src/PVE/LXC/Setup.pm

   1 package PVE::LXC::Setup;
   2
   3 use strict;
   4 use warnings;
   5 use POSIX;
   6 use PVE::Tools;
   7
   8 use PVE::LXC::Setup::Debian;
   9 use PVE::LXC::Setup::Ubuntu;
  10 use PVE::LXC::Setup::CentOS;
  11 use PVE::LXC::Setup::Fedora;
  12 use PVE::LXC::Setup::SUSE;
  13 use PVE::LXC::Setup::ArchLinux;
  14 use PVE::LXC::Setup::Alpine;
  15 use PVE::LXC::Setup::Gentoo;
  16 use PVE::LXC::Setup::Devuan;
  17
  18 my $plugins = {
  19     debian    => 'PVE::LXC::Setup::Debian',
  20     devuan    => 'PVE::LXC::Setup::Devuan',
  21     ubuntu    => 'PVE::LXC::Setup::Ubuntu',
  22     centos    => 'PVE::LXC::Setup::CentOS',
  23     fedora    => 'PVE::LXC::Setup::Fedora',
  24     opensuse  => 'PVE::LXC::Setup::SUSE',
  25     archlinux => 'PVE::LXC::Setup::ArchLinux',
  26     alpine    => 'PVE::LXC::Setup::Alpine',
  27     gentoo    => 'PVE::LXC::Setup::Gentoo',
  28 };
  29
  30 # a map to allow supporting related distro flavours
  31 my $plugin_alias = {
  32     arch => 'archlinux',
  33     sles => 'opensuse',
  34     'opensuse-leap' => 'opensuse',
  35 };
  36
  37 my $autodetect_type = sub {
  38     my ($self, $rootdir, $os_release) = @_;
  39
  40     if (my $id = $os_release->{ID}) {
  41         return $id if $plugins->{$id};
  42         return $plugin_alias->{$id} if $plugin_alias->{$id};
  43     }
  44
  45     # fallback compatibility checks
  46
  47     my $lsb_fn = "$rootdir/etc/lsb-release";
  48     if (-f $lsb_fn) {
  49         my $data =  PVE::Tools::file_get_contents($lsb_fn);
  50         if ($data =~ m/^DISTRIB_ID=Ubuntu$/im) {
  51             return 'ubuntu';
  52         }
  53     }
  54
  55     if (-f "$rootdir/etc/debian_version") {
  56         return "debian";
  57     } elsif (-f "$rootdir/etc/devuan_version") {
  58         return "devuan";
  59     } elsif (-f  "$rootdir/etc/SuSE-brand" || -f "$rootdir/etc/SuSE-release") {
  60         return "opensuse";
  61     } elsif (-f  "$rootdir/etc/fedora-release") {
  62         return "fedora";
  63     } elsif (-f  "$rootdir/etc/centos-release" || -f "$rootdir/etc/redhat-release") {
  64         return "centos";
  65     } elsif (-f  "$rootdir/etc/arch-release") {
  66         return "archlinux";
  67     } elsif (-f  "$rootdir/etc/alpine-release") {
  68         return "alpine";
  69     } elsif (-f  "$rootdir/etc/gentoo-release") {
  70         return "gentoo";
  71     }
  72     die "unable to detect OS distribution\n";
  73 };
  74
  75 sub new {
  76     my ($class, $conf, $rootdir, $type) = @_;
  77
  78     die "no root directory\n" if !$rootdir || $rootdir eq '/';
  79
  80     my $self = bless { conf => $conf, rootdir => $rootdir};
  81
  82     my $os_release = $self->get_ct_os_release();
  83
  84     if ($conf->{ostype} && $conf->{ostype} eq 'unmanaged') {
  85         return $self;
  86     } elsif (!defined($type)) {
  87         # try to autodetect type
  88         $type = &$autodetect_type($self, $rootdir, $os_release);
  89         my $expected_type = $conf->{ostype} || $type;
  90
  91         warn "got unexpected ostype ($type != $expected_type)\n"
  92             if $type ne $expected_type;
  93     }
  94
  95     my $plugin_class = $plugins->{$type} ||
  96         "no such OS type '$type'\n";
  97
  98     my $plugin = $plugin_class->new($conf, $rootdir, $os_release);
  99     $self->{plugin} = $plugin;
 100     $self->{in_chroot} = 0;
 101
 102     # Cache some host files we need access to:
 103     $plugin->{host_resolv_conf} = PVE::INotify::read_file('resolvconf');
 104
 105     # pass on user namespace information:
 106     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 107     if (@$id_map) {
 108         $plugin->{id_map} = $id_map;
 109         $plugin->{rootuid} = $rootuid;
 110         $plugin->{rootgid} = $rootgid;
 111     }
 112
 113     return $self;
 114 }
 115
 116 # Forks into a chroot and executes $sub
 117 sub protected_call {
 118     my ($self, $sub) = @_;
 119
 120     # avoid recursion:
 121     return $sub->() if $self->{in_chroot};
 122
 123     my $rootdir = $self->{rootdir};
 124     if (!-d "$rootdir/dev" && !mkdir("$rootdir/dev")) {
 125         die "failed to create temporary /dev directory: $!\n";
