src/PVE/LXC/Create.pm

   1 package PVE::LXC::Create;
   2
   3 use strict;
   4 use warnings;
   5 use File::Basename;
   6 use File::Path;
   7 use Fcntl;
   8
   9 use PVE::Storage::PBSPlugin;
  10 use PVE::Storage;
  11 use PVE::DataCenterConfig;
  12 use PVE::LXC;
  13 use PVE::LXC::Setup;
  14 use PVE::VZDump::ConvertOVZ;
  15 use PVE::Tools;
  16 use POSIX;
  17
  18 sub detect_architecture {
  19     my ($rootdir) = @_;
  20
  21     # see https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
  22
  23     my $supported_elf_machine = {
  24         0x03 => 'i386',
  25         0x3e => 'amd64',
  26         0x28 => 'armhf',
  27         0xb7 => 'arm64',
  28     };
  29
  30     my $elf_fn = '/bin/sh'; # '/bin/sh' is POSIX mandatory
  31     my $detect_arch = sub {
  32         # chroot avoids a problem where we check the binary of the host system
  33         # if $elf_fn is an absolut symlink (e.g. $rootdir/bin/sh -> /bin/bash)
  34         chroot($rootdir) or die "chroot '$rootdir' failed: $!\n";
  35         chdir('/') or die "failed to change to root directory\n";
  36
  37         open(my $fh, "<", $elf_fn) or die "open '$elf_fn' failed: $!\n";
  38         binmode($fh);
  39
  40         my $length = read($fh, my $data, 20) or die "read failed: $!\n";
  41
  42         # 4 bytes ELF magic number and 1 byte ELF class, padding, machine
  43         my ($magic, $class, undef, $machine) = unpack("A4CA12n", $data);
  44
  45         die "'$elf_fn' does not resolve to an ELF!\n"
  46             if (!defined($class) || !defined($magic) || $magic ne "\177ELF");
  47
  48         my $arch = $supported_elf_machine->{$machine};
  49         die "'$elf_fn' has unknown ELF machine '$machine'!\n"
  50             if !defined($arch);
  51
  52         return $arch;
  53     };
  54
  55     my $arch = eval { PVE::Tools::run_fork_with_timeout(10, $detect_arch); };
  56     my $err = $@;
  57
  58     if (!defined($arch) && !defined($err)) {
  59         # on timeout
  60         die "Architecture detection failed: timeout\n";
  61     } elsif ($err) {
  62         # any other error
  63         $arch = 'amd64';
  64         print "Architecture detection failed: $err\nFalling back to $arch.\n" .
  65               "Use `pct set VMID --arch ARCH` to change.\n";
  66     } else {
  67         print "Detected container architecture: $arch\n";
  68     }
  69
  70     return $arch;
  71 }
  72
  73 sub restore_archive {
  74     my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
  75
  76     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
  77     if (defined($storeid)) {
  78         my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
  79         if ($scfg->{type} eq 'pbs') {
  80             return restore_proxmox_backup_archive($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
  81         }
  82     }
  83
  84     $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $archive) if $archive ne '-';
  85     restore_tar_archive($archive, $rootdir, $conf, $no_unpack_error, $bwlimit);
  86 }
  87
  88 sub restore_proxmox_backup_archive {
  89     my ($storage_cfg, $archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
  90
  91     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
  92     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
  93
  94     my ($vtype, $name, undef, undef, undef, undef, $format) =
  95         PVE::Storage::parse_volname($storage_cfg, $archive);
  96
  97     die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
  98
  99     die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
 100
 101     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 102     my $userns_cmd = PVE::LXC::userns_command($id_map);
 103
 104     my $cmd = "restore";
 105     my $param = [$name, "root.pxar", $rootdir, '--allow-existing-dirs'];
 106
 107     PVE::Storage::PBSPlugin::run_raw_client_cmd(
 108         $scfg, $storeid, $cmd, $param, userns_cmd => $userns_cmd);
 109
 110     # if arch is set, we do not try to autodetect it
 111     return if defined($conf->{arch});
 112
