src/PVE/LXC/Setup.pm

   1 package PVE::LXC::Setup;
   2
   3 use strict;
   4 use warnings;
   5 use POSIX;
   6 use PVE::Tools;
   7
   8 use PVE::LXC::Setup::Debian;
   9 use PVE::LXC::Setup::Ubuntu;
  10 use PVE::LXC::Setup::CentOS;
  11 use PVE::LXC::Setup::Fedora;
  12 use PVE::LXC::Setup::SUSE;
  13 use PVE::LXC::Setup::ArchLinux;
  14 use PVE::LXC::Setup::Alpine;
  15 use PVE::LXC::Setup::Gentoo;
  16 use PVE::LXC::Setup::Devuan;
  17
  18 my $plugins = {
  19     debian    => 'PVE::LXC::Setup::Debian',
  20     devuan    => 'PVE::LXC::Setup::Devuan',
  21     ubuntu    => 'PVE::LXC::Setup::Ubuntu',
  22     centos    => 'PVE::LXC::Setup::CentOS',
  23     fedora    => 'PVE::LXC::Setup::Fedora',
  24     opensuse  => 'PVE::LXC::Setup::SUSE',
  25     archlinux => 'PVE::LXC::Setup::ArchLinux',
  26     alpine    => 'PVE::LXC::Setup::Alpine',
  27     gentoo    => 'PVE::LXC::Setup::Gentoo',
  28 };
  29
  30 # a map to allow supporting related distro flavours
  31 my $plugin_alias = {
  32     arch => 'archlinux',
  33     sles => 'opensuse',
  34 };
  35
  36 my $autodetect_type = sub {
  37     my ($self, $rootdir, $os_release) = @_;
  38
  39     if (my $id = $os_release->{ID}) {
  40         return $id if $plugins->{$id};
  41         return $plugin_alias->{$id} if $plugin_alias->{$id};
  42     }
  43
  44     # fallback compatibility checks
  45
  46     my $lsb_fn = "$rootdir/etc/lsb-release";
  47     if (-f $lsb_fn) {
  48         my $data =  PVE::Tools::file_get_contents($lsb_fn);
  49         if ($data =~ m/^DISTRIB_ID=Ubuntu$/im) {
  50             return 'ubuntu';
  51         }
  52     }
  53
  54     if (-f "$rootdir/etc/debian_version") {
  55         return "debian";
  56     } elsif (-f "$rootdir/etc/devuan_version") {
  57         return "devuan";
  58     } elsif (-f  "$rootdir/etc/SuSE-brand" || -f "$rootdir/etc/SuSE-release") {
  59         return "opensuse";
  60     } elsif (-f  "$rootdir/etc/fedora-release") {
  61         return "fedora";
  62     } elsif (-f  "$rootdir/etc/centos-release" || -f "$rootdir/etc/redhat-release") {
  63         return "centos";
  64     } elsif (-f  "$rootdir/etc/arch-release") {
  65         return "archlinux";
  66     } elsif (-f  "$rootdir/etc/alpine-release") {
  67         return "alpine";
  68     } elsif (-f  "$rootdir/etc/gentoo-release") {
  69         return "gentoo";
  70     }
  71     die "unable to detect OS distribution\n";
  72 };
  73
  74 sub new {
  75     my ($class, $conf, $rootdir, $type) = @_;
  76
  77     die "no root directory\n" if !$rootdir || $rootdir eq '/';
  78
  79     my $self = bless { conf => $conf, rootdir => $rootdir};
  80
  81     my $os_release = $self->get_ct_os_release();
  82
  83     if ($conf->{ostype} && $conf->{ostype} eq 'unmanaged') {
  84         return $self;
  85     } elsif (!defined($type)) {
  86         # try to autodetect type
  87         $type = &$autodetect_type($self, $rootdir, $os_release);
  88         my $expected_type = $conf->{ostype} || $type;
  89
  90         warn "got unexpected ostype ($type != $expected_type)\n"
  91             if $type ne $expected_type;
  92     }
  93
  94     my $plugin_class = $plugins->{$type} ||
  95         "no such OS type '$type'\n";
  96
  97     my $plugin = $plugin_class->new($conf, $rootdir, $os_release);
  98     $self->{plugin} = $plugin;
  99     $self->{in_chroot} = 0;
 100
 101     # Cache some host files we need access to:
 102     $plugin->{host_resolv_conf} = PVE::INotify::read_file('resolvconf');
 103
 104     # pass on user namespace information:
 105     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 106     if (@$id_map) {
 107         $plugin->{id_map} = $id_map;
 108         $plugin->{rootuid} = $rootuid;
 109         $plugin->{rootgid} = $rootgid;
 110     }
 111
 112     return $self;
 113 }
 114
 115 # Forks into a chroot and executes $sub
 116 sub protected_call {
