templates/lxc-busybox.in

   1 #!/bin/bash
   2
   3 #
   4 # lxc: linux Container library
   5
   6 # Authors:
   7 # Daniel Lezcano <daniel.lezcano@free.fr>
   8
   9 # This library is free software; you can redistribute it and/or
  10 # modify it under the terms of the GNU Lesser General Public
  11 # License as published by the Free Software Foundation; either
  12 # version 2.1 of the License, or (at your option) any later version.
  13
  14 # This library is distributed in the hope that it will be useful,
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # Lesser General Public License for more details.
  18
  19 # You should have received a copy of the GNU Lesser General Public
  20 # License along with this library; if not, write to the Free Software
  21 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  22
  23 LXC_MAPPED_UID=
  24 LXC_MAPPED_GID=
  25
  26 # Make sure the usual locations are in PATH
  27 export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin
  28
  29 am_in_userns() {
  30     [ -e /proc/self/uid_map ] || { echo no; return; }
  31     [ "$(wc -l /proc/self/uid_map | awk '{ print $1 }')" -eq 1 ] || { echo yes; return; }
  32     line=$(awk '{ print $1 " " $2 " " $3 }' /proc/self/uid_map)
  33     [ "$line" = "0 0 4294967295" ] && { echo no; return; }
  34     echo yes
  35 }
  36
  37 in_userns=0
  38 [ $(am_in_userns) = "yes" ] && in_userns=1
  39
  40 install_busybox()
  41 {
  42     rootfs=$1
  43     name=$2
  44     res=0
  45     tree="\
  46 $rootfs/selinux \
  47 $rootfs/dev \
  48 $rootfs/home \
  49 $rootfs/root \
  50 $rootfs/etc \
  51 $rootfs/etc/init.d \
  52 $rootfs/bin \
  53 $rootfs/usr/bin \
  54 $rootfs/sbin \
  55 $rootfs/usr/sbin \
  56 $rootfs/proc \
  57 $rootfs/sys \
  58 $rootfs/mnt \
  59 $rootfs/tmp \
  60 $rootfs/var/log \
  61 $rootfs/usr/share/udhcpc \
  62 $rootfs/dev/pts \
  63 $rootfs/dev/shm \
  64 $rootfs/lib \
  65 $rootfs/usr/lib \
  66 $rootfs/lib64 \
  67 $rootfs/usr/lib64"
  68
  69     mkdir -p $tree || return 1
  70     chmod 755 $tree || return 1
  71
  72     pushd $rootfs/dev > /dev/null || return 1
  73
  74     # minimal devices needed for busybox
  75     if [ $in_userns -eq 1 ]; then
  76         for dev in tty console tty0 tty1 ram0 null urandom; do
  77             echo "lxc.mount.entry = /dev/$dev dev/$dev    none bind,optional,create=file 0 0" >> $path/config
  78         done
  79     else
  80         mknod -m 666 tty c 5 0       || res=1
  81         mknod -m 666 console c 5 1   || res=1
  82         mknod -m 666 tty0 c 4 0      || res=1
  83         mknod -m 666 tty1 c 4 0      || res=1
  84         mknod -m 666 tty5 c 4 0      || res=1
  85         mknod -m 600 ram0 b 1 0      || res=1
  86         mknod -m 666 null c 1 3      || res=1
  87         mknod -m 666 zero c 1 5      || res=1
  88         mknod -m 666 urandom c 1 9   || res=1
  89     fi
  90
  91     popd > /dev/null
  92
  93     # root user defined
  94     cat <<EOF >> $rootfs/etc/passwd
  95 root:x:0:0:root:/root:/bin/sh
  96 EOF
  97
  98     cat <<EOF >> $rootfs/etc/group
  99 root:x:0:root
 100 EOF
 101
 102     # mount everything
 103     cat <<EOF >> $rootfs/etc/init.d/rcS
 104 #!/bin/sh
 105 /bin/syslogd
 106 /bin/mount -a
 107 /bin/udhcpc
 108 EOF
 109
 110     # executable
 111     chmod 744 $rootfs/etc/init.d/rcS || return 1
 112
 113     # launch rcS first then make a console available
 114     # and propose a shell on the tty, the last one is
 115     # not needed
 116     cat <<EOF >> $rootfs/etc/inittab
 117 ::sysinit:/etc/init.d/rcS
 118 tty1::respawn:/bin/getty -L tty1 115200 vt100
 119 console::askfirst:/bin/sh
 120 EOF
 121     # writable and readable for other
 122     chmod 644 $rootfs/etc/inittab || return 1
 123
 124     cat <<EOF >> $rootfs/usr/share/udhcpc/default.script
