use strict;
use warnings;
+use Cwd 'abs_path';
use File::stat;
use Digest::SHA;
use IO::File;
use File::Path;
use File::Spec;
use File::Basename;
+use POSIX ();
use PVE::INotify;
use PVE::Tools;
use PVE::Network;
+use PVE::LXC::Setup::Plugin;
+use base qw(PVE::LXC::Setup::Plugin);
+
sub new {
- my ($class, $conf, $rootdir) = @_;
+ my ($class, $conf, $rootdir, $os_release) = @_;
- return bless { conf => $conf, rootdir => $rootdir }, $class;
+ return bless { conf => $conf, rootdir => $rootdir, os_release => $os_release }, $class;
}
sub lookup_dns_conf {
my $nameserver = $conf->{nameserver};
my $searchdomains = $conf->{searchdomain};
- if (!($nameserver && $searchdomains)) {
-
- if ($conf->{'testmode'}) {
-
- $nameserver = "8.8.8.8 8.8.8.9";
- $searchdomains = "proxmox.com";
-
- } else {
-
- my $host_resolv_conf = $self->{host_resolv_conf};
+ if ($conf->{'testmode'}) {
+ $nameserver //= '8.8.8.8 8.8.8.9';
+ $searchdomains //= 'proxmox.com';
+ }
- $searchdomains = $host_resolv_conf->{search};
+ my $host_resolv_conf = $self->{host_resolv_conf};
- my @list = ();
- foreach my $k ("dns1", "dns2", "dns3") {
- if (my $ns = $host_resolv_conf->{$k}) {
- push @list, $ns;
- }
+ if (!defined($nameserver)) {
+ my @list = ();
+ foreach my $k ("dns1", "dns2", "dns3") {
+ if (my $ns = $host_resolv_conf->{$k}) {
+ push @list, $ns;
}
- $nameserver = join(' ', @list);
}
+ $nameserver = join(' ', @list);
+ }
+
+ if (!defined($searchdomains)) {
+ $searchdomains = $host_resolv_conf->{search};
}
return ($searchdomains, $nameserver);
sub update_etc_hosts {
my ($self, $hostip, $oldname, $newname, $searchdomains) = @_;
- my $done = 0;
+ my $hosts_fn = '/etc/hosts';
+ return if $self->ct_is_file_ignored($hosts_fn);
my $namepart = ($newname =~ s/\..*$//r);
# Prepare section:
my $section = '';
- my $hosts_fn = '/etc/hosts';
my $lo4 = "127.0.0.1 localhost.localnet localhost\n";
my $lo6 = "::1 localhost.localnet localhost\n";
if (defined($hostip)) {
$section .= "$hostip $all_names\n";
+ } elsif ($namepart ne 'localhost') {
+ $section .= "127.0.1.1 $all_names\n";
} else {
$section .= "127.0.1.1 $namepart\n";
}
die "please implement this inside subclass"
}
-sub setup_systemd_console {
+# A few distros as well as unprivileged containers cannot deal with the
+# /dev/lxc/ tty subdirectory.
+sub devttydir {
my ($self, $conf) = @_;
+ return $conf->{unprivileged} ? '' : 'lxc/';
+}
- my $systemd_dir_rel = $self->ct_is_executable("/lib/systemd/systemd") ?
- "/lib/systemd/system" : "/usr/lib/systemd/system";
-
- my $systemd_getty_service_rel = "$systemd_dir_rel/getty\@.service";
+sub fixup_old_getty {
+ my ($self) = @_;
- return if !$self->ct_file_exists($systemd_getty_service_rel);
+ my $sd_dir_rel = $self->ct_is_executable("/lib/systemd/systemd") ?
