we set DHCP_HOSTNAME so the guest
  72     # will report its name and be resolv'able by the hosts dnsmasq
  73     touch $container_rootfs/etc/resolv.conf
  74     cat <<EOF > $container_rootfs/etc/sysconfig/network-scripts/ifcfg-eth0
  75 DEVICE=eth0
  76 BOOTPROTO=dhcp
  77 ONBOOT=yes
  78 HOSTNAME=$name
  79 DHCP_HOSTNAME=$name
  80 NM_CONTROLLED=no
  81 TYPE=Ethernet
  82 EOF
  83
  84     # set the hostname
  85     cat <<EOF > $container_rootfs/etc/sysconfig/network
  86 NETWORKING=yes
  87 NETWORKING_IPV6=no
  88 HOSTNAME=$name
  89 EOF
  90
  91     # disable interactive ovmd asking questions
  92     if [ -f $container_rootfs/etc/sysconfig/ovmd ]; then
  93         sed -i 's|INITIAL_CONFIG=yes|INITIAL_CONFIG=no|' $container_rootfs/etc/sysconfig/ovmd
  94     fi
  95
  96     # set minimal hosts
  97     echo "127.0.0.1 localhost $name" > $container_rootfs/etc/hosts
  98
  99     # disable ipv6
 100     echo "blacklist ipv6" >>$container_rootfs/etc/modprobe.d/blacklist.conf
 101     echo "blacklist net-pf-10" >>$container_rootfs/etc/modprobe.d/blacklist.conf
 102     rm -f $container_rootfs/etc/sysconfig/network-scripts/init.ipv6-global
 103
 104     # this file has to exist for libvirt/Virtual machine monitor to boot the container
 105     touch $container_rootfs/etc/mtab
 106
 107     # don't put devpts in here, it will already be mounted for us by lxc/libvirt
 108     cat <<EOF > $container_rootfs/etc/fstab
 109 proc    /proc     proc   nodev,noexec,nosuid 0 0
 110 sysfs   /sys      sysfs  defaults 0 0
 111 EOF
 112
 113     # remove module stuff for iptables it just shows errors that are not
 114     # relevant in a container
 115     if [ -f "$container_rootfs/etc/sysconfig/iptables-config" ]; then
 116         sed -i 's|IPTABLES_MODULES=".*|IPTABLES_MODULES=""|' $container_rootfs/etc/sysconfig/iptables-config
 117         sed -i 's|IPTABLES_MODULES_UNLOAD=".*|IPTABLES_MODULES_UNLOAD="no"|' $container_rootfs/etc/sysconfig/iptables-config
 118     fi
 119
 120     # disable readahead in the container
 121     if [ $container_release_major = "6" -a -e $container_rootfs/etc/sysconfig/readahead ]; then
 122         rm -f $container_rootfs/etc/init/readahead-collector.conf
 123         rm -f $container_rootfs/etc/init/readahead-disable-services.conf
 124         sed -i 's|READAHEAD="yes"|READAHEAD="no"|' $container_rootfs/etc/sysconfig/readahead
 125     fi
 126
 127     if [ $container_release_major = "4" ]; then
 128         # enable fastboot always
 129         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.sysinit
 130         sed -i 's|\[ -f /fastboot \]|/bin/true|' $container_rootfs/etc/rc.d/rc.sysinit
 131
 132         # dont attempt to set kernel parameters
 133         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.sysinit
 134         sed -i 's|action $"Configuring kernel parameters|# LXC action $"Configuring kernel parameters|' $container_rootfs/etc/rc.d/rc.sysinit
 135         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/network
 136         sed -i 's|action $"Setting network parameters|# LXC action $"Setting network parameters|' $container_rootfs/etc/init.d/NetworkManager
 137     fi
 138
 139     # disable udev in the container
 140     if [ $container_release_major = "4" ]; then
 141         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.sysinit
 142         sed -i 's|\[ -x /sbin/start_udev \]|# LXC no udev|' $container_rootfs/etc/rc.d/rc.sysinit
 143     else
 144         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.sysinit
 145         sed -i 's|.sbin.start_udev||' $container_rootfs/etc/rc.d/rc.sysinit
 146     fi
 147
 148     # disable nash raidautorun in the container since no /dev/md*
