templates: Refuse to run unprivileged

Only the download and ubuntu-cloud templates work with unprivileged
containers, for all others, detect --mapped-uid and error out as early
as possible, recommending the use of the download template.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diff --git a/templates/lxc-alpine.in b/templates/lxc-alpine.in
index 70da08de93446eb8fe17179ec1b41879ec7642f9..232f54bd4ac09b481cef63c95239dcba9275cde8 100644 (file)
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
@@ -1,5 +1,14 @@
 #!/bin/bash
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 key_sha256sums="9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4  alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
 2adcf7ce224f476330b5360ca5edb92fd0bf91c92d83292ed028d7c4e26333ab  alpine-devel@lists.alpinelinux.org-4d07755e.rsa.pub"
 

diff --git a/templates/lxc-altlinux.in b/templates/lxc-altlinux.in
index 1a586d8ad44bb553edd05d4192fe6a76a17a6aa0..385465c1b453649231ef034b7b72dafca1b50095 100644 (file)
--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -24,6 +24,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 #Configurations
 arch=$(uname -m)
 cache_base=@LOCALSTATEDIR@/cache/lxc/altlinux/$arch

diff --git a/templates/lxc-archlinux.in b/templates/lxc-archlinux.in
index 82c4fcb21eeec86732423b7086a7cb978aec8ac7..d394816f137a423ddadf5eb6ad2312469f8af9de 100755 (executable)
--- a/templates/lxc-archlinux.in
+++ b/templates/lxc-archlinux.in
@@ -25,6 +25,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 # defaults
 arch=$(uname -m)
 lxc_network_type="veth"

diff --git a/templates/lxc-busybox.in b/templates/lxc-busybox.in
index 3568c0cfa5e2f95526edb1b3e1c5c92e9834ee9e..f4aa6c40e1771fd1e8807fd8c1f9a4482352435b 100644 (file)
--- a/templates/lxc-busybox.in
+++ b/templates/lxc-busybox.in
@@ -20,6 +20,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 am_in_userns() {
     [ -e /proc/self/uid_map ] || { echo no; return; }
     [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }

diff --git a/templates/lxc-centos.in b/templates/lxc-centos.in
index f5f6e53b29b4e9ba6020fce7151195c611967c57..1fce0e3b406d34768a3f5bc0a18ca427f400ef1f 100644 (file)
--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -72,6 +72,15 @@ lxc_network_link=lxcbr0
 # This may be in /etc/os-release or /etc/system-release-cpe.  We
 # should be able to use EITHER.  Give preference to /etc/os-release for now.
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 if [ -e /etc/os-release ]
 then
 # This is a shell friendly configuration file.  We can just source it.

diff --git a/templates/lxc-cirros.in b/templates/lxc-cirros.in
index 255095674e3eec96bfe4bdcbe4e8a2f0b0508ef4..519013f5c9b9d2cee456beb4c3c8ddfeee0eb91e 100644 (file)
--- a/templates/lxc-cirros.in
+++ b/templates/lxc-cirros.in
@@ -20,6 +20,16 @@
 # You should have received a copy of the GNU General Public License along
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 VERBOSITY=0
 DOWNLOAD_URL="http://download.cirros-cloud.net/"
 CACHE_D="@LOCALSTATEDIR@/cache/lxc/cirros"

diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in
index 5d41396d0d7ba4c275df3fd796fc1072494b094e..376e30d441ebd3e93fa2299dac6a87c30b637a78 100644 (file)
--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -20,6 +20,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 MIRROR=${MIRROR:-http://cdn.debian.net/debian}
 LOCALSTATEDIR="@LOCALSTATEDIR@"
 LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@"

diff --git a/templates/lxc-fedora.in b/templates/lxc-fedora.in
index 2230b5c676a9f2d9f477c9e0432f92399e34a817..b8a233956c552b80e14adad3bddaea0af8338fc7 100644 (file)
--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -72,6 +72,15 @@ lxc_network_link=lxcbr0
 # This may be in /etc/os-release or /etc/system-release-cpe.  We
 # should be able to use EITHER.  Give preference to /etc/os-release for now.
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 if [ -e /etc/os-release ]
 then
 # This is a shell friendly configuration file.  We can just source it.

diff --git a/templates/lxc-gentoo.in b/templates/lxc-gentoo.in
index 0fd392e78b3ff79e131895cbace9b22d8fcd9a7d..dff146e10002787b59513932c38f1e03a199537c 100644 (file)
--- a/templates/lxc-gentoo.in
+++ b/templates/lxc-gentoo.in
@@ -13,6 +13,15 @@
 # - ready to use cache
 #
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 # Ensure strict root's umask doesen't render the VM unusable
 umask 022
 

diff --git a/templates/lxc-openmandriva.in b/templates/lxc-openmandriva.in
index eddaad0356d6291637f4f5eb1f49805a3db38f96..e5d2b1cd4a0c7b7be2c9883897c78f26f9ee3727 100644 (file)
--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -26,6 +26,15 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 #
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 #Configurations
 #distro=cooker
 hostarch=$(uname -m)

diff --git a/templates/lxc-opensuse.in b/templates/lxc-opensuse.in
index 89ae8bd9b7a6ac648a96498619636f13f7476107..fb2186412ed47bf7e2291a6bf4ee12929af2f61e 100644 (file)
--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -25,6 +25,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 DISTRO=12.3
 
 configure_opensuse()

diff --git a/templates/lxc-oracle.in b/templates/lxc-oracle.in
index 40fe5c0f92aaccb8cef55eeabc1c79896833b622..c114ad8352053a987fee0517ebefb7702dbc9815 100644 (file)
--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -27,6 +27,15 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 #
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 # use virbr0 that is setup by default by libvirtd
 lxc_network_type=veth
 lxc_network_link=virbr0

diff --git a/templates/lxc-plamo.in b/templates/lxc-plamo.in
index dd8d29b4c9da925f12c64a7ce533c77ccc20fb39..e9f681e99ba26b0ea469dede61499d393766296a 100644 (file)
--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
@@ -28,6 +28,15 @@
 # ref. https://github.com/Ponce/lxc-slackware/blob/master/lxc-slackware
 #      lxc-ubuntu script
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 [ -r /etc/default/lxc ] && . /etc/default/lxc
 
 DLSCHEME=${DLSCHEME:-"http"}

diff --git a/templates/lxc-sshd.in b/templates/lxc-sshd.in
index 74467bbdbb5dc1122efc3084417958b6f87c98aa..397a388fe3fd10ceb25df141377e4300fd9ee57f 100644 (file)
--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -20,6 +20,15 @@
 # License along with this library; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 install_sshd()
 {
     rootfs=$1

diff --git a/templates/lxc-ubuntu.in b/templates/lxc-ubuntu.in
index 88e7c9c23f66a6d5cbdb4e179b6486093992c69d..b7f9777c91e8f09786fe59715d3b8b186f01655f 100644 (file)
--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -24,6 +24,15 @@
 #  License along with this library; if not, write to the Free Software
 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
+# Detect use under userns (unsupported)
+for arg in $*; do
+    if [ "$arg" == "--mapped-uid" ]; then
+        echo "This template can't be used for unprivileged containers." 1>&2
+        echo "You may want to try the \"download\" template instead." 1>&2
+        exit 1
+    fi
+done
+
 set -e
 
 LOCALSTATEDIR="@LOCALSTATEDIR@"