 125 #!/bin/sh
 126 case "\$1" in
 127     deconfig)
 128         ip addr flush dev \$interface
 129         ;;
 130
 131     renew|bound)
 132         # flush all the routes
 133         if [ -n "\$router" ]; then
 134             ip route del default 2> /dev/null
 135         fi
 136
 137         # check broadcast
 138         if [ -n "\$broadcast" ]; then
 139             broadcast="broadcast \$broadcast"
 140         fi
 141
 142         # add a new ip address
 143         ip addr add \$ip/\$mask \$broadcast dev \$interface
 144
 145         if [ -n "\$router" ]; then
 146             ip route add default via \$router dev \$interface
 147         fi
 148
 149         [ -n "\$domain" ] && echo search \$domain > /etc/resolv.conf
 150         for i in \$dns ; do
 151             echo nameserver \$i >> /etc/resolv.conf
 152         done
 153         ;;
 154 esac
 155 exit 0
 156 EOF
 157
 158     chmod 744 $rootfs/usr/share/udhcpc/default.script
 159
 160     return $res
 161 }
 162
 163 configure_busybox()
 164 {
 165     rootfs=$1
 166
 167     which busybox >/dev/null 2>&1
 168
 169     if [ $? -ne 0 ]; then
 170         echo "busybox executable is not accessible"
 171         return 1
 172     fi
 173
 174     file -L $(which busybox) | grep -q "statically linked"
 175     if [ $? -ne 0 ]; then
 176         echo "warning : busybox is not statically linked."
 177         echo "warning : The template script may not correctly"
 178         echo "warning : setup the container environment."
 179     fi
 180
 181     # copy busybox in the rootfs
 182     cp $(which busybox) $rootfs/bin
 183     if [ $? -ne 0 ]; then
 184         echo "failed to copy busybox in the rootfs"
 185         return 1
 186     fi
 187
 188     # symlink busybox for the commands it supports
 189     # it would be nice to just use "chroot $rootfs busybox --install -s /bin"
 190     # but that only works right in a chroot with busybox >= 1.19.0
 191     pushd $rootfs/bin > /dev/null || return 1
 192     ./busybox --help | grep 'Currently defined functions:' -A300 | \
 193       grep -v 'Currently defined functions:' | tr , '\n' | \
 194       xargs -n1 ln -s busybox
 195     popd > /dev/null
 196
 197     # relink /sbin/init
 198     ln $rootfs/bin/busybox $rootfs/sbin/init
 199
 200     # passwd exec must be setuid
 201     chmod +s $rootfs/bin/passwd
 202     touch $rootfs/etc/shadow
 203
 204     # setting passwd for root
 205     CHPASSWD_FILE=$rootfs/root/chpasswd.sh
 206
 207     cat <<EOF >$CHPASSWD_FILE
 208 echo "setting root password to \"root\""
 209
 210 mount -n --bind /lib $rootfs/lib
 211 if [ \$? -ne 0 ]; then
 212     echo "Failed bind-mounting /lib at $rootfs/lib"
 213     exit 1
 214 fi
 215
 216 chroot $rootfs chpasswd <<EOFF 2>/dev/null
 217 root:root
 218 EOFF
 219
 220
 221 if [ \$? -ne 0 ]; then
 222     echo "Failed to change root password"
 223     exit 1
 224 fi
 225
 226 umount $rootfs/lib
 227
 228 EOF
 229
 230     lxc-unshare -s MOUNT -- /bin/sh < $CHPASSWD_FILE
 231     rm $CHPASSWD_FILE
 232
 233     # add ssh functionality if dropbear package available on host
 234     which dropbear >/dev/null 2>&1
 235     if [ $? -eq 0 ]; then
 236         # copy dropbear binary
 237         cp $(which dropbear) $rootfs/usr/sbin
 238         if [ $? -ne 0 ]; then
 239             echo "Failed to copy dropbear in the rootfs"
 240             return 1
 241         fi
 242
 243         # make symlinks to various ssh utilities
 244         utils="\
 245             $rootfs/usr/bin/dbclient \
 246             $rootfs/usr/bin/scp \
 247             $rootfs/usr/bin/ssh \
 248             $rootfs/usr/sbin/dropbearkey \
 249             $rootfs/usr/sbin/dropbearconvert \
 250         "
 251         echo $utils | xargs -n1 ln -s /usr/sbin/dropbear
