src/PVE/LXC/Create.pm

   1 package PVE::LXC::Create;
   2
   3 use strict;
   4 use warnings;
   5 use File::Basename;
   6 use File::Path;
   7 use Fcntl;
   8
   9 use PVE::RPCEnvironment;
  10 use PVE::Storage::PBSPlugin;
  11 use PVE::Storage;
  12 use PVE::DataCenterConfig;
  13 use PVE::LXC;
  14 use PVE::LXC::Setup;
  15 use PVE::VZDump::ConvertOVZ;
  16 use PVE::Tools;
  17 use POSIX;
  18
  19 sub detect_architecture {
  20     my ($rootdir) = @_;
  21
  22     # see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
  23
  24     my $supported_elf_machine = {
  25         0x03 => 'i386',
  26         0x3e => 'amd64',
  27         0x28 => 'armhf',
  28         0xb7 => 'arm64',
  29         0xf3 => 'riscv',
  30     };
  31
  32     my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory
  33     my $detect_arch = sub {
  34         # chroot avoids a problem where we check the binary of the host system
  35         # if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash)
  36         chroot($rootdir) or die "chroot '$rootdir' failed: $!\n";
  37         chdir('/') or die "failed to change to root directory\n";
  38
  39         open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n";
  40         binmode($fh);
  41
  42         my $length = read($fh, my $data, 20) or die "read failed: $!\n";
  43
  44         # 4 bytes ELF magic number and 1 byte ELF class, padding, machine
  45         my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data);
  46
  47         die "'$elf_fn' does not resolve to an ELF!\n"
  48             if (!defined($class) || !defined($magic) || $magic ne "\177ELF");
  49
  50         my $arch = $supported_elf_machine->{$machine};
  51         die "'$elf_fn' has unknown ELF machine '$machine'!\n"
  52             if !defined($arch);
  53
  54         if ($arch eq 'riscv') {
  55             if ($class eq 1) {
  56                 $arch = 'riscv32';
  57             } elsif ($class eq 2) {
  58                 $arch = 'riscv64';
  59             } else {
  60                 die "'$elf_fn' has invalid class '$class'!\n";
  61             }
  62         }
  63
  64         return $arch;
  65     };
  66
  67     my $arch = eval { PVE::Tools::run_fork_with_timeout(10, $detect_arch); };
  68     my $err = $@;
  69
  70     if (!defined($arch) && !defined($err)) {
  71         # on timeout
  72         die "Architecture detection failed: timeout\n";
  73     } elsif ($err) {
  74         # any other error
  75         $arch = 'amd64';
  76         print "Architecture detection failed: $err\nFalling back to $arch.\n" .
  77               "Use `pct set VMID --arch ARCH` to change.\n";
  78     } else {
  79         print "Detected container architecture: $arch\n";
  80     }
  81
  82     return $arch;
  83 }
  84
  85 sub restore_archive {
  86     my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
  87
  88     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
  89     if (defined($storeid)) {
  90         my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
  91         if ($scfg->{type} eq 'pbs') {
  92             return restore_proxmox_backup_archive($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
  93         }
  94     }
  95
  96     $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $archive) if $archive ne '-';
  97     restore_tar_archive($archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
  98 }
  99
 100 sub restore_proxmox_backup_archive {
 101     my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
 102
 103     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
 104     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 105
 106     my ($vtype, $name, undef, undef, undef, undef, $format) =
 107         PVE::Storage::parse_volname($storage_cfg, $archive);
 108
 109     die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
 110
 111     die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
 112
 113     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 114     my $userns_cmd = PVE::LXC::userns_command($id_map);
 115
 116     my $cmd = "restore";
 117     my $param = [$name, "root.pxar", $rootdir, '--allow-existing-dirs'];
 118
 119     PVE::Storage::PBSPlugin::run_raw_client_cmd(
 120         $scfg, $storeid, $cmd, $param, userns_cmd => $userns_cmd);
 121
 122     # if arch is set, we do not try to autodetect it
 123     return if defined($conf->{arch});
 124
 125     $conf->{arch} = detect_architecture($rootdir);
 126 }
 127
 128 sub restore_tar_archive {
 129     my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
 130
 131     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 132     my $userns_cmd = PVE::LXC::userns_command($id_map);
 133
 134     my $archive_fh;
 135     my $tar_input = '<&STDIN';
 136     my @compression_opt;
 137     if ($archive ne '-') {
 138         # GNU tar refuses to autodetect this... *sigh*
 139         my %compression_map = (
 140             '.gz'  => '-z',
 141             '.bz2' => '-j',
 142             '.xz'  => '-J',
 143             '.lzo'  => '--lzop',
 144             '.zst'  => '--zstd',
 145         );
 146         if ($archive =~ /\.tar(\.[^.]+)?$/) {
 147             if (defined($1)) {
 148                 die "unrecognized compression format: $1\n" if !defined($compression_map{$1});
 149                 @compression_opt = $compression_map{$1};
 150             }
 151         } else {
 152             die "file does not look like a template archive: $archive\n";
 153         }
 154         sysopen($archive_fh, $archive, O_RDONLY)
 155             or die "failed to open '$archive': $!\n";
 156         my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0);
 157         $archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC()));
 158         $tar_input = '<&'.fileno($archive_fh);
 159     }
 160
 161     my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals',
 162                @PVE::Storage::Plugin::COMMON_TAR_FLAGS,
 163                '-C', $rootdir];
 164
 165     # skip-old-files doesn't have anything to do with time (old/new), but is
 166     # simply -k (annoyingly also called --keep-old-files) without the 'treat
 167     # existing files as errors' part... iow. it's bsdtar's interpretation of -k
 168     # *sigh*, gnu...
