use File::Path;
use File::Spec;
use File::Basename;
+use POSIX ();
use PVE::INotify;
use PVE::Tools;
use PVE::Network;
use PVE::LXC::Setup::Plugin;
+use PVE::LXC::Tools;
+
use base qw(PVE::LXC::Setup::Plugin);
sub new {
my ($has_ipv4, $has_ipv6);
# DHCP bitflags:
- my @DHCPMODES = ('no', 'v4', 'v6', 'both');
+ my @DHCPMODES = ('no', 'ipv4', 'ipv6', 'yes');
my ($NONE, $DHCP4, $DHCP6, $BOTH) = (0, 1, 2, 3);
my $dhcp = $NONE;
my $accept_ra = 'false';
}
}
+# At first boot (/etc/machine-id not existing), systemd goes through a set of `presets` to bring the
+# enable/disable state of services to a default.
+# Meaning for newer templates we should use this instead of manually creating enable/disable
+# symlinks.
+#
+# Disables some common problematic and/or useless units by default.
+#
+# `$extra_preset` should map service names to a bool-ish. It can also hold overrides for the default
+# presets.
+sub setup_systemd_preset {
+ my ($self, $extra_preset) = @_;
+
+ # some don't make sense in CTs, child-plugins can still override through extra_presets
+ my $preset = {
+ 'sys-kernel-config.mount' => 0,
+ 'sys-kernel-debug.mount' => 0,
+ 'getty@.service' => 0,
+ 'container-getty@.service' => 1,
+ };
+
+ if (defined($extra_preset)) {
+ $preset->{$_} = $extra_preset->{$_} for keys $extra_preset->%*;
+ }
+
+ my $preset_data = "# Added by PVE at create-time for first-boot configuration.\n";
+ for my $service (sort keys %$preset) {
+ if ($preset->{$service}) {
+ $preset_data .= "enable $service\n";
+ } else {
+ $preset_data .= "disable $service\n";
+ }
+ }
+
+ $self->ct_mkdir('/etc/systemd/system-preset', 0755);
+ $self->ct_file_set_contents(
+ '/etc/systemd/system-preset/00-pve.preset',
+ $preset_data,
+ );
+}
+
sub setup_securetty {
my ($self, $conf, @add) = @_;
$self->ct_unlink($dbus_machine_id_path);
}
- # truncate on clone to avoid that FirstBoot condition is set
- if ($clone && ($uses_systemd || $machine_id_existed)) {
- $self->ct_file_set_contents($machine_id_path, "\n");
- } elsif (!$clone && $machine_id_existed) {
- $self->ct_unlink($machine_id_path);
+ if ($machine_id_existed) {
+ # truncate exiting ones on clone to avoid FirstBoot condition. admins can override this by
+ # removing the machine-id file or setting it to uninitialized before creating a template, or
+ # cloning a guest - as per machine-id(5) man page. TODO: add explicit switch to API?
+ if ($clone) {
+ my $old_machine_id = $self->ct_file_read_firstline($machine_id_path) // '';
+ if ($uses_systemd && $old_machine_id ne 'uninitialized') {
+ $self->ct_file_set_contents($machine_id_path, "\n") if $uses_systemd;
+ }
+ } else {
+ $self->ct_unlink($machine_id_path);
+ }
}
}
-# tries to guess the systemd version based on the existence of
-# (/usr)?/lib/systemd/libsystemd-shared<version>.so. It was introduced in v231.
+# tries to guess the systemd (major) version based on the
+# libsystemd-shared<version>.so linked with /sbin/init
sub get_systemd_version {
- my ($self) = @_;
-
- my $sd_lib_dir = $self->ct_is_directory("/lib/systemd") ?