+ "/lib/systemd/system" : "/usr/lib/systemd/system";
- my $raw = $self->ct_file_get_contents($systemd_getty_service_rel);
+ my $sd_getty_service_rel = "$sd_dir_rel/getty\@.service";
+ return if !$self->ct_file_exists($sd_getty_service_rel);
- my $systemd_container_getty_service_rel = "$systemd_dir_rel/container-getty\@.service";
+ my $raw = $self->ct_file_get_contents($sd_getty_service_rel);
+ my $sd_container_getty_service_rel = "$sd_dir_rel/container-getty\@.service";
# systemd on CenoOS 7.1 is too old (version 205), so there is no
# container-getty service
- if (!$self->ct_file_exists($systemd_container_getty_service_rel)) {
+ if (!$self->ct_file_exists($sd_container_getty_service_rel)) {
if ($raw =~ s!^ConditionPathExists=/dev/tty0$!ConditionPathExists=/dev/tty!m) {
- $self->ct_file_set_contents($systemd_getty_service_rel, $raw);
+ $self->ct_file_set_contents($sd_getty_service_rel, $raw);
}
} else {
# undo above change (in case someone updated systemd)
if ($raw =~ s!^ConditionPathExists=/dev/tty$!ConditionPathExists=/dev/tty0!m) {
- $self->ct_file_set_contents($systemd_getty_service_rel, $raw);
+ $self->ct_file_set_contents($sd_getty_service_rel, $raw);
}
}
+}
+
+sub setup_container_getty_service {
+ my ($self, $conf) = @_;
+
+ my $sd_dir = $self->ct_is_executable("/lib/systemd/systemd") ?
+ "/lib/systemd/system" : "/usr/lib/systemd/system";
+
+ # prefer container-getty.service shipped by newer systemd versions
+ # fallback to getty.service and just return if that doesn't exists either..
+ my $template_base = "container-getty\@";
+ my $template_path = "${sd_dir}/${template_base}.service";
+ my $instance_base = $template_base;
+
+ if (!$self->ct_file_exists($template_path)) {
+ $template_base = "getty\@";
+ $template_path = "${template_base}.service";
+ $instance_base = "{$template_base}tty";
+ return if !$self->ct_file_exists($template_path);
+ }
+
+ my $raw = $self->ct_file_get_contents($template_path);
+ my $ttyname = $self->devttydir($conf) . 'tty%I';
+ if ($raw =~ s@pts/%I|lxc/tty%I@$ttyname@g) {
+ $self->ct_file_set_contents($template_path, $raw);
+ }
+ my $getty_target_fn = "/etc/systemd/system/getty.target.wants/";
my $ttycount = PVE::LXC::Config->get_tty_count($conf);
for (my $i = 1; $i < 7; $i++) {
- my $tty_service_lnk = "/etc/systemd/system/getty.target.wants/getty\@tty$i.service";
- if ($i > $ttycount) {
- $self->ct_unlink($tty_service_lnk);
- } else {
- if (!$self->ct_is_symlink($tty_service_lnk)) {
- $self->ct_unlink($tty_service_lnk);
- $self->ct_symlink($systemd_getty_service_rel, $tty_service_lnk);
- }
+ # ensure that not two gettys are using the same tty!
+ $self->ct_unlink("$getty_target_fn/getty\@tty$i.service");
+ $self->ct_unlink("$getty_target_fn/container-getty\@$i.service");
+
+ # re-enable only those requested
+ if ($i <= $ttycount) {
+ my $tty_service = "${instance_base}${i}.service";
+
+ $self->ct_symlink($template_path, "$getty_target_fn/$tty_service");
}
}
-}
-sub setup_container_getty_service {
- my ($self, $nosubdir) = @_;
- my $systemd_dir_rel = $self->ct_is_executable("/lib/systemd/systemd") ?