 113     $conf->{arch} = detect_architecture($rootdir);
 114 }
 115
 116 sub restore_tar_archive {
 117     my ($archive, $rootdir, $conf, $no_unpack_error, $bwlimit) = @_;
 118
 119     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 120     my $userns_cmd = PVE::LXC::userns_command($id_map);
 121
 122     my $archive_fh;
 123     my $tar_input = '<&STDIN';
 124     my @compression_opt;
 125     if ($archive ne '-') {
 126         # GNU tar refuses to autodetect this... *sigh*
 127         my %compression_map = (
 128             '.gz'  => '-z',
 129             '.bz2' => '-j',
 130             '.xz'  => '-J',
 131             '.lzo'  => '--lzop',
 132             '.zst'  => '--zstd',
 133         );
 134         if ($archive =~ /\.tar(\.[^.]+)?$/) {
 135             if (defined($1)) {
 136                 die "unrecognized compression format: $1\n" if !defined($compression_map{$1});
 137                 @compression_opt = $compression_map{$1};
 138             }
 139         } else {
 140             die "file does not look like a template archive: $archive\n";
 141         }
 142         sysopen($archive_fh, $archive, O_RDONLY)
 143             or die "failed to open '$archive': $!\n";
 144         my $flags = $archive_fh->fcntl(Fcntl::F_GETFD(), 0);
 145         $archive_fh->fcntl(Fcntl::F_SETFD(), $flags & ~(Fcntl::FD_CLOEXEC()));
 146         $tar_input = '<&'.fileno($archive_fh);
 147     }
 148
 149     my $cmd = [@$userns_cmd, 'tar', 'xpf', '-', @compression_opt, '--totals',
 150                @PVE::Storage::Plugin::COMMON_TAR_FLAGS,
 151                '-C', $rootdir];
 152
 153     # skip-old-files doesn't have anything to do with time (old/new), but is
 154     # simply -k (annoyingly also called --keep-old-files) without the 'treat
 155     # existing files as errors' part... iow. it's bsdtar's interpretation of -k
 156     # *sigh*, gnu...
 157     push @$cmd, '--skip-old-files';
 158     push @$cmd, '--anchored';
 159     push @$cmd, '--exclude' , './dev/*';
 160
 161     if (defined($bwlimit)) {
 162         $cmd = [ ['cstream', '-t', $bwlimit*1024], $cmd ];
 163     }
 164
 165     if ($archive eq '-') {
 166         print "extracting archive from STDIN\n";
 167     } else {
 168         print "extracting archive '$archive'\n";
 169     }
 170     eval { PVE::Tools::run_command($cmd, input => $tar_input); };
 171     my $err = $@;
 172     close($archive_fh) if defined $archive_fh;
 173     die $err if $err && !$no_unpack_error;
 174
 175     # if arch is set, we do not try to autodetect it
 176     return if defined($conf->{arch});
 177
 178     $conf->{arch} = detect_architecture($rootdir);
 179 }
 180
 181 sub recover_config {
 182     my ($storage_cfg, $volid, $vmid) = @_;
 183
 184     my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 185     if (defined($storeid)) {
 186         my $scfg = PVE::Storage::storage_check_enabled($storage_cfg, $storeid);
 187         if ($scfg->{type} eq 'pbs') {
 188             return recover_config_from_proxmox_backup($storage_cfg, $volid, $vmid);
 189         }
 190     }
 191
 192     my $archive = PVE::Storage::abs_filesystem_path($storage_cfg, $volid);
 193     recover_config_from_tar($archive, $vmid);
 194 }
 195
 196 sub recover_config_from_proxmox_backup {
 197     my ($storage_cfg, $volid, $vmid) = @_;
 198
 199     $vmid //= 0;
 200
 201     my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
 202     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 203
 204     my ($vtype, $name, undef, undef, undef, undef, $format) =
 205         PVE::Storage::parse_volname($storage_cfg, $volid);
 206
 207     die "got unexpected vtype '$vtype'\n" if $vtype ne 'backup';
 208
 209     die "got unexpected backup format '$format'\n" if $format ne 'pbs-ct';
 210
 211     my $cmd = "restore";
 212     my $param = [$name, "pct.conf", "-"];
 213
 214     my $raw = '';
 215     my $outfunc = sub { my $line = shift; $raw .= "$line\n"; };
 216     PVE::Storage::PBSPlugin::run_raw_client_cmd(
 217         $scfg,  $storeid, $cmd, $param, outfunc => $outfunc);
 218