 252
 253         # add necessary config files
 254         mkdir $rootfs/etc/dropbear
 255         dropbearkey -t rsa -f $rootfs/etc/dropbear/dropbear_rsa_host_key > /dev/null 2>&1
 256         dropbearkey -t dss -f $rootfs/etc/dropbear/dropbear_dss_host_key > /dev/null 2>&1
 257
 258         echo "'dropbear' ssh utility installed"
 259     fi
 260
 261     return 0
 262 }
 263
 264 copy_configuration()
 265 {
 266     path=$1
 267     rootfs=$2
 268     name=$3
 269
 270 grep -q "^lxc.rootfs" $path/config 2>/dev/null || echo "lxc.rootfs = $rootfs" >> $path/config
 271 cat <<EOF >> $path/config
 272 lxc.haltsignal = SIGUSR1
 273 lxc.utsname = $name
 274 lxc.tty = 1
 275 lxc.pts = 1
 276 lxc.cap.drop = sys_module mac_admin mac_override sys_time
 277
 278 # When using LXC with apparmor, uncomment the next line to run unconfined:
 279 #lxc.aa_profile = unconfined
 280
 281 lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
 282 lxc.mount.entry = shm /dev/shm tmpfs defaults 0 0
 283 EOF
 284
 285     libdirs="\
 286         lib \
 287         usr/lib \
 288         lib64 \
 289         usr/lib64"
 290
 291     for dir in $libdirs; do
 292         if [ -d "/$dir" ] && [ -d "$rootfs/$dir" ]; then
 293             echo "lxc.mount.entry = /$dir $dir none ro,bind 0 0" >> $path/config
 294         fi
 295     done
 296     echo "lxc.mount.entry = /sys/kernel/security sys/kernel/security none ro,bind,optional 0 0" >>$path/config
 297 }
 298
 299 remap_userns()
 300 {
 301     path=$1
 302
 303     if [ -n "$LXC_MAPPED_UID" ] && [ "$LXC_MAPPED_UID" != "-1" ]; then
 304         chown $LXC_MAPPED_UID $path/config >/dev/null 2>&1
 305         chown -R root $path/rootfs >/dev/null 2>&1
 306     fi
 307
 308     if [ -n "$LXC_MAPPED_GID" ] && [ "$LXC_MAPPED_GID" != "-1" ]; then
 309         chgrp $LXC_MAPPED_GID $path/config >/dev/null 2>&1
 310         chgrp -R root $path/rootfs >/dev/null 2>&1
 311     fi
 312 }
 313
 314 usage()
 315 {
 316     cat <<EOF
 317 $1 -h|--help -p|--path=<path>
 318 EOF
 319     return 0
 320 }
 321
 322 options=$(getopt -o hp:n: -l help,rootfs:,path:,name:,mapped-uid:,mapped-gid: -- "$@")
 323 if [ $? -ne 0 ]; then
 324     usage $(basename $0)
 325     exit 1
 326 fi
 327 eval set -- "$options"
 328
 329 while true
 330 do
 331     case "$1" in
 332         -h|--help)      usage $0 && exit 0;;
 333         -p|--path)      path=$2; shift 2;;
 334         --rootfs)       rootfs=$2; shift 2;;
 335         -n|--name)      name=$2; shift 2;;
 336         --mapped-uid)   LXC_MAPPED_UID=$2; shift 2;;
 337         --mapped-gid)   LXC_MAPPED_GID=$2; shift 2;;
 338         --)             shift 1; break ;;
 339         *)              break ;;
 340     esac
 341 done
 342
 343 if [ "$(id -u)" != "0" ]; then
 344     echo "This script should be run as 'root'"
 345     exit 1
 346 fi
 347
 348 if [ -z "$path" ]; then
 349     echo "'path' parameter is required"
 350     exit 1
 351 fi
 352
 353 # detect rootfs
 354 config="$path/config"
 355 if [ -z "$rootfs" ]; then
 356     if grep -q '^lxc.rootfs' $config 2>/dev/null ; then
 357         rootfs=$(awk -F= '/^lxc.rootfs =/{ print $2 }' $config)
 358     else
 359         rootfs=$path/rootfs
 360     fi
 361 fi
 362
 363 install_busybox $rootfs $name
 364 if [ $? -ne 0 ]; then
 365     echo "failed to install busybox's rootfs"
 366     exit 1
 367 fi
 368
 369 configure_busybox $rootfs
 370 if [ $? -ne 0 ]; then
 371     echo "failed to configure busybox template"
 372     exit 1
 373 fi
 374
 375 copy_configuration $path $rootfs $name
 376 if [ $? -ne 0 ]; then
 377     echo "failed to write configuration file"
 378     exit 1
 379 fi
 380
 381 remap_userns $path
 382 if [ $? -ne 0 ]; then
 383     echo "failed to remap files to user"
 384     exit 1
 385 fi