 149     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 150         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.sysinit
 151         sed -i 's|echo "raidautorun /dev/md0"|echo ""|' $container_rootfs/etc/rc.d/rc.sysinit
 152     fi
 153
 154     # prevent rc.sysinit from attempting to loadkeys
 155     if [ \( $container_release_major = "4" -o $container_release_major = "5" \) -a -e $container_rootfs/etc/sysconfig/keyboard ]; then
 156         rm $container_rootfs/etc/sysconfig/keyboard
 157     fi
 158
 159     # dont use the hwclock, it messes up the host's time
 160     if [ $container_release_major = "4" ]; then
 161         sed -i 's|runcmd $"Syncing hardware clock|# LXC no hwclock runcmd $"Syncing hardware clock|' $container_rootfs/etc/rc.d/init.d/halt
 162     else
 163         sed -i 's|\[ -x /sbin/hwclock|\[ 0 -eq 1|' $container_rootfs/etc/rc.d/init.d/halt
 164     fi
 165     sed -i 's|/sbin/hwclock|# LXC no hwclock /sbin/hwclock|' $container_rootfs/etc/rc.sysinit
 166     sed -i 's|/sbin/hwclock|# LXC no hwclock /sbin/hwclock|' $container_rootfs/etc/rc.d/rc.sysinit
 167
 168     # dont start lvm
 169     sed -i 's|action $"Setting up Logical Volume Management:"|#action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.sysinit
 170     sed -i 's|action $"Setting up Logical Volume Management:"|/bin/true #action $"Setting up Logical Volume Management:"|' $container_rootfs/etc/rc.d/rc.sysinit
 171
 172     # fix assumptions that plymouth is available
 173     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.sysinit
 174     sed -i 's|\[ "$PROMPT" != no \] && plymouth|[ "$PROMPT" != no ] \&\& [ -n "$PLYMOUTH" ] \&\& plymouth|' $container_rootfs/etc/rc.d/rc.sysinit
 175     rm -f $container_rootfs/etc/init/plymouth-shutdown.conf
 176     rm -f $container_rootfs/etc/init/quit-plymouth.conf
 177     rm -f $container_rootfs/etc/init/splash-manager.conf
 178
 179     # setup console and tty[1-4] for login. note that /dev/console and
 180     # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
 181     # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
 182     # lxc will maintain these links and bind mount ptys over /dev/lxc/*
 183     # since lxc.devttydir is specified in the config.
 184
 185     # allow root login on console, tty[1-4], and pts/0 for libvirt
 186     echo "# LXC (Linux Containers)" >>$container_rootfs/etc/securetty
 187     echo "lxc/console"  >>$container_rootfs/etc/securetty
 188     echo "lxc/tty1"     >>$container_rootfs/etc/securetty
 189     echo "lxc/tty2"     >>$container_rootfs/etc/securetty
 190     echo "lxc/tty3"     >>$container_rootfs/etc/securetty
 191     echo "lxc/tty4"     >>$container_rootfs/etc/securetty
 192     echo "# For libvirt/Virtual Machine Monitor" >>$container_rootfs/etc/securetty
 193     echo "pts/0"        >>$container_rootfs/etc/securetty
 194
 195     # dont try to unmount /dev/lxc devices
 196     sed -i 's|&& $1 !~ /^\\/dev\\/ram/|\&\& $2 !~ /^\\/dev\\/lxc/ \&\& $1 !~ /^\\/dev\\/ram/|' $container_rootfs/etc/init.d/halt
 197
 198     # start a getty on /dev/console, /dev/tty[1-4]
 199     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 200         sed -i '/1:2345:respawn/i cns:2345:respawn:/sbin/mingetty console' $container_rootfs/etc/inittab
 201         sed -i '/5:2345:respawn/d' $container_rootfs/etc/inittab
 202         sed -i '/6:2345:respawn/d' $container_rootfs/etc/inittab
 203     fi
 204
 205     if [ $container_release_major = "6" ]; then
 206         cat <<EOF > $container_rootfs/etc/init/console.conf
 207 # console - getty
 208 #
 209 # This service maintains a getty on the console from the point the system is
 210 # started until it is shut down again.
