use strict;
use warnings;
+use Cwd 'abs_path';
use File::stat;
use Digest::SHA;
use IO::File;
use File::Path;
use File::Spec;
use File::Basename;
+use POSIX ();
use PVE::INotify;
use PVE::Tools;
use PVE::Network;
+use PVE::LXC::Setup::Plugin;
+use PVE::LXC::Tools;
+
+use base qw(PVE::LXC::Setup::Plugin);
+
sub new {
my ($class, $conf, $rootdir, $os_release) = @_;
my $searchdomains = $conf->{searchdomain};
if ($conf->{'testmode'}) {
- return ('proxmox.com', '8.8.8.8 8.8.8.9');
+ $nameserver //= '8.8.8.8 8.8.8.9';
+ $searchdomains //= 'proxmox.com';
}
my $host_resolv_conf = $self->{host_resolv_conf};
die "please implement this inside subclass"
}
-sub setup_systemd_console {
- my ($self, $conf) = @_;
-
- my $systemd_dir_rel = $self->ct_is_executable("/lib/systemd/systemd") ?
- "/lib/systemd/system" : "/usr/lib/systemd/system";
-
- my $systemd_getty_service_rel = "$systemd_dir_rel/getty\@.service";
-
- return if !$self->ct_file_exists($systemd_getty_service_rel);
-
- my $ttycount = PVE::LXC::Config->get_tty_count($conf);
-
- for (my $i = 1; $i < 7; $i++) {
- my $tty_service_lnk = "/etc/systemd/system/getty.target.wants/getty\@tty$i.service";
- if ($i > $ttycount) {
- $self->ct_unlink($tty_service_lnk);
- } else {
- if (!$self->ct_is_symlink($tty_service_lnk)) {
- $self->ct_unlink($tty_service_lnk);
- $self->ct_symlink($systemd_getty_service_rel, $tty_service_lnk);
- }
- }
- }
-}
-
# A few distros as well as unprivileged containers cannot deal with the
# /dev/lxc/ tty subdirectory.
sub devttydir {
$self->ct_symlink($template_path, "$getty_target_fn/$tty_service");
}
}
+
+ # ensure getty.target is not masked
+ $self->ct_unlink("/etc/systemd/system/getty.target");
}
sub setup_systemd_networkd {
my ($has_ipv4, $has_ipv6);
# DHCP bitflags:
- my @DHCPMODES = ('none', 'v4', 'v6', 'both');
+ my @DHCPMODES = ('no', 'ipv4', 'ipv6', 'yes');
my ($NONE, $DHCP4, $DHCP6, $BOTH) = (0, 1, 2, 3);
my $dhcp = $NONE;
my $accept_ra = 'false';
}
}
+# At first boot (/etc/machine-id not existing), systemd goes through a set of `presets` to bring the
+# enable/disable state of services to a default.
+# Meaning for newer templates we should use this instead of manually creating enable/disable
+# symlinks.
+#
+# Disables some common problematic and/or useless units by default.
+#
+# `$extra_preset` should map service names to a bool-ish. It can also hold overrides for the default
+# presets.
