lxc-oci: rely on jq instead of sed to transform values

[mirror_lxc.git] / templates / lxc-sshd.in

diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index 622f8220b3d1ea5b5eba81a1c56178e92a53eb1c..e6f90ad7c96f426934594a72b3022e74e6baa5e4 100644 (file)
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -20,12 +20,24 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in "$@"; do
+    [ "$arg" = "--" ] && break
+    if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
+# Make sure the usual locations are in PATH
+export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
+
 install_sshd()
 {
     rootfs=$1
 
     tree="\
-$rootfs/var/run/sshd \
 $rootfs/var/empty/sshd \
 $rootfs/var/lib/empty/sshd \
 $rootfs/etc/init.d \
@@ -33,7 +45,7 @@ $rootfs/etc/rc.d \
 $rootfs/etc/ssh \
 $rootfs/etc/sysconfig/network-scripts \
 $rootfs/dev/shm \
-$rootfs/run/shm \
+$rootfs/run/sshd \
 $rootfs/proc \
 $rootfs/sys \
 $rootfs/bin \
@@ -50,6 +62,11 @@ $rootfs/lib64"
         return 1
     fi
 
+    ln -s /run $rootfs/var/run
+    if [ $? -ne 0 ]; then
+        return 1
+    fi
+
     return 0
 }
 
@@ -77,17 +94,13 @@ Protocol 2
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_dsa_key
 UsePrivilegeSeparation yes
-KeyRegenerationInterval 3600
-ServerKeyBits 768
 SyslogFacility AUTH
 LogLevel INFO
 LoginGraceTime 120
 PermitRootLogin yes
 StrictModes yes
-RSAAuthentication yes
 PubkeyAuthentication yes
 IgnoreRhosts yes
-RhostsRSAAuthentication no
 HostbasedAuthentication no
 PermitEmptyPasswords yes
 ChallengeResponseAuthentication no
@@ -112,26 +125,27 @@ copy_configuration()
     rootfs=$2
     name=$3
 
-    grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
+    init_path=$(realpath --relative-to=/ $(readlink -f /sbin/init))
+
+    grep -q "^lxc.rootfs.path" $path/config 2>/dev/null || echo "lxc.rootfs.path = $rootfs" >> $path/config
 cat <<EOF >> $path/config
-lxc.utsname = $name
-lxc.pts = 1024
-lxc.kmsg = 0
+lxc.uts.name = $name
+lxc.pty.max = 1024
 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 
 # When using LXC with apparmor, uncomment the next line to run unconfined:
-#lxc.aa_profile = unconfined
+#lxc.apparmor.profile = unconfined
 
 lxc.mount.entry = /dev dev none ro,bind 0 0
 lxc.mount.entry = /lib lib none ro,bind 0 0
 lxc.mount.entry = /bin bin none ro,bind 0 0
 lxc.mount.entry = /usr usr none ro,bind 0 0
 lxc.mount.entry = /sbin sbin none ro,bind 0 0
-lxc.mount.entry = tmpfs var/run/sshd tmpfs mode=0644 0 0
-lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none bind 0 0
-lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry = sysfs sys sysfs ro 0 0
+lxc.mount.entry = tmpfs run/sshd tmpfs mode=0644 0 0
+lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd $init_path none ro,bind 0 0
 lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
+
+lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 EOF
 
     # Oracle Linux and Fedora need the following two bind mounted
@@ -148,7 +162,7 @@ EOF
     fi
 
     # if no .ipv4 section in config, then have the container run dhcp
-    grep -q "^lxc.network.ipv4" $path/config || touch $rootfs/run-dhcp
+    grep -q "^lxc.net.0.ipv4.address" $path/config || touch $rootfs/run-dhcp
 
     if [ "$(uname -m)" = "x86_64" ]; then
         cat <<EOF >> $path/config
@@ -202,10 +216,10 @@ if [ "$(id -u)" != "0" ]; then
     exit 1
 fi
 
-if [ $0 == "/sbin/init" ]; then
+if [ $0 = "/sbin/init" ]; then
 
     PATH="$PATH:/bin:/sbin:/usr/sbin"
-    check_for_cmd @LXCINITDIR@/lxc/lxc-init
+    check_for_cmd @SBINDIR@/init.lxc
     check_for_cmd sshd
     sshd_path=$cmd_path
 
@@ -216,15 +230,15 @@ if [ $0 == "/sbin/init" ]; then
         touch /etc/fstab
         rm -f /dhclient.conf
         cat > /dhclient.conf << EOF
-send host-name "<hostname>";
+send host-name = gethostname();
 EOF
         ifconfig eth0 up
         dhclient eth0 -cf /dhclient.conf
-       echo "Container IP address:"
+        echo "Container IP address:"
         ifconfig eth0 |grep inet
     fi
 
-    exec @LXCINITDIR@/lxc/lxc-init -- $sshd_path
+    exec @SBINDIR@/init.lxc -- $sshd_path
     exit 1
 fi
 
@@ -236,8 +250,8 @@ fi
 # detect rootfs
 config="$path/config"
 if [ -z "$rootfs" ]; then
-    if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
-        rootfs=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $config)
+    if grep -q '^lxc.rootfs.path' $config 2>/dev/null ; then
+        rootfs=$(awk -F= '/^lxc.rootfs.path =/{ print $2 }' $config)
     else
         rootfs=$path/rootfs
     fi