diff --git a/config/Makefile.am b/config/Makefile.am index 904d18a..76fd2e7 100644 --- a/config/Makefile.am +++ b/config/Makefile.am @@ -9,11 +9,15 @@ templatesconfig_DATA = \ centos.userns.conf \ debian.common.conf \ debian.userns.conf \ + devuan.common.conf \ + devuan.userns.conf \ fedora.common.conf \ fedora.userns.conf \ gentoo.common.conf \ gentoo.moresecure.conf \ gentoo.userns.conf \ + kali.common.conf \ + kali.userns.conf \ opensuse.common.conf \ opensuse.userns.conf \ oracle.common.conf \ diff --git a/config/devuan.common.conf.in b/config/devuan.common.conf.in new file mode 100644 index 0000000..4e6a6e6 --- /dev/null +++ b/config/devuan.common.conf.in @@ -0,0 +1,28 @@ +# This derives from the global common config +lxc.include = @LXCTEMPLATECONFIG@/common.conf + +# Doesn't support consoles in /dev/lxc/ +lxc.tty.dir = + +# When using LXC with apparmor, the container will be confined by default. +# If you wish for it to instead run unconfined, copy the following line +# (uncommented) to the container's configuration file. +#lxc.apparmor.profile = unconfined + +# If you wish to allow mounting block filesystems, then use the following +# line instead, and make sure to grant access to the block device and/or loop +# devices below in lxc.cgroup.devices.allow. +#lxc.apparmor.profile = lxc-container-default-with-mounting + +# Extra cgroup device access +## rtc +lxc.cgroup.devices.allow = c 254:0 rm +## tun +lxc.cgroup.devices.allow = c 10:200 rwm +## hpet +lxc.cgroup.devices.allow = c 10:228 rwm +## kvm +lxc.cgroup.devices.allow = c 10:232 rwm +## To use loop devices, copy the following line to the container's +## configuration file (uncommented). +#lxc.cgroup.devices.allow = b 7:* rwm diff --git a/config/devuan.userns.conf.in b/config/devuan.userns.conf.in new file mode 100644 index 0000000..707bb30 --- /dev/null +++ b/config/devuan.userns.conf.in @@ -0,0 +1,2 @@ +# This derives from the global userns config +lxc.include = @LXCTEMPLATECONFIG@/userns.conf diff --git a/configure.ac b/configure.ac index 27bb26f..fbabc94 100644 --- a/configure.ac +++ b/configure.ac @@ -18,7 +18,7 @@ AC_GNU_SOURCE # Detect the distribution. This is used for the default configuration and # for some distro-specific build options. AC_MSG_CHECKING([host distribution]) -AC_ARG_WITH(distro, AS_HELP_STRING([--with-distro=DISTRO], [Specify the Linux distribution to target: One of redhat, oracle, centos, fedora, suse, gentoo, debian, arch, slackware, plamo, paldo, openmandriva, pardus, sparclinux, altlinux.])) +AC_ARG_WITH(distro, AS_HELP_STRING([--with-distro=DISTRO], [Specify the Linux distribution to target: One of redhat, oracle, centos, fedora, suse, gentoo, debian, devuan, arch, slackware, plamo, paldo, openmandriva, pardus, sparclinux, altlinux.])) if type lsb_release >/dev/null 2>&1 && test "z$with_distro" = "z"; then with_distro=`lsb_release -is` fi @@ -159,6 +159,8 @@ AC_CONFIG_FILES([ config/centos.userns.conf config/debian.common.conf config/debian.userns.conf + config/devuan.common.conf + config/devuan.userns.conf config/fedora.common.conf config/fedora.userns.conf config/gentoo.common.conf @@ -195,6 +197,7 @@ AC_CONFIG_FILES([ templates/lxc-centos templates/lxc-cirros templates/lxc-debian + templates/lxc-devuan templates/lxc-fedora templates/lxc-fedora-legacy templates/lxc-gentoo diff --git a/templates/Makefile.am b/templates/Makefile.am index b1be133..b885433 100644 --- a/templates/Makefile.am +++ b/templates/Makefile.am @@ -7,9 +7,11 @@ templates_SCRIPTS = \ lxc-centos \ lxc-cirros \ lxc-debian \ + lxc-devuan \ lxc-fedora \ lxc-fedora-legacy \ lxc-gentoo \ + lxc-kali \ lxc-openmandriva \ lxc-opensuse \ lxc-oracle \ diff --git a/templates/lxc-devuan.in b/templates/lxc-devuan.in new file mode 100644 index 0000000..76ed315 --- /dev/null +++ b/templates/lxc-devuan.in @@ -0,0 +1,806 @@ +#!