 211
 212 start on stopped rc RUNLEVEL=[2345]
 213 stop on runlevel [!2345]
 214
 215 respawn
 216 exec /sbin/mingetty /dev/console
 217 EOF
 218     fi
 219
 220     # lxc-shutdown sends SIGPWR to init, OL4 and OL5 have SysVInit, just
 221     # make it do shutdown now instead of delaying 2 minutes.  OL6 uses
 222     # upstart, so we create an upstart job to handle SIGPWR to shut down
 223     # cleanly.  We use "init 0" instead of shutdown -h now to avoid SELinux
 224     # permission denied when upstart's shutdown tries to connect to the
 225     # /com/ubuntu/upstart socket.
 226     if [ $container_release_major = "4" -o $container_release_major = "5" ]; then
 227         sed -i 's|pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; |pf::powerfail:/sbin/shutdown -f -h now "|' $container_rootfs/etc/inittab
 228     else
 229         cat <<EOF > $container_rootfs/etc/init/power-status-changed.conf
 230 # power-status-changed - used to cleanly shut down the container
 231 #
 232 # This task is run whenever init receives SIGPWR
 233 # Used to shut down the machine.
 234
 235 start on power-status-changed
 236
 237 exec init 0
 238 EOF
 239     fi
 240
 241     # there might be other services that are useless but the below set is a good start
 242     # some of these might not exist in the image, so we silence chkconfig complaining
 243     # about the service file not being found
 244     for service in \
 245         acpid apmd auditd autofs cpuspeed dund gpm haldaemon hidd       \
 246         ip6tables irqbalance iscsi iscsid isdn kdump kudzu              \
 247         lm_sensors lvm2-monitor mdmonitor microcode_ctl                 \
 248         ntpd pcmcia postfix sendmail udev-post xfs ;
 249     do
 250         chroot $container_rootfs chkconfig 2>/dev/null $service off
 251     done
 252
 253     for service in rsyslog ;
 254     do
 255         chroot $container_rootfs chkconfig 2>/dev/null $service on
 256     done
 257
 258     # create required devices. note that /dev/console will be created by lxc
 259     # or libvirt itself to be a symlink to the right pty.
 260     # take care to not nuke /dev in case $container_rootfs isn't set
 261     dev_path="$container_rootfs/dev"
 262     if [ $container_rootfs != "/" -a -d $dev_path ]; then
 263         rm -rf $dev_path
 264         mkdir -p $dev_path
 265     fi
 266     mknod -m 666  $dev_path/null c 1 3
 267     mknod -m 666  $dev_path/zero c 1 5
 268     mknod -m 666  $dev_path/random c 1 8
 269     mknod -m 666  $dev_path/urandom c 1 9
 270     mkdir -m 755  $dev_path/pts
 271     mkdir -m 1777 $dev_path/shm
 272     mknod -m 666  $dev_path/tty c 5 0
 273     mknod -m 666  $dev_path/tty0 c 4 0
 274     mknod -m 666  $dev_path/tty1 c 4 1
 275     mknod -m 666  $dev_path/tty2 c 4 2
 276     mknod -m 666  $dev_path/tty3 c 4 3
 277     mknod -m 666  $dev_path/tty4 c 4 4
 278     mknod -m 666  $dev_path/full c 1 7
 279     mknod -m 600  $dev_path/initctl p
 280
 281     # ensure /dev/ptmx refers to the newinstance devpts of the container, or
 282     # pty's will get crossed up with the hosts (https://lkml.org/lkml/2012/1/23/512)
 283     rm -f $container_rootfs/dev/ptmx
 284     ln -s pts/ptmx $container_rootfs/dev/ptmx
 285
 286     # start with a clean /var/log/messages
 287     rm -f $container_rootfs/var/log/messages
 288
 289     # add oracle user, set root password
 290     chroot $container_rootfs useradd -m -s /bin/bash oracle
 291     echo "oracle:oracle" | chroot $container_rootfs chpasswd