- "/lib/systemd/system" : "/usr/lib/systemd/system";
- my $servicefile = "$systemd_dir_rel/container-getty\@.service";
- my $raw = $self->ct_file_get_contents($servicefile);
- my $ttyname = ($nosubdir ? '' : 'lxc/') . 'tty%I';
- if ($raw =~ s@pts/%I@$ttyname@g) {
- $self->ct_file_set_contents($servicefile, $raw);
- }
+ # ensure getty.target is not masked
+ $self->ct_unlink("/etc/systemd/system/getty.target");
}
sub setup_systemd_networkd {
my ($has_ipv4, $has_ipv6);
# DHCP bitflags:
- my @DHCPMODES = ('none', 'v4', 'v6', 'both');
+ my @DHCPMODES = ('no', 'v4', 'v6', 'yes');
my ($NONE, $DHCP4, $DHCP6, $BOTH) = (0, 1, 2, 3);
my $dhcp = $NONE;
+ my $accept_ra = 'false';
if (defined(my $ip = $d->{ip})) {
if ($ip eq 'dhcp') {
if (defined(my $ip = $d->{ip6})) {
if ($ip eq 'dhcp') {
$dhcp |= $DHCP6;
+ } elsif ($ip eq 'auto') {
+ $accept_ra = 'true';
} elsif ($ip ne 'manual') {
$has_ipv6 = 1;
$data .= "Address = $ip\n";
}
}
if (defined(my $gw = $d->{gw6})) {
+ $accept_ra = 'false';
$data .= "Gateway = $gw\n";
if ($has_ipv6 && !PVE::Network::is_ip_in_cidr($gw, $d->{ip6}, 6) &&
!PVE::Network::is_ip_in_cidr($gw, 'fe80::/10', 6)) {
}
$data .= "DHCP = $DHCPMODES[$dhcp]\n";
+ $data .= "IPv6AcceptRA = $accept_ra\n";
$data .= $routes if $routes;
$self->ct_file_set_contents($filename, $data);
# root login is already allowed on every device if no securetty present
return if !$self->ct_file_exists($filename);
+ if (!scalar(@add)) {
+ @add = qw(console tty1 tty2 tty3 tty4);
+ if (my $dir = $self->devttydir($conf)) {
+ @add = map { "${dir}$_" } @add;
+ }
+ }
+
my $data = $self->ct_file_get_contents($filename);
chomp $data; $data .= "\n";
foreach my $dev (@add) {
my $last_change = int(time()/(60*60*24));
- if ($epw =~ m/^\$TEST\$/) { # for regression tests
- $last_change = 12345;
- }
-
while (defined (my $line = <$src>)) {
if ($shadow) {
$line =~ s/^${user}:[^:]*:[^:]*:/${user}:${epw}:${last_change}:/;
my $shadow = "/etc/shadow";
if (defined($opt_password)) {
- if ($opt_password !~ m/^\$/) {
+ if ($opt_password !~ m/^\$(?:1|2[axy]?|5|6)\$[a-zA-Z0-9.\/]{1,16}\$[a-zA-Z0-9.\/]+$/) {
my $time = substr (Digest::SHA::sha1_base64 (time), 0, 8);
- $opt_password = crypt(encode("utf8", $opt_password), "\$1\$$time\$");
+ $opt_password = crypt(encode("utf8", $opt_password), "\$6\$$time\$");
};
} else {
$opt_password = '*';
}
};
+sub set_timezone {
+ my ($self, $conf) = @_;
+
+ my $zoneinfo = $conf->{timezone};
+
+ return if !defined($zoneinfo);
+
+ my $tz_path = "/usr/share/zoneinfo/$zoneinfo";
+
+ if ($zoneinfo eq 'host') {
+ $tz_path = $self->{host_localtime};
+ }
+
+ if ($self->ct_file_exists($tz_path)) {
+ if (abs_path('/etc/localtime') ne $tz_path) {
+ my $tmpfile = "localtime.$$.new.tmpfile";
+ $self->ct_symlink($tz_path, $tmpfile);
+ $self->ct_rename($tmpfile, "/etc/localtime");
+ }
+
+ # not all distributions have /etc/timezone
+ if ($self->ct_file_exists('/etc/timezone')) {
+ my $contents = $zoneinfo eq 'host' ? $self->{host_timezone} : $zoneinfo;
+ $self->ct_file_set_contents('/etc/timezone', "$contents\n");
+ }
+ } else {
+ warn "container does not have $tz_path, timezone can not be modified\n";
+ }
+}
+
+sub clear_machine_id {
+ my ($self, $conf, $clone) = @_;
+
+ my $uses_systemd = $self->ct_is_executable("/lib/systemd/systemd")
+ || $self->ct_is_executable("/usr/lib/systemd/systemd");
+
+ my $dbus_machine_id_path = "/var/lib/dbus/machine-id";
+ my $machine_id_path = "/etc/machine-id";
+
+ my $machine_id_existed = $self->ct_file_exists($machine_id_path);
+
+ if (
+ $self->ct_file_exists($dbus_machine_id_path)