 117     my ($self, $sub) = @_;
 118
 119     # avoid recursion:
 120     return $sub->() if $self->{in_chroot};
 121
 122     my $rootdir = $self->{rootdir};
 123     if (!-d "$rootdir/dev" && !mkdir("$rootdir/dev")) {
 124         die "failed to create temporary /dev directory: $!\n";
 125     }
 126
 127     pipe(my $res_in, my $res_out) or die "pipe failed: $!\n";
 128
 129     my $child = fork();
 130     die "fork failed: $!\n" if !defined($child);
 131
 132     if (!$child) {
 133         close($res_in);
 134         # avoid recursive forks
 135         $self->{in_chroot} = 1;
 136         eval {
 137             chroot($rootdir) or die "failed to change root to: $rootdir: $!\n";
 138             chdir('/') or die "failed to change to root directory\n";
 139             my $res = $sub->();
 140             if (defined($res)) {
 141                 print {$res_out} "$res";
 142                 $res_out->flush();
 143             }
 144         };
 145         if (my $err = $@) {
 146             warn $err;
 147             POSIX::_exit(1);
 148         }
 149         POSIX::_exit(0);
 150     }
 151     close($res_out);
 152     my $result = do { local $/ = undef; <$res_in> };
 153     while (waitpid($child, 0) != $child) {}
 154     if ($? != 0) {
 155         my $method = (caller(1))[3];
 156         die "error in setup task $method\n";
 157     }
 158     return $result;
 159 }
 160
 161 sub template_fixup {
 162     my ($self) = @_;
 163
 164     return if !$self->{plugin}; # unmanaged
 165
 166     my $code = sub {
 167         $self->{plugin}->template_fixup($self->{conf});
 168     };
 169     $self->protected_call($code);
 170 }
 171
 172 sub setup_network {
 173     my ($self) = @_;
 174
 175     return if !$self->{plugin}; # unmanaged
 176
 177     my $code = sub {
 178         $self->{plugin}->setup_network($self->{conf});
 179     };
 180     $self->protected_call($code);
 181 }
 182
 183 sub set_hostname {
 184     my ($self) = @_;
 185
 186     return if !$self->{plugin}; # unmanaged
 187
 188     my $code = sub {
 189         $self->{plugin}->set_hostname($self->{conf});
 190     };
 191     $self->protected_call($code);
 192 }
 193
 194 sub set_dns {
 195     my ($self) = @_;
 196
 197     return if !$self->{plugin}; # unmanaged
 198
 199     my $code = sub {
 200         $self->{plugin}->set_dns($self->{conf});
 201     };
 202     $self->protected_call($code);
 203 }
 204
 205 sub setup_init {
 206     my ($self) = @_;
 207
 208     return if !$self->{plugin}; # unmanaged
 209
 210     my $code = sub {
 211         $self->{plugin}->setup_init($self->{conf});
 212     };
 213     $self->protected_call($code);
 214 }
 215
 216 sub set_user_password {
 217     my ($self, $user, $pw) = @_;
 218
 219     return if !$self->{plugin}; # unmanaged
 220
 221     my $code = sub {
 222         $self->{plugin}->set_user_password($self->{conf}, $user, $pw);
 223     };
 224     $self->protected_call($code);
 225 }
 226
 227 sub rewrite_ssh_host_keys {
 228     my ($self) = @_;
 229
 230     return if !$self->{plugin}; # unmanaged
 231
 232     my $conf = $self->{conf};
 233     my $plugin = $self->{plugin};
 234     my $rootdir = $self->{rootdir};
 235
 236     return if ! -d "$rootdir/etc/ssh";
 237
 238     my $keynames = {
 239         rsa => 'ssh_host_rsa_key',
 240         dsa => 'ssh_host_dsa_key',
 241         ecdsa => 'ssh_host_ecdsa_key',
 242         ed25519 => 'ssh_host_ed25519_key',
 243     };
 244
 245     my $hostname = $conf->{hostname} || 'localhost';
 246     $hostname =~ s/\..*$//;
 247     my $ssh_comment = "root\@$hostname";
 248
 249     my $keygen_outfunc = sub {
 250         my $line = shift;
 251
 252         print "done: $line\n"
 253             if $line =~ m/^(?:[0-9a-f]{2}:)+[0-9a-f]{2}\s+\Q$ssh_comment\E$/i ||
 254                $line =~ m/^SHA256:[0-9a-z+\/]{43}\s+\Q$ssh_comment\E$/i;