 169     push @$cmd, '--skip-old-files';
 170     push @$cmd, '--anchored';
 171     push @$cmd, '--exclude' , './dev/*';
 172
 173     if (defined($bwlimit)) {
 174         $cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
 175     }
 176
 177     if ($archive eq '-') {
 178         print "extracting archive from STDIN\n";
 179     } else {
 180         print "extracting archive '$archive'\n";
 181     }
 182     eval { PVE::Tools::run_command($cmd, input => $tar_input); };
 183     my $err = $@;
 184     close($archive_fh) if defined $archive_fh;
 185     die $err if $err && !$no_unpack_error;
 186
 187     # if arch is set, we do not try to autodetect it
 188     return if defined($conf->{arch});
 189
 190     $conf->{arch} = detect_architecture($rootdir);
 191 }
 192
 193 sub recover_config {
 194     my ($storage_cfg, $volid, $vmid) = @_;
 195
 196     my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 197     if (defined($storeid)) {
 198         my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
 199         if ($scfg->{type} eq 'pbs') {
 200             return recover_config_from_proxmox_backup($storage_cfg, $volid, $vmid);
 201         }
 202     }
 203
 204     my $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $volid);
 205     recover_config_from_tar($archive, $vmid);
 206 }
 207
 208 sub recover_config_from_proxmox_backup {
 209     my ($storage_cfg, $volid, $vmid) = @_;
 210
 211     $vmid //= 0;
 212
 213     my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
 214     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 215
 216     my ($vtype, $name, undef, undef, undef, undef, $format) =
 217         PVE::Storage::parse_volname($storage_cfg, $volid);
 218
 219     die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
 220
 221     die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
 222
 223     my $cmd = "restore";
 224     my $param = [$name, "pct.conf", "-"];
 225
 226     my $raw = '';
 227     my $outfunc = sub { my $line = shift; $raw .= "$line\n"; };
 228     PVE::Storage::PBSPlugin::run_raw_client_cmd(
 229         $scfg,  $storeid, $cmd, $param, outfunc => $outfunc);
 230
 231     my $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
 232
 233     delete $conf->{snapshots};
 234
 235     my $mp_param = {};
 236     PVE::LXC::Config->foreach_volume($conf, sub {
 237         my ($ms, $mountpoint) = @_;
 238         $mp_param->{$ms} = $conf->{$ms};
 239     });
 240
 241     return wantarray ? ($conf, $mp_param) : $conf;
 242 }
 243
 244 sub recover_config_from_tar {
 245     my ($archive, $vmid) = @_;
 246
 247     my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct|vps)\.conf)$!);
 248     my $conf;
 249     my $mp_param = {};
 250     $vmid //= 0;
 251
 252     if ($conf_file =~ m/pct\.conf/) {
 253
 254         $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
 255
 256         delete $conf->{snapshots};
 257
 258         PVE::LXC::Config->foreach_volume($conf, sub {
 259             my ($ms, $mountpoint) = @_;
 260             $mp_param->{$ms} = $conf->{$ms};
 261         });
 262
 263     } elsif ($conf_file =~ m/vps\.conf/) {
 264
 265         ($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
 266
 267     } else {
 268
 269        die "internal error";
 270     }
 271
 272     return wantarray ? ($conf, $mp_param) : $conf;
 273 }
 274
 275 sub restore_configuration {
 276     my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 277
 278     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
 279     if (defined($storeid)) {
 280         my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 281         if ($scfg->{type} eq 'pbs') {
 282             return restore_configuration_from_proxmox_backup($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw);
 283         }
 284     }
 285     restore_configuration_from_etc_vzdump($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw);
 286 }
 287
 288 sub restore_configuration_from_proxmox_backup {
 289     my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 290
 291     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
 292     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 293
 294     my ($vtype, $name, undef, undef, undef, undef, $format) =
 295         PVE::Storage::parse_volname($storage_cfg, $archive);
 296
 297     my $oldconf = recover_config_from_proxmox_backup($storage_cfg, $archive, $vmid);
 298
 299     sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
 300
 301     my $cmd = "files";
 302
 303     my $list = PVE::Storage::PBSPlugin::run_client_cmd($scfg, $storeid, "files", [$name]);
 304     my $has_fw_conf = grep { $_->{filename} eq 'fw.conf.blob' } @$list;
 305
 306     if ($has_fw_conf) {
 307         my $pve_firewall_dir = '/etc/pve/firewall';
 308         my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
 309         if ($skip_fw) {
 310             warn "ignoring firewall config from backup archive's 'fw.conf', lacking API permission to modify firewall.\n";
 311             warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
 312                 if -e $pct_fwcfg_target;
 313         } else {