 126     }
 127
 128     pipe(my $res_in, my $res_out) or die "pipe failed: $!\n";
 129
 130     my $child = fork();
 131     die "fork failed: $!\n" if !defined($child);
 132
 133     if (!$child) {
 134         close($res_in);
 135         # avoid recursive forks
 136         $self->{in_chroot} = 1;
 137         eval {
 138             chroot($rootdir) or die "failed to change root to: $rootdir: $!\n";
 139             chdir('/') or die "failed to change to root directory\n";
 140             my $res = $sub->();
 141             if (defined($res)) {
 142                 print {$res_out} "$res";
 143                 $res_out->flush();
 144             }
 145         };
 146         if (my $err = $@) {
 147             warn $err;
 148             POSIX::_exit(1);
 149         }
 150         POSIX::_exit(0);
 151     }
 152     close($res_out);
 153     my $result = do { local $/ = undef; <$res_in> };
 154     while (waitpid($child, 0) != $child) {}
 155     if ($? != 0) {
 156         my $method = (caller(1))[3];
 157         die "error in setup task $method\n";
 158     }
 159     return $result;
 160 }
 161
 162 sub template_fixup {
 163     my ($self) = @_;
 164
 165     return if !$self->{plugin}; # unmanaged
 166
 167     my $code = sub {
 168         $self->{plugin}->template_fixup($self->{conf});
 169     };
 170     $self->protected_call($code);
 171 }
 172
 173 sub setup_network {
 174     my ($self) = @_;
 175
 176     return if !$self->{plugin}; # unmanaged
 177
 178     my $code = sub {
 179         $self->{plugin}->setup_network($self->{conf});
 180     };
 181     $self->protected_call($code);
 182 }
 183
 184 sub set_hostname {
 185     my ($self) = @_;
 186
 187     return if !$self->{plugin}; # unmanaged
 188
 189     my $code = sub {
 190         $self->{plugin}->set_hostname($self->{conf});
 191     };
 192     $self->protected_call($code);
 193 }
 194
 195 sub set_dns {
 196     my ($self) = @_;
 197
 198     return if !$self->{plugin}; # unmanaged
 199
 200     my $code = sub {
 201         $self->{plugin}->set_dns($self->{conf});
 202     };
 203     $self->protected_call($code);
 204 }
 205
 206 sub setup_init {
 207     my ($self) = @_;
 208
 209     return if !$self->{plugin}; # unmanaged
 210
 211     my $code = sub {
 212         $self->{plugin}->setup_init($self->{conf});
 213     };
 214     $self->protected_call($code);
 215 }
 216
 217 sub set_user_password {
 218     my ($self, $user, $pw) = @_;
 219
 220     return if !$self->{plugin}; # unmanaged
 221
 222     my $code = sub {
 223         $self->{plugin}->set_user_password($self->{conf}, $user, $pw);
 224     };
 225     $self->protected_call($code);
 226 }
 227
 228 sub rewrite_ssh_host_keys {
 229     my ($self) = @_;
 230
 231     return if !$self->{plugin}; # unmanaged
 232
 233     my $conf = $self->{conf};
 234     my $plugin = $self->{plugin};
 235     my $rootdir = $self->{rootdir};
 236
 237     return if ! -d "$rootdir/etc/ssh";
 238
 239     my $keynames = {
 240         rsa => 'ssh_host_rsa_key',
 241         dsa => 'ssh_host_dsa_key',
 242         ecdsa => 'ssh_host_ecdsa_key',
 243         ed25519 => 'ssh_host_ed25519_key',
 244     };
 245
 246     my $hostname = $conf->{hostname} || 'localhost';
 247     $hostname =~ s/\..*$//;
 248     my $ssh_comment = "root\@$hostname";
 249
 250     my $keygen_outfunc = sub {
 251         my $line = shift;
 252
 253         print "done: $line\n"
 254             if $line =~ m/^(?:[0-9a-f]{2}:)+[0-9a-f]{2}\s+\Q$ssh_comment\E$/i ||
 255                $line =~ m/^SHA256:[0-9a-z+\/]{43}\s+\Q$ssh_comment\E$/i;
 256     };
 257
 258     # Create temporary keys in /tmp on the host
 259     my $keyfiles = {};
 260     foreach my $keytype (keys %$keynames) {
 261         my $basename = $keynames->{$keytype};
 262         my $file = "/tmp/$$.$basename";
 263         print "Creating SSH host key '$basename' - this may take some time ...\n";
 264         my $cmd = ['ssh-keygen', '-f', $file, '-t', $keytype,
 265                    '-N', '', '-E', 'sha256', '-C', $ssh_comment];
 266         PVE::Tools::run_command($cmd, outfunc => $keygen_outfunc);
 267         $keyfiles->{"/etc/ssh/$basename"} = [PVE::Tools::file_get_contents($file), 0600];