/bin/bash + +# +# lxc: linux Container library + +# Authors: +# Daniel Lezcano +# Greg Olsen +# Tanya + +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. + +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. + +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + +# Detect use under userns (unsupported) +for arg in "$@"; do + [ "$arg" = "--" ] && break + if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then + echo "This template can't be used for unprivileged containers." 1>&2 + echo "You may want to try the \"download\" template instead." 1>&2 + exit 1 + fi +done + +# Make sure the usual locations are in PATH +export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin +export GREP_OPTIONS="" + +MIRROR=${MIRROR:-http://deb.devuan.org/merged} +SECURITY_MIRROR=${SECURITY_MIRROR:-http://deb.devuan.org/merged} +LOCALSTATEDIR="@LOCALSTATEDIR@" +LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@" +# Allows the lxc-cache directory to be set by environment variable +LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc"} +[ -z "$DOWNLOAD_KEYRING" ] && DOWNLOAD_KEYRING=1 + +find_interpreter() +{ + given_interpreter=$(basename "$1") + + if [ ! -d /proc/sys/fs/binfmt_misc/ ] ; then + return 1 + fi + for file in /proc/sys/fs/binfmt_misc/* ; do + if [ "$file" = "/proc/sys/fs/binfmt_misc/register" -o \ + "$file" = "/proc/sys/fs/binfmt_misc/status" ] ; then + continue + fi + interpreter_path=$(sed -n "/^interpreter/s/interpreter \([^[:space:]]*\)/\1/p" "$file") + interpreter=$(basename "$interpreter_path") + + if [ "$given_interpreter" = "$interpreter" ] ; then + echo "$interpreter_path" + return 0 + fi + done + return 1 +} + +configure_devuan() +{ + rootfs=$1 + hostname=$2 + num_tty=$3 + + # squeeze only has /dev/tty and /dev/tty0 by default, + # therefore creating missing device nodes for tty1-4. + for tty in $(seq 1 "$num_tty"); do + if [ ! -e "$rootfs/dev/tty$tty" ]; then + mknod "$rootfs/dev/tty$tty" c 4 "$tty" + fi + done + + # configure the inittab + cat < $rootfs/etc/inittab +id:3:initdefault: +si::sysinit:/etc/init.d/rcS +l0:0:wait:/etc/init.d/rc 0 +l1:1:wait:/etc/init.d/rc 1 +l2:2:wait:/etc/init.d/rc 2 +l3:3:wait:/etc/init.d/rc 3 +l4:4:wait:/etc/init.d/rc 4 +l5:5:wait:/etc/init.d/rc 5 +l6:6:wait:/etc/init.d/rc 6 +# Normally not reached, but fallthrough in case of emergency. +z6:6:respawn:/sbin/sulogin +1:2345:respawn:/sbin/getty 38400 console +$(for tty in $(seq 1 "$num_tty"); do echo "c${tty}:12345:respawn:/sbin/getty 38400 tty${tty} linux" ; done;) +p6::ctrlaltdel:/sbin/init 6 +p0::powerfail:/sbin/init 0 +EOF + + # symlink mtab + [ -e "$rootfs/etc/mtab" ] && rm "$rootfs/etc/mtab" + ln -s /proc/self/mounts "$rootfs/etc/mtab" + + # disable selinux in devuan + mkdir -p "$rootfs/selinux" + echo 0 > "$rootfs/selinux/enforce" + + # remove links protection settings + rm -f "$rootfs/etc/sysctl.d/protect-links.conf" + + # configure the network using the dhcp + cat < $rootfs/etc/network/interfaces +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet dhcp +EOF + + # set the hostname + cat < $rootfs/etc/hostname +$hostname +EOF + + # set minimal hosts + cat < $rootfs/etc/hosts +127.0.0.1 localhost +127.0.1.1 $hostname + +# The following lines are desirable for IPv6 capable hosts +::1 localhost ip6-localhost ip6-loopback +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters +EOF + + # reconfigure some services + + # but first reconfigure locales - so we get no noisy perl-warnings + if [ -z "$LANG" ] || echo $LANG | grep -E -q "^C(\..