+sub setup_systemd_preset {
+ my ($self, $extra_preset) = @_;
+
+ # some don't make sense in CTs, child-plugins can still override through extra_presets
+ my $preset = {
+ 'sys-kernel-config.mount' => 0,
+ 'sys-kernel-debug.mount' => 0,
+ 'getty@.service' => 0,
+ 'container-getty@.service' => 1,
+ };
+
+ if (defined($extra_preset)) {
+ $preset->{$_} = $extra_preset->{$_} for keys $extra_preset->%*;
+ }
+
+ my $preset_data = "# Added by PVE at create-time for first-boot configuration.\n";
+ for my $service (sort keys %$preset) {
+ if ($preset->{$service}) {
+ $preset_data .= "enable $service\n";
+ } else {
+ $preset_data .= "disable $service\n";
+ }
+ }
+
+ $self->ct_mkdir('/etc/systemd/system-preset', 0755);
+ $self->ct_file_set_contents(
+ '/etc/systemd/system-preset/00-pve.preset',
+ $preset_data,
+ );
+}
+
sub setup_securetty {
my ($self, $conf, @add) = @_;
}
};
+sub set_timezone {
+ my ($self, $conf) = @_;
+
+ my $zoneinfo = $conf->{timezone};
+
+ return if !defined($zoneinfo);
+
+ my $tz_path = "/usr/share/zoneinfo/$zoneinfo";
+
+ if ($zoneinfo eq 'host') {
+ $tz_path = $self->{host_localtime};
+ }
+
+ if ($self->ct_file_exists($tz_path)) {
+ if (abs_path('/etc/localtime') ne $tz_path) {
+ my $tmpfile = "localtime.$$.new.tmpfile";
+ $self->ct_symlink($tz_path, $tmpfile);
+ $self->ct_rename($tmpfile, "/etc/localtime");
+ }
+
+ # not all distributions have /etc/timezone
+ if ($self->ct_file_exists('/etc/timezone')) {
+ my $contents = $zoneinfo eq 'host' ? $self->{host_timezone} : $zoneinfo;
+ $self->ct_file_set_contents('/etc/timezone', "$contents\n");
+ }
+ } else {
+ warn "container does not have $tz_path, timezone can not be modified\n";
+ }
+}
+
+sub clear_machine_id {
+ my ($self, $conf, $clone) = @_;
+
+ my $uses_systemd = $self->ct_is_executable("/lib/systemd/systemd")
+ || $self->ct_is_executable("/usr/lib/systemd/systemd");
+
+ my $dbus_machine_id_path = "/var/lib/dbus/machine-id";
+ my $machine_id_path = "/etc/machine-id";
+
+ my $machine_id_existed = $self->ct_file_exists($machine_id_path);
+
+ if (
+ $self->ct_file_exists($dbus_machine_id_path)
+ && !$self->ct_is_symlink($dbus_machine_id_path)
+ && $uses_systemd
+ ) {
+ $self->ct_unlink($dbus_machine_id_path);
+ }
+
+ if ($machine_id_existed) {
+ # truncate exiting ones on clone to avoid FirstBoot condition. admins can override this by
+ # removing the machine-id file or setting it to uninitialized before creating a template, or
+ # cloning a guest - as per machine-id(5) man page. TODO: add explicit switch to API?
+ if ($clone) {
+ my $old_machine_id = $self->ct_file_read_firstline($machine_id_path) // '';
+ if ($uses_systemd && $old_machine_id ne 'uninitialized') {
+ $self->ct_file_set_contents($machine_id_path, "\n") if $uses_systemd;
+ }
+ } else {
+ $self->ct_unlink($machine_id_path);
+ }
+ }
+}
+
+# tries to guess the systemd (major) version based on the
+# libsystemd-shared<version>.so linked with /sbin/init
+sub get_systemd_version {
+ my ($self, $init) = @_;
+
+ my $version = undef;
+ PVE::Tools::run_command(
+ ['objdump', '-p', $self->{rootdir}.$init],
+ outfunc => sub {
+ my $line = shift;
+ if ($line =~ /libsystemd-shared-(\d+)(?:[-.][a-zA-Z0-9]+)*\.so:?$/) {
+ $version = $1;
+ }
+ },
+ errmsg => "objdump on $init failed",
+ );
+
+ return $version;
+}
+
+sub unified_cgroupv2_support {
+ my ($self, $init) = @_;
+
+ # https://www.freedesktop.org/software/systemd/man/systemd.html
+ # systemd is installed as symlink to /sbin/init
+ # assume non-systemd init will run with unified cgroupv2
+ if (!defined($init) || $init !~ m@/systemd$@) {
+ return 1;
+ }
+
+ # systemd version 232 (e.g. debian stretch) supports the unified hierarchy
+ my $sdver = $self->get_systemd_version($init);
+ if (!defined($sdver) || $sdver < 232) {
+ return 0;
+ }
+
+ return 1;
+}
+
+sub get_ct_init_path {
+ my ($self) = @_;
+
+ my $init_path = "/sbin/init";
+ if ($self->ct_is_symlink($init_path)) {
+ $init_path = $self->ct_readlink_recursive($init_path);
+ }
+ return $init_path;
+}
+
+sub ssh_host_key_types_to_generate {
+ my ($self) = @_;
+
+ return {
+ rsa => 'ssh_host_rsa_key',
+ dsa => 'ssh_host_dsa_key',
+ ecdsa => 'ssh_host_ecdsa_key',
+ ed25519 => 'ssh_host_ed25519_key',
+ };
+}
+
+sub detect_architecture {
+ my ($self) = @_;
+
+ # '/bin/sh' is POSIX mandatory
+ return PVE::LXC::Tools::detect_elf_architecture('/bin/sh');
+}
+
sub pre_start_hook {
my ($self, $conf) = @_;
+ $self->ct_file_set_contents('/fastboot', ''); # skips fsck, among other things
+
$self->setup_init($conf);
$self->setup_network($conf);
$self->set_hostname($conf);
$self->set_dns($conf);
+ $self->set_timezone($conf);