 292     echo "root:root" | chroot $container_rootfs chpasswd
 293     echo -e "Added container user:\033[1moracle\033[0m password:\033[1moracle\033[0m"
 294     echo -e "Added container user:\033[1mroot\033[0m password:\033[1mroot\033[0m"
 295 }
 296
 297 # create the container's lxc config file
 298 container_config_create()
 299 {
 300     echo "Create configuration file $cfg_dir/config"
 301     # generate a hwaddr for the container with a high mac address
 302     # see http://sourceforge.net/tracker/?func=detail&aid=3411497&group_id=163076&atid=826303
 303     local hwaddr="fe:`dd if=/dev/urandom bs=8 count=1 2>/dev/null |od -t x8 | \
 304                       head -1 |awk '{print $2}' | cut -c1-10 |\
 305                       sed 's/\(..\)/\1:/g; s/.$//'`"
 306     mkdir -p $cfg_dir || die "unable to create config dir $cfg_dir"
 307     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 308 # Container configuration for Oracle Linux $container_release_major.$container_release_minor
 309 lxc.arch = $arch
 310 lxc.utsname = $name
 311 lxc.devttydir = lxc
 312 lxc.tty = 4
 313 lxc.pts = 1024
 314 lxc.rootfs = $container_rootfs
 315 lxc.mount = $cfg_dir/fstab
 316 # Uncomment these if you don't run anything that needs the capability, and
 317 # would like the container to run with less privilege.
 318 #
 319 # Dropping sys_admin disables container root from doing a lot of things
 320 # that could be bad like re-mounting lxc fstab entries rw for example,
 321 # but also disables some useful things like being able to nfs mount, and
 322 # things that are already namespaced with ns_capable() kernel checks, like
 323 # hostname(1).
 324 # lxc.cap.drop = sys_admin
 325 # lxc.cap.drop = net_raw          # breaks dhcp/ping
 326 # lxc.cap.drop = setgid           # breaks login (initgroups/setgroups)
 327 # lxc.cap.drop = dac_read_search  # breaks login (pam unix_chkpwd)
 328 # lxc.cap.drop = setuid           # breaks sshd,nfs statd
 329 # lxc.cap.drop = audit_control    # breaks sshd (set_loginuid failed)
 330 # lxc.cap.drop = audit_write
 331 #
 332 lxc.cap.drop = mac_admin mac_override setfcap setpcap
 333 lxc.cap.drop = sys_module sys_nice sys_pacct
 334 lxc.cap.drop = sys_rawio sys_time
 335 EOF
 336
 337     if [ $container_release_major != "4" ]; then
 338         echo "lxc.cap.drop = sys_resource" >>$cfg_dir/config
 339     fi
 340
 341     echo "# Networking" >>$cfg_dir/config
 342     # see if the network settings were already specified
 343     lxc_network_type=`grep '^lxc.network.type' $cfg_dir/config | awk -F'[= \t]+' '{ print $2 }'`
 344     if [ -z "$lxc_network_type" -a                      \
 345         \( $host_distribution = "OracleServer" -o       \
 346            $host_distribution = "Fedora" \) ]; then
 347             echo "lxc.network.type = veth" >>$cfg_dir/config
 348             echo "lxc.network.flags = up" >>$cfg_dir/config
 349             echo "lxc.network.link = virbr0" >>$cfg_dir/config
 350     fi
 351
 352     cat <<EOF >> $cfg_dir/config || die "unable to create $cfg_dir/config"
 353 lxc.network.name = eth0
 354 lxc.network.mtu = 1500
 355 lxc.network.hwaddr = $hwaddr
 356 # Control Group devices: all denied except those whitelisted
 357 lxc.cgroup.devices.deny = a
 358 lxc.cgroup.devices.allow = c 1:3 rwm    # /dev/null
 359 lxc.cgroup.devices.allow = c 1:5 rwm    # /dev/zero
 360 lxc.cgroup.devices.allow = c 1:7 rwm    # /dev/full
 361 lxc.cgroup.devices.allow = c 5:0 rwm    # /dev/tty
 362 lxc.cgroup.devices.allow = c 1:8 rwm    # /dev/random