 268         $keyfiles->{"/etc/ssh/$basename.pub"} = [PVE::Tools::file_get_contents("$file.pub"), 0644];
 269         unlink $file;
 270         unlink "$file.pub";
 271     }
 272
 273     # Write keys out in a protected call
 274
 275     my $code = sub {
 276         foreach my $file (keys %$keyfiles) {
 277             $plugin->ct_file_set_contents($file, @{$keyfiles->{$file}});
 278         }
 279     };
 280     $self->protected_call($code);
 281 }
 282
 283 my $container_emulator_path = {
 284     'amd64' => '/usr/bin/qemu-x86_64-static',
 285     'arm64' => '/usr/bin/qemu-aarch64-static',
 286 };
 287
 288 sub pre_start_hook {
 289     my ($self) = @_;
 290
 291     return if !$self->{plugin}; # unmanaged
 292
 293     my $host_arch = PVE::Tools::get_host_arch();
 294
 295     my $container_arch = $self->{conf}->{arch};
 296
 297     $container_arch = 'amd64' if $container_arch eq 'i386'; # always use 64 bit version
 298     $container_arch = 'arm64' if $container_arch eq 'armhf'; # always use 64 bit version
 299
 300     my $emul;
 301     my $emul_data;
 302
 303     if ($host_arch ne $container_arch) {
 304         if ($emul = $container_emulator_path->{$container_arch}) {
 305             $emul_data = PVE::Tools::file_get_contents($emul, 10*1024*1024) if -f $emul;
 306         }
 307     }
 308
 309     my $code = sub {
 310
 311         if ($emul && $emul_data) {
 312             $self->{plugin}->ct_file_set_contents($emul, $emul_data, 0755);
 313         }
 314
 315         # Create /fastboot to skip run fsck
 316         $self->{plugin}->ct_file_set_contents('/fastboot', '');
 317
 318         $self->{plugin}->pre_start_hook($self->{conf});
 319     };
 320     $self->protected_call($code);
 321 }
 322
 323 sub post_create_hook {
 324     my ($self, $root_password, $ssh_keys) = @_;
 325
 326     return if !$self->{plugin}; # unmanaged
 327
 328     my $code = sub {
 329         $self->{plugin}->post_create_hook($self->{conf}, $root_password, $ssh_keys);
 330     };
 331     $self->protected_call($code);
 332     $self->rewrite_ssh_host_keys();
 333 }
 334
 335 # os-release(5):
 336 #   (...) a newline-separated list of environment-like shell-compatible
 337 #   variable assignments. (...) beyond mere variable assignments, no shell
 338 #   features are supported (this means variable expansion is explicitly not
 339 #   supported) (...). Variable assignment values must be enclosed in double or
 340 #   single quotes *if* they include spaces, semicolons or other special
 341 #   characters outside of A-Z, a-z, 0-9. Shell special characters ("$", quotes,
 342 #   backslash, backtick) must be escaped with backslashes (...). All strings
 343 #   should be in UTF-8 format, and non-printable characters should not be used.
 344 #   It is not supported to concatenate multiple individually quoted strings.
 345 #   Lines beginning with "#" shall be ignored as comments.
 346 my $parse_os_release = sub {
 347     my ($data) = @_;
 348     my $variables = {};
 349     while (defined($data) && $data =~ /^(.+)$/gm) {
 350         next if $1 !~ /^\s*([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/;
 351         my ($var, $content) = ($1, $2);
 352         chomp $content;
 353
 354         if ($content =~ /^'([^']*)'/) {
 355             $variables->{$var} = $1;
 356         } elsif ($content =~ /^"((?:[^"\\]|\\.)*)"/) {
 357             my $s = $1;
 358             $s =~ s/(\\["'`nt\$\\])/"\"$1\""/eeg;
 359             $variables->{$var} = $s;
 360         } elsif ($content =~ /^([A-Za-z0-9]*)/) {
 361             $variables->{$var} = $1;
 362         }
 363     }
 364     return $variables;
 365 };
 366
 367 sub get_ct_os_release {
 368     my ($self) = @_;
 369
 370     my $code = sub {
 371         if (-f '/etc/os-release') {
 372             return PVE::Tools::file_get_contents('/etc/os-release');
 373         } elsif (-f '/usr/lib/os-release') {
 374             return PVE::Tools::file_get_contents('/usr/lib/os-release');
 375         }
 376         return undef;
 377     };
 378
 379     my $data = $self->protected_call($code);
 380
 381     return &$parse_os_release($data);
 382 }
 383
 384 1;