# fixme: what else ?
}
+sub post_clone_hook {
+ my ($self, $conf) = @_;
+
+ $self->clear_machine_id($conf, 1);
+}
+
sub post_create_hook {
my ($self, $conf, $root_password, $ssh_keys) = @_;
+ $self->clear_machine_id($conf);
$self->template_fixup($conf);
-
+
&$randomize_crontab($self, $conf);
-
+
$self->set_user_password($conf, 'root', $root_password);
$self->set_user_authorized_ssh_keys($conf, 'root', $ssh_keys) if $ssh_keys;
$self->setup_init($conf);
$self->setup_network($conf);
$self->set_hostname($conf);
$self->set_dns($conf);
-
+ $self->set_timezone($conf);
+
# fixme: what else ?
}
# File access wrappers for container setup code.
+# NOTE: those are not direct part of the Plugin API (yet), avoid using them outside the child plugins
# For user-namespace support these might need to take uid and gid maps into account.
sub ct_is_file_ignored {
sub ct_make_path {
my $self = shift;
- if ($self->{id_map}) {
- my $opts = pop;
- if (ref($opts) eq 'HASH') {
- $opts->{owner} = $self->{rootuid} if !defined($self->{owner});
- $opts->{group} = $self->{rootgid} if !defined($self->{group});
- }
- File::Path::make_path(@_, $opts);
- } else {
- File::Path::make_path(@_);
+
+ my $opts = {};
+ if (defined($self->{id_map})) {
+ $opts->{owner} = $self->{rootuid};
+ $opts->{group} = $self->{rootgid};
}
+ File::Path::make_path(@_, $opts);
}
sub ct_symlink {
my ($self, $old, $new) = @_;
return if $self->ct_is_file_ignored($new);
- return CORE::symlink($old, $new);
+ if (CORE::symlink($old, $new)) {
+ if (defined($self->{id_map})) {
+ POSIX::lchown($self->{rootuid}, $self->{rootgid}, $new);
+ }
+ return 1;
+ } else {
+ return 0;
+ }
}
sub ct_readlink {
return CORE::readlink($name);
}
+sub ct_readlink_recursive {
+ my ($self, $name) = @_;
+
+ my $res = $name;
+ for (my $i = 0; $self->ct_is_symlink($res); $i++) {
+ # arbitrary limit, but should be enough for all for our management relevant things
+ die "maximal link depth of 10 for resolving '$name' reached, abort\n" if $i >= 10;
+ $res = $self->ct_readlink($res);
+ $res = abs_path($res);
+ }
+ return $res;
+}
+
sub ct_file_exists {
my ($self, $file) = @_;
return -f $file;
return $data =~ s/^\h*\Q$head\E.*^\h*\Q$tail\E.*?$//rgms;
}
+# templates from images.linuxcontainers.org have a bogus LXC_NAME line in /etc/hosts
+sub remove_lxc_name_from_etc_hosts {
+ my ($self) = @_;
+
+ return if ! -e '/etc/hosts';
+
+ my $hosts = $self->ct_file_get_contents('/etc/hosts');
+ my @lines = grep { !/^127.0.1.1\s+LXC_NAME$/ } split(/\n/, $hosts);
+
+ $hosts = join("\n", @lines). "\n";
+
+ $self->ct_file_set_contents('/etc/hosts', $hosts);
+}
+
1;
projects / pve-container.git / blobdiff