 219     my $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
 220
 221     delete $conf->{snapshots};
 222
 223     my $mp_param = {};
 224     PVE::LXC::Config->foreach_volume($conf, sub {
 225         my ($ms, $mountpoint) = @_;
 226         $mp_param->{$ms} = $conf->{$ms};
 227     });
 228
 229     return wantarray ? ($conf, $mp_param) : $conf;
 230 }
 231
 232 sub recover_config_from_tar {
 233     my ($archive, $vmid) = @_;
 234
 235     my ($raw, $conf_file) = PVE::Storage::extract_vzdump_config_tar($archive, qr!(\./etc/vzdump/(pct|vps)\.conf)$!);
 236     my $conf;
 237     my $mp_param = {};
 238     $vmid //= 0;
 239
 240     if ($conf_file =~ m/pct\.conf/) {
 241
 242         $conf = PVE::LXC::Config::parse_pct_config("/lxc/${vmid}.conf" , $raw);
 243
 244         delete $conf->{snapshots};
 245
 246         PVE::LXC::Config->foreach_volume($conf, sub {
 247             my ($ms, $mountpoint) = @_;
 248             $mp_param->{$ms} = $conf->{$ms};
 249         });
 250
 251     } elsif ($conf_file =~ m/vps\.conf/) {
 252
 253         ($conf, $mp_param) = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
 254
 255     } else {
 256
 257        die "internal error";
 258     }
 259
 260     return wantarray ? ($conf, $mp_param) : $conf;
 261 }
 262
 263 sub restore_configuration {
 264     my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 265
 266     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive, 1);
 267     if (defined($storeid)) {
 268         my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 269         if ($scfg->{type} eq 'pbs') {
 270             return restore_configuration_from_proxmox_backup($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw);
 271         }
 272     }
 273     restore_configuration_from_etc_vzdump($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw);
 274 }
 275
 276 sub restore_configuration_from_proxmox_backup {
 277     my ($vmid, $storage_cfg, $archive, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 278
 279     my ($storeid, $volname) = PVE::Storage::parse_volume_id($archive);
 280     my $scfg = PVE::Storage::storage_config($storage_cfg, $storeid);
 281
 282     my ($vtype, $name, undef, undef, undef, undef, $format) =
 283         PVE::Storage::parse_volname($storage_cfg, $archive);
 284
 285     my $oldconf = recover_config_from_proxmox_backup($storage_cfg, $archive, $vmid);
 286
 287     sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
 288
 289     my $cmd = "files";
 290
 291     my $list = PVE::Storage::PBSPlugin::run_client_cmd($scfg, $storeid, "files", [$name]);
 292     my $has_fw_conf = grep { $_->{filename} eq 'fw.conf.blob' } @$list;
 293
 294     if ($has_fw_conf) {
 295         my $pve_firewall_dir = '/etc/pve/firewall';
 296         my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
 297         if ($skip_fw) {
 298             warn "ignoring firewall config from backup archive's 'fw.conf', lacking API permission to modify firewall.\n";
 299             warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
 300                 if -e $pct_fwcfg_target;
 301         } else {
 302             mkdir $pve_firewall_dir; # make sure the directory exists
 303             unlink $pct_fwcfg_target;
 304
 305             my $cmd = "restore";
 306             my $param = [$name, "fw.conf", $pct_fwcfg_target];
 307             PVE::Storage::PBSPlugin::run_raw_client_cmd($scfg, $storeid, $cmd, $param);
 308         }
 309     }
 310 }
 311
 312 sub sanitize_and_merge_config {
 313     my ($conf, $oldconf, $restricted, $unique) = @_;
 314
 315     foreach my $key (keys %$oldconf) {
 316         next if $key eq 'digest' || $key eq 'rootfs' || $key eq 'snapshots' || $key eq 'unprivileged' || $key eq 'parent';
 317         next if $key =~ /^mp\d+$/; # don't recover mountpoints
 318         next if $key =~ /^unused\d+$/; # don't recover unused disks
 319         # we know if it was a template in the restore API call and check if the target
 320         # storage supports creating a template there
 321         next if $key =~ /^template$/;