 314             mkdir $pve_firewall_dir; # make sure the directory exists
 315             unlink $pct_fwcfg_target;
 316
 317             my $cmd = "restore";
 318             my $param = [$name, "fw.conf", $pct_fwcfg_target];
 319             PVE::Storage::PBSPlugin::run_raw_client_cmd($scfg, $storeid, $cmd, $param);
 320         }
 321     }
 322 }
 323
 324 sub sanitize_and_merge_config {
 325     my ($conf, $oldconf, $restricted, $unique) = @_;
 326
 327     my $rpcenv = PVE::RPCEnvironment::get();
 328     my $authuser = $rpcenv->get_user();
 329
 330     foreach my $key (keys %$oldconf) {
 331         next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged' || $key eq 'parent';
 332         next if $key =~ /^mp\d+$/; # don't recover mountpoints
 333         next if $key =~ /^unused\d+$/; # don't recover unused disks
 334         # we know if it was a template in the restore API call and check if the target
 335         # storage supports creating a template there
 336         next if $key =~ /^template$/;
 337
 338         if ($restricted && $key eq 'features' && !$conf->{unprivileged} && $oldconf->{unprivileged}) {
 339             warn "changing from unprivileged to privileged, skipping features\n";
 340             next;
 341         }
 342
 343         if ($key eq 'lxc' && $restricted) {
 344             my $lxc_list = $oldconf->{'lxc'};
 345
 346             my $msg = "skipping custom lxc options, restore manually as root:\n";
 347             $msg .= "--------------------------------\n";
 348             foreach my $lxc_opt (@$lxc_list) {
 349                 $msg .= "$lxc_opt->[0]: $lxc_opt->[1]\n"
 350             }
 351             $msg .= "--------------------------------";
 352
 353             $rpcenv->warn($msg);
 354
 355             next;
 356         }
 357
 358         if ($key =~ /^net\d+$/ && !defined($conf->{$key})) {
 359             PVE::LXC::check_bridge_access($rpcenv, $authuser, $oldconf->{$key});
 360         }
 361
 362         if ($unique && $key =~ /^net\d+$/) {
 363             my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key});
 364             my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 365             $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 366             $conf->{$key} = PVE::LXC::Config->print_lxc_network($net);
 367             next;
 368         }
 369         $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
 370     }
 371 }
 372
 373 sub restore_configuration_from_etc_vzdump {
 374     my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 375
 376     # restore: try to extract configuration from archive
 377
 378     my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
 379     my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw";
 380     my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
 381     if (-f $pct_cfg_fn) {
 382         my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
 383         my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw);
 384
 385         sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
 386
 387         unlink($pct_cfg_fn);
 388
 389         # note: this file is possibly from the container itself in backups
 390         # created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x)
 391         # only copy non-empty, non-symlink files, and only if the user is
 392         # allowed to modify the firewall config anyways
 393         if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) {
 394             my $pve_firewall_dir = '/etc/pve/firewall';
 395             my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
 396             if ($skip_fw) {
 397                 warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n";
 398                 warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
 399                     if -e $pct_fwcfg_target;
 400             } else {
 401                 mkdir $pve_firewall_dir; # make sure the directory exists
 402                 PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target);
 403             }
 404             unlink $pct_fwcfg_fn;
 405         }
 406
 407     } elsif (-f $ovz_cfg_fn) {
 408         print "###########################################################\n";
 409         print "Converting OpenVZ configuration to LXC.\n";
 410         print "Please check the configuration and reconfigure the network.\n";
 411         print "###########################################################\n";
 412
 413         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 414         $conf->{ostype} = $lxc_setup->{conf}->{ostype};
 415         my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
 416         my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
 417         foreach my $key (keys %$oldconf) {
 418             $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
 419         }
 420         unlink($ovz_cfg_fn);
 421
 422     } else {
 423         print "###########################################################\n";
 424         print "Backup archive does not contain any configuration\n";
 425         print "###########################################################\n";
 426     }
 427 }
 428
 429 1;