 255     };
 256
 257     # Create temporary keys in /tmp on the host
 258     my $keyfiles = {};
 259     foreach my $keytype (keys %$keynames) {
 260         my $basename = $keynames->{$keytype};
 261         my $file = "/tmp/$$.$basename";
 262         print "Creating SSH host key '$basename' - this may take some time ...\n";
 263         my $cmd = ['ssh-keygen', '-f', $file, '-t', $keytype,
 264                    '-N', '', '-E', 'sha256', '-C', $ssh_comment];
 265         PVE::Tools::run_command($cmd, outfunc => $keygen_outfunc);
 266         $keyfiles->{"/etc/ssh/$basename"} = [PVE::Tools::file_get_contents($file), 0600];
 267         $keyfiles->{"/etc/ssh/$basename.pub"} = [PVE::Tools::file_get_contents("$file.pub"), 0644];
 268         unlink $file;
 269         unlink "$file.pub";
 270     }
 271
 272     # Write keys out in a protected call
 273
 274     my $code = sub {
 275         foreach my $file (keys %$keyfiles) {
 276             $plugin->ct_file_set_contents($file, @{$keyfiles->{$file}});
 277         }
 278     };
 279     $self->protected_call($code);
 280 }
 281
 282 sub pre_start_hook {
 283     my ($self) = @_;
 284
 285     return if !$self->{plugin}; # unmanaged
 286
 287     my $code = sub {
 288         # Create /fastboot to skip run fsck
 289         $self->{plugin}->ct_file_set_contents('/fastboot', '');
 290
 291         $self->{plugin}->pre_start_hook($self->{conf});
 292     };
 293     $self->protected_call($code);
 294 }
 295
 296 sub post_create_hook {
 297     my ($self, $root_password, $ssh_keys) = @_;
 298
 299     return if !$self->{plugin}; # unmanaged
 300
 301     my $code = sub {
 302         $self->{plugin}->post_create_hook($self->{conf}, $root_password, $ssh_keys);
 303     };
 304     $self->protected_call($code);
 305     $self->rewrite_ssh_host_keys();
 306 }
 307
 308 # os-release(5):
 309 #   (...) a newline-separated list of environment-like shell-compatible
 310 #   variable assignments. (...) beyond mere variable assignments, no shell
 311 #   features are supported (this means variable expansion is explicitly not
 312 #   supported) (...). Variable assignment values must be enclosed in double or
 313 #   single quotes *if* they include spaces, semicolons or other special
 314 #   characters outside of A-Z, a-z, 0-9. Shell special characters ("$", quotes,
 315 #   backslash, backtick) must be escaped with backslashes (...). All strings
 316 #   should be in UTF-8 format, and non-printable characters should not be used.
 317 #   It is not supported to concatenate multiple individually quoted strings.
 318 #   Lines beginning with "#" shall be ignored as comments.
 319 my $parse_os_release = sub {
 320     my ($data) = @_;
 321     my $variables = {};
 322     while (defined($data) && $data =~ /^(.+)$/gm) {
 323         next if $1 !~ /^\s*([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/;
 324         my ($var, $content) = ($1, $2);
 325         chomp $content;
 326
 327         if ($content =~ /^'([^']*)'/) {
 328             $variables->{$var} = $1;
 329         } elsif ($content =~ /^"((?:[^"\\]|\\.)*)"/) {
 330             my $s = $1;
 331             $s =~ s/(\\["'`nt\$\\])/"\"$1\""/eeg;
 332             $variables->{$var} = $s;
 333         } elsif ($content =~ /^([A-Za-z0-9]*)/) {
 334             $variables->{$var} = $1;
 335         }
 336     }
 337     return $variables;
 338 };
 339
 340 sub get_ct_os_release {
 341     my ($self) = @_;
 342
 343     my $code = sub {
 344         if (-f '/etc/os-release') {
 345             return PVE::Tools::file_get_contents('/etc/os-release');
 346         } elsif (-f '/usr/lib/os-release') {
 347             return PVE::Tools::file_get_contents('/usr/lib/os-release');
 348         }
 349         return undef;
 350     };
 351
 352     my $data = $self->protected_call($code);
 353
 354     return &$parse_os_release($data);
 355 }
 356
 357 1;