+ && !$self->ct_is_symlink($dbus_machine_id_path)
+ && $uses_systemd
+ ) {
+ $self->ct_unlink($dbus_machine_id_path);
+ }
+
+ # truncate on clone to avoid that FirstBoot condition is set
+ if ($clone && ($uses_systemd || $machine_id_existed)) {
+ $self->ct_file_set_contents($machine_id_path, "\n");
+ } elsif (!$clone && $machine_id_existed) {
+ $self->ct_unlink($machine_id_path);
+ }
+}
+
+# tries to guess the systemd (major) version based on the
+# libsystemd-shared<version>.so linked with /sbin/init
+sub get_systemd_version {
+ my ($self, $init) = @_;
+
+ my $version = undef;
+ PVE::Tools::run_command(
+ ['objdump', '-p', $self->{rootdir}.$init],
+ outfunc => sub {
+ my $line = shift;
+ if ($line =~ /libsystemd-shared-(\d+)(?:\.[a-zA-Z0-9]*)?\.so:$/) {
+ $version = $1;
+ }},
+ errmsg => "objdump on $init failed",
+ );
+
+ return $version;
+}
+
+sub unified_cgroupv2_support {
+ my ($self, $init) = @_;
+
+ # https://www.freedesktop.org/software/systemd/man/systemd.html
+ # systemd is installed as symlink to /sbin/init
+ # assume non-systemd init will run with unified cgroupv2
+ if (!defined($init) || $init !~ m@/systemd$@) {
+ return 1;
+ }
+
+ # systemd version 232 (e.g. debian stretch) supports the unified hierarchy
+ my $sdver = $self->get_systemd_version($init);
+ if (!defined($sdver) || $sdver < 232) {
+ return 0;
+ }
+
+ return 1;
+}
+
+sub ssh_host_key_types_to_generate {
+ my ($self) = @_;
+
+ return {
+ rsa => 'ssh_host_rsa_key',
+ dsa => 'ssh_host_dsa_key',
+ ecdsa => 'ssh_host_ecdsa_key',
+ ed25519 => 'ssh_host_ed25519_key',
+ };
+}
+
sub pre_start_hook {
my ($self, $conf) = @_;
+ $self->ct_file_set_contents('/fastboot', ''); # skips fsck, among other things
+
$self->setup_init($conf);
$self->setup_network($conf);
$self->set_hostname($conf);
$self->set_dns($conf);
+ $self->set_timezone($conf);
# fixme: what else ?
}
+sub post_clone_hook {
+ my ($self, $conf) = @_;
+
+ $self->clear_machine_id($conf, 1);
+}
+
sub post_create_hook {
my ($self, $conf, $root_password, $ssh_keys) = @_;
+ $self->clear_machine_id($conf);
$self->template_fixup($conf);
-
+
&$randomize_crontab($self, $conf);
-
+
$self->set_user_password($conf, 'root', $root_password);
$self->set_user_authorized_ssh_keys($conf, 'root', $ssh_keys) if $ssh_keys;
$self->setup_init($conf);
$self->setup_network($conf);
$self->set_hostname($conf);
$self->set_dns($conf);
-
+ $self->set_timezone($conf);
+
# fixme: what else ?
}
# File access wrappers for container setup code.
+# NOTE: those are not direct part of the Plugin API (yet), avoid using them outside the child plugins
# For user-namespace support these might need to take uid and gid maps into account.
sub ct_is_file_ignored {
sub ct_make_path {
my $self = shift;
- if ($self->{id_map}) {
- my $opts = pop;
- if (ref($opts) eq 'HASH') {
- $opts->{owner} = $self->{rootuid} if !defined($self->{owner});
- $opts->{group} = $self->{rootgid} if !defined($self->{group});
- }
- File::Path::make_path(@_, $opts);
- } else {
- File::Path::make_path(@_);
+
+ my $opts = {};
+ if (defined($self->{id_map})) {
+ $opts->{owner} = $self->{rootuid};
+ $opts->{group} = $self->{rootgid};
}
+ File::Path::make_path(@_, $opts);
}
sub ct_symlink {
my ($self, $old, $new) = @_;
return if $self->ct_is_file_ignored($new);
- return CORE::symlink($old, $new);
+ if (CORE::symlink($old, $new)) {
+ if (defined($self->{id_map})) {
+ POSIX::lchown($self->{rootuid}, $self->{rootgid}, $new);
+ }
+ return 1;
+ } else {
+ return 0;
+ }
}
sub ct_readlink {
projects / pve-container.git / blobdiff