 363 lxc.cgroup.devices.allow = c 1:9 rwm    # /dev/urandom
 364 lxc.cgroup.devices.allow = c 136:* rwm  # /dev/tty[1-4] ptys and lxc console
 365 lxc.cgroup.devices.allow = c 5:2 rwm    # /dev/ptmx pty master
 366 EOF
 367
 368     cat <<EOF > $cfg_dir/fstab || die "unable to create $cfg_dir/fstab"
 369 proc    $container_rootfs/proc     proc   nodev,noexec,nosuid 0 0
 370 devpts  $container_rootfs/dev/pts  devpts defaults 0 0
 371 sysfs   $container_rootfs/sys      sysfs  defaults  0 0
 372 EOF
 373 }
 374
 375 container_rootfs_clone()
 376 {
 377     if is_btrfs_subvolume $template_rootfs; then
 378         # lxc-create already made $container_rootfs a btrfs subvolume, but
 379         # in this case we want to snapshot the original subvolume so we we
 380         # have to delete the one that lxc-create made
 381         btrfs subvolume delete $container_rootfs
 382         btrfs subvolume snapshot $template_rootfs $container_rootfs || die "btrfs clone template"
 383     else
 384         cp -ax $template_rootfs $container_rootfs || die "copy template"
 385     fi
 386 }
 387
 388 container_rootfs_create()
 389 {
 390     cmds="rpm wget yum"
 391     if [ $container_release_major = "5" ]; then
 392         if [ $host_distribution = "Ubuntu" ]; then
 393             db_dump_cmd="db5.1_dump"
 394             db_load_cmd="db4.3_load"
 395         fi
 396         if [ $host_distribution = "OracleServer" -o \
 397              $host_distribution = "Fedora" ]; then
 398             db_dump_cmd="db_dump"
 399             db_load_cmd="db43_load"
 400         fi
 401
 402         cmds="$cmds $db_dump_cmd $db_load_cmd file"
 403     fi
 404     for cmd in $cmds; do
 405         which $cmd >/dev/null 2>&1
 406         if [ $? -ne 0 ]; then
 407             die "The $cmd command is required, please install it"
 408         fi
 409     done
 410
 411     mkdir -p @LOCALSTATEDIR@/lock/subsys/lxc
 412     (
 413         flock -x 200
 414         if [ $? -ne 0 ]; then
 415             die "The template is busy."
 416         fi
 417
 418         echo "Downloading release $container_release_major.$container_release_minor for $basearch"
 419
 420         # get yum repo file
 421         if [ -n "$repourl" ]; then
 422             yum_url=$repourl
 423         else
 424             yum_url=http://public-yum.oracle.com
 425         fi
 426         if   [ $container_release_major = "5" ]; then
 427             repofile=public-yum-el5.repo
 428         elif [ $container_release_major = "6" ]; then
 429             repofile=public-yum-ol6.repo
 430         else
 431             die "Unsupported release $container_release_major"
 432         fi
 433         mkdir -p $container_rootfs/etc/yum.repos.d
 434         wget -q $yum_url/$repofile -O $container_rootfs/etc/yum.repos.d/$repofile
 435         if [ $? -ne 0 ]; then
 436             die "Failed to download repo file $yum_url/$repofile"
 437         fi
 438
 439         # yum will take $basearch from host, so force the arch we want
 440         sed -i "s|\$basearch|$basearch|" $container_rootfs/etc/yum.repos.d/$repofile
 441
 442         # replace url if they specified one
 443         if [ -n "$repourl" ]; then
 444             sed -i "s|baseurl=http://public-yum.oracle.com/repo|baseurl=$repourl/repo|" $container_rootfs/etc/yum.repos.d/$repofile
 445             sed -i "s|gpgkey=http://public-yum.oracle.com|gpgkey=$repourl|" $container_rootfs/etc/yum.repos.d/$repofile
 446         fi
 447
 448         # disable all repos, then enable the repo for the version we are installing.