 322
 323         if ($restricted && $key eq 'features' && !$conf->{unprivileged} && $oldconf->{unprivileged}) {
 324             warn "changing from unprivileged to privileged, skipping features\n";
 325             next;
 326         }
 327
 328         if ($key eq 'lxc' && $restricted) {
 329             my $lxc_list = $oldconf->{'lxc'};
 330             warn "skipping custom lxc options, restore manually as root:\n";
 331             warn "--------------------------------\n";
 332             foreach my $lxc_opt (@$lxc_list) {
 333                 warn "$lxc_opt->[0]: $lxc_opt->[1]\n"
 334             }
 335             warn "--------------------------------\n";
 336             next;
 337         }
 338
 339         if ($unique && $key =~ /^net\d+$/) {
 340             my $net = PVE::LXC::Config->parse_lxc_network($oldconf->{$key});
 341             my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
 342             $net->{hwaddr} = PVE::Tools::random_ether_addr($dc->{mac_prefix});
 343             $conf->{$key} = PVE::LXC::Config->print_lxc_network($net);
 344             next;
 345         }
 346         $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
 347     }
 348 }
 349
 350 sub restore_configuration_from_etc_vzdump {
 351     my ($vmid, $rootdir, $conf, $restricted, $unique, $skip_fw) = @_;
 352
 353     # restore: try to extract configuration from archive
 354
 355     my $pct_cfg_fn = "$rootdir/etc/vzdump/pct.conf";
 356     my $pct_fwcfg_fn = "$rootdir/etc/vzdump/pct.fw";
 357     my $ovz_cfg_fn = "$rootdir/etc/vzdump/vps.conf";
 358     if (-f $pct_cfg_fn) {
 359         my $raw = PVE::Tools::file_get_contents($pct_cfg_fn);
 360         my $oldconf = PVE::LXC::Config::parse_pct_config("/lxc/$vmid.conf", $raw);
 361
 362         sanitize_and_merge_config($conf, $oldconf, $restricted, $unique);
 363
 364         unlink($pct_cfg_fn);
 365
 366         # note: this file is possibly from the container itself in backups
 367         # created prior to pve-container 2.0-40 (PVE 5.x) / 3.0-5 (PVE 6.x)
 368         # only copy non-empty, non-symlink files, and only if the user is
 369         # allowed to modify the firewall config anyways
 370         if (-f $pct_fwcfg_fn && ! -l $pct_fwcfg_fn && -s $pct_fwcfg_fn) {
 371             my $pve_firewall_dir = '/etc/pve/firewall';
 372             my $pct_fwcfg_target = "${pve_firewall_dir}/${vmid}.fw";
 373             if ($skip_fw) {
 374                 warn "ignoring firewall config from backup archive's '$pct_fwcfg_fn', lacking API permission to modify firewall.\n";
 375                 warn "old firewall configuration in '$pct_fwcfg_target' left in place!\n"
 376                     if -e $pct_fwcfg_target;
 377             } else {
 378                 mkdir $pve_firewall_dir; # make sure the directory exists
 379                 PVE::Tools::file_copy($pct_fwcfg_fn, $pct_fwcfg_target);
 380             }
 381             unlink $pct_fwcfg_fn;
 382         }
 383
 384     } elsif (-f $ovz_cfg_fn) {
 385         print "###########################################################\n";
 386         print "Converting OpenVZ configuration to LXC.\n";
 387         print "Please check the configuration and reconfigure the network.\n";
 388         print "###########################################################\n";
 389
 390         my $lxc_setup = PVE::LXC::Setup->new($conf, $rootdir); # detect OS
 391         $conf->{ostype} = $lxc_setup->{conf}->{ostype};
 392         my $raw = PVE::Tools::file_get_contents($ovz_cfg_fn);
 393         my $oldconf = PVE::VZDump::ConvertOVZ::convert_ovz($raw);
 394         foreach my $key (keys %$oldconf) {
 395             $conf->{$key} = $oldconf->{$key} if !defined($conf->{$key});
 396         }
 397         unlink($ovz_cfg_fn);
 398
 399     } else {
 400         print "###########################################################\n";
 401         print "Backup archive does not contain any configuration\n";
 402         print "###########################################################\n";
 403     }
 404 }
 405
 406 1;