- "/lib/systemd" : "/usr/lib/systemd";
- my $libsd = PVE::Tools::dir_glob_regex($sd_lib_dir, "libsystemd-shared-.+\.so");
- if (defined($libsd) && $libsd =~ /libsystemd-shared-(\d+)\.so/) {
- return $1;
- }
+ my ($self, $init) = @_;
+
+ my $version = undef;
+ PVE::Tools::run_command(
+ ['objdump', '-p', $self->{rootdir}.$init],
+ outfunc => sub {
+ my $line = shift;
+ if ($line =~ /libsystemd-shared-(\d+)(?:[-.][a-zA-Z0-9]+)*\.so:?$/) {
+ $version = $1;
+ }
+ },
+ errmsg => "objdump on $init failed",
+ );
- return undef;
+ return $version;
}
sub unified_cgroupv2_support {
- my ($self) = @_;
+ my ($self, $init) = @_;
# https://www.freedesktop.org/software/systemd/man/systemd.html
# systemd is installed as symlink to /sbin/init
- my $systemd = $self->ct_readlink('/sbin/init');
-
# assume non-systemd init will run with unified cgroupv2
- if (!defined($systemd) || $systemd !~ m@/systemd$@) {
+ if (!defined($init) || $init !~ m@/systemd$@) {
return 1;
}
# systemd version 232 (e.g. debian stretch) supports the unified hierarchy
- my $sdver = $self->get_systemd_version();
+ my $sdver = $self->get_systemd_version($init);
if (!defined($sdver) || $sdver < 232) {
return 0;
}
- return 1
+ return 1;
+}
+
+sub get_ct_init_path {
+ my ($self) = @_;
+
+ my $init_path = "/sbin/init";
+ if ($self->ct_is_symlink($init_path)) {
+ $init_path = $self->ct_readlink_recursive($init_path);
+ }
+ return $init_path;
}
sub ssh_host_key_types_to_generate {
};
}
+sub detect_architecture {
+ my ($self) = @_;
+
+ # '/bin/sh' is POSIX mandatory
+ return PVE::LXC::Tools::detect_elf_architecture('/bin/sh');
+}
+
sub pre_start_hook {
my ($self, $conf) = @_;
sub ct_make_path {
my $self = shift;
- if ($self->{id_map}) {
- my $opts = pop;
- if (ref($opts) eq 'HASH') {
- $opts->{owner} = $self->{rootuid} if !defined($self->{owner});
- $opts->{group} = $self->{rootgid} if !defined($self->{group});
- }
- File::Path::make_path(@_, $opts);
- } else {
- File::Path::make_path(@_);
+
+ my $opts = {};
+ if (defined($self->{id_map})) {
+ $opts->{owner} = $self->{rootuid};
+ $opts->{group} = $self->{rootgid};
}
+ File::Path::make_path(@_, $opts);
}
sub ct_symlink {
my ($self, $old, $new) = @_;
return if $self->ct_is_file_ignored($new);
- return CORE::symlink($old, $new);
+ if (CORE::symlink($old, $new)) {
+ if (defined($self->{id_map})) {
+ POSIX::lchown($self->{rootuid}, $self->{rootgid}, $new);
+ }
+ return 1;
+ } else {
+ return 0;
+ }
}
sub ct_readlink {
return CORE::readlink($name);
}
+sub ct_readlink_recursive {
+ my ($self, $name) = @_;
+
+ my $res = $name;
+ for (my $i = 0; $self->ct_is_symlink($res); $i++) {
+ # arbitrary limit, but should be enough for all for our management relevant things
+ die "maximal link depth of 10 for resolving '$name' reached, abort\n" if $i >= 10;
+ $res = $self->ct_readlink($res);
+ $res = abs_path($res);
+ }
+ return $res;
+}
+
sub ct_file_exists {
my ($self, $file) = @_;
return -f $file;
return $data =~ s/^\h*\Q$head\E.*^\h*\Q$tail\E.*?$//rgms;
}
+# templates from images.linuxcontainers.org have a bogus LXC_NAME line in /etc/hosts
+sub remove_lxc_name_from_etc_hosts {
+ my ($self) = @_;
+
+ return if ! -e '/etc/hosts';
+
+ my $hosts = $self->ct_file_get_contents('/etc/hosts');
+ my @lines = grep { !/^127.0.1.1\s+LXC_NAME$/ } split(/\n/, $hosts);
+
+ $hosts = join("\n", @lines). "\n";
+
+ $self->ct_file_set_contents('/etc/hosts', $hosts);
+}
+
1;
projects / pve-container.git / blobdiff