 449         if [ $container_release_minor = "latest" ]; then
 450             if [ $container_release_major = "5" ]; then
 451         repo="el"$container_release_major"_"$container_release_minor
 452             else
 453                 repo="ol"$container_release_major"_"$container_release_minor
 454             fi
 455         elif [ $container_release_minor = "0" ]; then
 456             repo="ol"$container_release_major"_ga_base"
 457         else
 458             repo="ol"$container_release_major"_u"$container_release_minor"_base"
 459         fi
 460         sed -i "s|enabled=1|enabled=0|" $container_rootfs/etc/yum.repos.d/$repofile
 461         sed -i "/\[$repo\]/,/\[/ s/enabled=0/enabled=1/" $container_rootfs/etc/yum.repos.d/$repofile
 462
 463         # create rpm db, download and yum install minimal packages
 464         mkdir -p $container_rootfs/var/lib/rpm
 465         rpm --root $container_rootfs --initdb
 466         yum_cmd="yum --installroot $container_rootfs --disablerepo=* --enablerepo=$repo -y --nogpgcheck"
 467         min_pkgs="yum initscripts passwd rsyslog vim-minimal openssh-server dhclient chkconfig rootfiles policycoreutils oraclelinux-release"
 468
 469         $yum_cmd install $min_pkgs
 470         if [ $? -ne 0 ]; then
 471             die "Failed to download and install the rootfs, aborting."
 472         fi
 473
 474         # rsyslog and pam depend on coreutils for some common commands in
 475         # their POSTIN scriptlets, but coreutils wasn't installed yet. now
 476         # that coreutils is installed, reinstall the packages so their POSTIN
 477         # runs right. similarly, libutempter depends on libselinux.so.1 when
 478         # it runs /usr/sbin/groupadd, so reinstall it too
 479         if [ $container_release_major = "5" ]; then
 480             rpm --root $container_rootfs --nodeps -e rsyslog pam libutempter
 481             $yum_cmd install rsyslog pam libutempter
 482             if [ $? -ne 0 ]; then
 483                 die "Unable to reinstall packages"
 484             fi
 485         fi
 486
 487         # these distributions put the rpm database in a place the guest is
 488         # not expecting it, so move it
 489         if [ $host_distribution = "Ubuntu" ]; then
 490             mv $container_rootfs/root/.rpmdb/* $container_rootfs/var/lib/rpm
 491         fi
 492
 493         # if the native rpm created the db with Hash version 9, we need to
 494         # downgrade it to Hash version 8 for use with OL5.x
 495         db_version=`file $container_rootfs/var/lib/rpm/Packages | \
 496                     grep -o 'version [0-9]*' |awk '{print $2}'`
 497         if [ $container_release_major = "5" -a $db_version != "8" ]; then
 498             echo "Fixing (downgrading) rpm database from version $db_version"
 499             rm -f $container_rootfs/var/lib/rpm/__db*
 500             for db in $container_rootfs/var/lib/rpm/* ; do
 501                 $db_dump_cmd $db |$db_load_cmd $db.new
 502                 mv $db.new $db
 503             done
 504         fi
 505
 506         # the host rpm may not be the same as the guest, rebuild the db with
 507         # the guest rpm version
 508         echo "Rebuilding rpm database"
 509         rm -f $container_rootfs/var/lib/rpm/__db*
 510         chroot $container_rootfs rpm --rebuilddb >/dev/null 2>&1
 511     ) 200>@LOCALSTATEDIR@/lock/subsys/lxc-oracle-$name
 512 }
 513
 514 container_release_get()
 515 {
 516     if [ -f $1/etc/oracle-release ]; then
 517         container_release_version=`cat $1/etc/oracle-release |awk '/^Oracle/ {print $5}'`
 518         container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 519         container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 520     elif grep -q Nahant $1/etc/redhat-release; then
 521         container_release_major=`cat $1/etc/redhat-release |awk '{print $7}'`
 522         container_release_minor=`cat $1/etc/redhat-release |awk '{print $10}' |tr -d ")"`
 523         container_release_version="$container_release_major.$container_release_minor"
 524     else
 525         echo "Unable to determine container release version"
 526         exit 1
 527     fi
 528 }
 529
 530 usage()
 531 {
 532     cat <<EOF
 533   -a|--arch=<arch>        architecture (ie. i386, x86_64)
 534   -R|--release=<release>  release to download for the new container
 535   -u|--url=<url>          replace yum repo url (ie. local yum mirror)
 536   -t|--templatefs=<path>  copy/clone rootfs at path instead of downloading
 537   -h|--help
 538
 539 Release is of the format "major.minor", for example "5.8", "6.3", or "6.latest"
 540 EOF
 541     return 0
 542 }
 543
 544 options=$(getopt -o hp:n:a:R:u:t: -l help,path:,name:,arch:,release:,url:,templatefs: -- "$@")
 545 if [ $? -ne 0 ]; then
 546     usage $(basename $0)
 547     exit 1
 548 fi
 549
 550 arch=$(arch)
 551 eval set -- "$options"
 552 while true
 553 do
 554     case "$1" in
 555         -h|--help)              usage $0 && exit 0;;
 556         -p|--path)              cfg_dir=$2; shift 2;;
 557         -n|--name)              name=$2; shift 2;;
 558         -a|--arch)              arch=$2; shift 2;;
 559         -R|--release)           container_release_version=$2; shift 2;;
 560         -u|--url)               repourl=$2; shift;;
 561         -t|--templatefs)        template_rootfs=$2; shift 2;;
 562         --)                     shift 1; break ;;
 563         *)                      break ;;
 564     esac
 565 done
 566
 567 # make sure mandatory args are given and valid
 568 if [ "$(id -u)" != "0" ]; then
 569     echo "This script should be run as 'root'"
 570     exit 1
 571 fi
 572
 573 if [ -z $name ]; then
 574     echo "Container name must be given"
 575     usage
 576     exit 1
 577 fi
 578
 579 if [ -z $cfg_dir ]; then
 580     echo "Configuration directory must be given, check lxc-create"
 581     usage
 582     exit 1
 583 fi
 584
 585 basearch=$arch
 586 if [ "$arch" = "i686" ]; then
 587     basearch="i386"
 588 fi
 589
 590 if [ "$arch" != "i386" -a "$arch" != "x86_64" ]; then
 591     echo "Bad architecture given, check lxc-create"
 592     usage
 593     exit 1
 594 fi
 595
 596 container_rootfs="$cfg_dir/rootfs"
 597
 598 if [ -n "$template_rootfs" ]; then
 599     container_release_get $template_rootfs
 600 else
 601     if [ -z "$container_release_version" ]; then
 602         echo "No release specified with -R, defaulting to 6.3"
 603         container_release_version="6.3"
 604     fi
 605     container_release_major=`echo $container_release_version |awk -F '.' '{print $1}'`
 606     container_release_minor=`echo $container_release_version |awk -F '.' '{print $2}'`
 607 fi
 608
 609 if which lsb_release >/dev/null 2>&1; then
 610     host_distribution=`lsb_release --id |awk '{print $3}'`
 611     host_release_version=`lsb_release --release |awk '{print $2}'`
 612     host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 613     host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 614 else
 615     if   [ -f /etc/fedora-release ]; then
 616        host_distribution="Fedora"
 617        host_release_version=`cat /etc/fedora-release |awk '{print $3}'`
 618        host_release_major=$host_release_version
 619        host_release_minor=0
 620     elif [ -f /etc/oracle-release ]; then
 621        host_distribution="OracleServer"
 622        host_release_version=`cat /etc/oracle-release |awk '{print $5}'`
 623        host_release_major=`echo $host_release_version |awk -F '.' '{print $1}'`
 624        host_release_minor=`echo $host_release_version |awk -F '.' '{print $2}'`
 625     else
 626        echo "Unable to determine host distribution, ensure lsb_release is installed"
 627        exit 1
 628     fi
 629 fi
 630 echo "Host is $host_distribution $host_release_version"
 631
 632 trap cleanup SIGHUP SIGINT SIGTERM
 633
 634 container_config_create
 635 if [ -n "$template_rootfs" ]; then
 636     container_rootfs_clone
 637 else
 638     container_rootfs_create
 639 fi
 640
 641 container_release_get $container_rootfs
 642
 643 container_rootfs_configure
 644
 645 echo "Container : $container_rootfs"
 646 echo "Config    : $cfg_dir/config"
 647 echo "Network   : eth0 ($lxc_network_type) on $lxc_network_link"