+)*$"; then + cat >> "$rootfs/etc/locale.gen" << EOF +en_US.UTF-8 UTF-8 +EOF + chroot "$rootfs" locale-gen en_US.UTF-8 UTF-8 + chroot "$rootfs" update-locale LANG=en_US.UTF-8 + else + encoding=$(locale charmap) + [ -z "${encoding}" ] && encoding="UTF-8" + chroot "$rootfs" sed -e "s/^# \(${LANG} ${encoding}\)/\1/" \ + -i /etc/locale.gen 2> /dev/null + cat >> "$rootfs/etc/locale.gen" << EOF +$LANG $encoding +EOF + chroot "$rootfs" locale-gen "$LANG" "$encoding" + chroot "$rootfs" update-locale LANG="$LANG" + fi + + # remove pointless services in a container + chroot "$rootfs" /usr/sbin/update-rc.d -f checkroot.sh disable + chroot "$rootfs" /usr/sbin/update-rc.d -f umountfs disable + chroot "$rootfs" /usr/sbin/update-rc.d -f hwclock.sh disable + chroot "$rootfs" /usr/sbin/update-rc.d -f hwclockfirst.sh disable + + # generate new SSH keys + if [ -x "$rootfs/var/lib/dpkg/info/openssh-server.postinst" ]; then + cat > "$rootfs/usr/sbin/policy-rc.d" << EOF +#!/bin/sh +exit 101 +EOF + chmod +x "$rootfs/usr/sbin/policy-rc.d" + + if [ -f "$rootfs/etc/init/ssh.conf" ]; then + mv "$rootfs/etc/init/ssh.conf" "$rootfs/etc/init/ssh.conf.disabled" + fi + + rm -f "$rootfs/etc/ssh/"ssh_host_*key* + + DPKG_MAINTSCRIPT_PACKAGE=openssh DPKG_MAINTSCRIPT_NAME=postinst chroot "$rootfs" /var/lib/dpkg/info/openssh-server.postinst configure + sed -i "s/root@$(hostname)/root@$hostname/g" "$rootfs/etc/ssh/"ssh_host_*.pub + + if [ -f "$rootfs/etc/init/ssh.conf.disabled" ]; then + mv "$rootfs/etc/init/ssh.conf.disabled" "$rootfs/etc/init/ssh.conf" + fi + + rm -f "$rootfs/usr/sbin/policy-rc.d" + fi + + # set initial timezone as on host + if [ -f /etc/timezone ]; then + cat /etc/timezone > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" + chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata + elif [ -f /etc/sysconfig/clock ]; then + . /etc/sysconfig/clock + echo "$ZONE" > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" + chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata + else + echo "Timezone in container is not configured. Adjust it manually." + fi + + if [ -n "$authkey" ]; then + local ssh_dir_path="${rootfs}/root/.ssh" + mkdir -p "$ssh_dir_path" + cp "$authkey" "${ssh_dir_path}/authorized_keys" + chmod 700 "$ssh_dir_path" + echo "Inserted SSH public key from '$authkey' into /root/.ssh/authorized_keys" + fi + + return 0 +} + +write_sourceslist() +{ + local rootfs="$1"; shift + local release="$1"; shift + local arch="$1"; shift + + local prefix="deb" + if [ -n "${arch}" ]; then + prefix="deb [arch=${arch}]" + fi + + if [ "$mainonly" = 1 ]; then + non_main='' + else + non_main=' contrib non-free' + fi + + cat >> "${rootfs}/etc/apt/sources.list" << EOF +${prefix} $MIRROR ${release} main${non_main} +EOF + + if [ "$release" != "unstable" -a "$release" != "ceres" ]; then + cat >> "${rootfs}/etc/apt/sources.list" << EOF +${prefix} $SECURITY_MIRROR ${release}-updates main${non_main} +EOF + fi +} + +install_packages() +{ + local rootfs="$1"; shift + local packages="$*" + + chroot "${rootfs}" apt-get update + if [ -n "${packages}" ]; then + chroot "${rootfs}" apt-get install --force-yes -y --no-install-recommends ${packages} + fi +} + +# Check if given path is in a btrfs partition +is_btrfs() +{ + [ -e "$1" -a "$(stat -f -c '%T' "$1")" = "btrfs" ] +} + +# Check if given path is the root of a btrfs subvolume +is_btrfs_subvolume() +{ + [ -d "$1" -a "$(stat -f -c '%T' "$1")" = "btrfs" -a "$(stat -c '%i' "$1")" -eq 256 ] +} + +try_mksubvolume() +{ + path=$1 + [ -d "$path" ] && return 0 + mkdir -p "$(dirname "$path")" + if which btrfs >/dev/null 2>&1 && is_btrfs "$(dirname "$path")"; then + btrfs subvolume create "$path" + else + mkdir -p "$path" + fi +} + +try_rmsubvolume() +{ + path=$1 + [ -d "$path" ] || return 0 + if which btrfs >/dev/null 2>&1 && is_btrfs_subvolume "$path"; then + btrfs subvolume delete "$path" + else + rm -rf "$path" + fi +} + +cleanup() +{ + try_rmsubvolume "$cache/partial-$release-$arch" + try_rmsubvolume "$cache/rootfs-$release-$arch" +} + +download_devuan() +{ + packages=\ +init,\ +ifupdown,\ +locales,\ +dialog,\ +isc-dhcp-client,\ +netbase,\ +net-tools,\ +iproute2,\ +openssh-server + + cache=$1 + arch=$2 + release=$3 + interpreter="$4" + interpreter_path="$5" + + trap cleanup EXIT SIGHUP SIGINT SIGTERM + + # Create the cache + mkdir -p "$cache" + + # If devuan-archive-keyring isn't installed, fetch GPG keys directly + releasekeyring=/usr/share/keyrings/devuan-archive-keyring.gpg + lreleasekeyring=/etc/apt/trusted.gpg.d/devuan-archive-keyring.gpg + if [ -f "$releasekeyring" ]; then + apt_gpg_opt="--keyring=${releasekeyring}" + elif [ -f "$lreleasekeyring" ]; then + apt_gpg_opt="--keyring=${lreleasekeyring}" + elif [ "$DOWNLOAD_KEYRING" = 1 ]; then + [ ! -d "/etc/apt/trusted.gpg.d" ] && lreleasekeyring="$cache/archive-key.gpg" + if [[ "$(id -u)" == "0" ]]; then + wget https://git.devuan.org/devuan/devuan-keyring/raw/branch/master/keyrings/devuan-archive-keyring.gpg -O - --quiet \ + | gpg --import --no-default-keyring --keyring="${lreleasekeyring}" + apt_gpg_opt="--keyring=${lreleasekeyring}" + else + echo "Must be root (sudo) to save $lreleasekeyring" + fi + fi + if [ -z "$apt_gpg_opt" ]; then + echo "WARNING: No GPG check" + apt_gpg_opt='--no-check-gpg' + fi + # check the mini devuan was not already downloaded + try_mksubvolume "$cache/partial-$release-$arch" + if [ $? -ne 0 ]; then + echo "Failed to create '$cache/partial-$release-$arch' directory" + return 1 + fi + + # download a mini devuan into a cache + echo "Downloading devuan minimal ..." + if [ "$interpreter" = "" ] ; then + debootstrap --verbose --variant=minbase --arch="$arch" \ + --include=$packages "${apt_gpg_opt}" \ + "$release" "$cache/partial-$release-$arch" "$MIRROR" + if [ $? -ne 0 ]; then + echo "Failed to download the rootfs, aborting." + return 1 + fi + else + debootstrap --foreign --verbose --variant=minbase --arch="$arch" \ + --include=$packages "${apt_gpg_opt}" \ + "$release" "$cache/partial-$release-$arch" "$MIRROR" + if [ $? -ne 0 ]; then + echo "Failed to download the rootfs, aborting." + return 1 + fi + mkdir -p "$(dirname "$cache/partial-$release-$arch/$interpreter_path")" + cp "$interpreter" "$cache/partial-$release-$arch/$interpreter_path" + if [ $? -ne 0 ]; then + echo "failed to copy $interpreter to $cache/partial-$release-$arch/$interpreter_path" + return 1 + fi + chroot "$cache/partial-$release-$arch" debootstrap/debootstrap --second-stage + if [ $? -ne 0 ]; then + echo "failed to update the rootfs, aborting" + return 1 + fi + fi + + mv "$1/partial-$release-$arch" "$1/rootfs-$release-$arch" + echo "Download complete." + trap EXIT + trap SIGINT + trap SIGTERM + trap SIGHUP + + return 0 +} + +copy_devuan() +{ + cache=$1 + arch=$2 + rootfs=$3 + release=$4 + + # make a local copy of the minidevuan + echo -n "Copying rootfs to $rootfs..." + try_mksubvolume "$rootfs" + if which btrfs >/dev/null 2>&1 && \ + is_btrfs_subvolume "$cache/rootfs-$release-$arch" && \ + is_btrfs_subvolume "$rootfs"; then + realrootfs="$(dirname "$config")"/rootfs + [ "$rootfs" = "$realrootfs" ] || umount "$rootfs" || return 1 + btrfs subvolume delete "$realrootfs" || return 1 + btrfs subvolume snapshot "$cache/rootfs-$release-$arch" "$realrootfs" || return 1 + [ "$rootfs" = "$realrootfs" ] || mount --bind "$realrootfs" "$rootfs" || return 1 + else + rsync -SHaAX "$cache/rootfs-$release-$arch"/ $rootfs/ || return 1 + fi + return 0 +} + +install_devuan() +{ + rootfs=$1 + release=$2 + arch=$3 + cache="$4/devuan" + interpreter="$5" + interpreter_path="$6" + flushcache=$7 + mkdir -p $LOCALSTATEDIR/lock/subsys/ + ( + flock -x 9 + if [ $? -ne 0 ]; then + echo "Cache repository is busy." + return 1 + fi + + if [ "$flushcache" -eq 1 ]; then + echo "Flushing cache..." + cleanup + fi + + echo "Checking cache download in $cache/rootfs-$release-$arch ... " + if [ ! -e "$cache/rootfs-$release-$arch" ]; then + download_devuan "$cache" "$arch" "$release" "$interpreter" "$interpreter_path" + if [ $? -ne 0 ]; then + echo "Failed to download 'devuan base'" + return 1 + fi + fi + + copy_devuan "$cache" "$arch" "$rootfs" "$release" + if [ $? -ne 0 ]; then + echo "Failed to copy rootfs" + return 1 + fi + + return 0 + + ) 9>$LOCALSTATEDIR/lock/subsys/lxc-devuan + + return $? +} + +copy_configuration() +{ + path=$1 + rootfs=$2 + hostname=$3 + arch=$4 + num_tty=$5 + + # Generate the configuration file + # if there is exactly one veth network entry, make sure it has an + # associated hwaddr. + nics=$(grep -ce '^lxc\.net\.0\.type[ \t]*=[ \t]*veth' "$path/config") + if [ "$nics" -eq 1 ]; then + grep -q "^lxc.net.0.hwaddr" "$path/config" || sed -i -e "/^lxc\.net\.0\.type[ \t]*=[ \t]*veth/a lxc.net.0.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" "$path/config" + fi + + ## Add all the includes + echo "" >> "$path/config" + echo "# Common configuration" >> "$path/config" + if [ -e "${LXC_TEMPLATE_CONFIG}/devuan.common.conf" ]; then + echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/devuan.common.conf" >> "$path/config" + fi + if [ -e "${LXC_TEMPLATE_CONFIG}/devuan.${release}.conf" ]; then + echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/devuan.${release}.conf" >> "$path/config" + fi + + ## Add the container-specific config + echo "" >> "$path/config" + echo "# Container specific configuration" >> "$path/config" + grep -q "^lxc.rootfs.path" "$path/config" 2> /dev/null || echo "lxc.rootfs.path = $rootfs" >> "$path/config" + + cat <> $path/config +lxc.tty.max = $num_tty +lxc.uts.name = $hostname +lxc.arch = $arch +lxc.pty.max = 1024 +EOF + + if [ $? -ne 0 ]; then + echo "Failed to add configuration" + return 1 + fi + + return 0 +} + +post_process() +{ + local rootfs="$1"; shift + local release="$1"; shift + local arch="$1"; shift + local hostarch="$1"; shift + local interpreter="$1"; shift + local packages="$*" + + # Disable service startup + cat > "${rootfs}/usr/sbin/policy-rc.d" << EOF +#!/bin/sh +exit 101 +EOF + chmod +x "${rootfs}/usr/sbin/policy-rc.d" + + # If the container isn't running a native architecture, setup multiarch + if [ "$interpreter" = "" -a "${arch}" != "${hostarch}" ]; then + # Test if dpkg supports multiarch + if ! chroot "$rootfs" dpkg --print-foreign-architectures 2>&1; then + chroot "$rootfs" dpkg --add-architecture "${hostarch}" + fi + fi + + # Write a new sources.list containing both native and multiarch entries + > "${rootfs}/etc/apt/sources.list" + if [ "$interpreter" != "" -a "${arch}" = "${hostarch}" ]; then + write_sourceslist "${rootfs}" "${release}" "${arch}" + else + write_sourceslist "${rootfs}" "${release}" + fi + + # Install Packages in container + if [ -n "${packages}" ]; then + local pack_list + pack_list="${packages//,/ }" + echo "Installing packages: ${pack_list}" + install_packages "${rootfs}" "${pack_list}" + fi + + # Re-enable service startup + rm "${rootfs}/usr/sbin/policy-rc.d" + + # Fix by Greg Olsen, avoid warning 'stdin not a tty' in some cases + if [[ -f "${rootfs}/root/.profile" ]]; then + sed -i -e 's/^mesg n/test -t 0 \&\& mesg n/g' ${rootfs}/root/.profile + fi + + # end +} + +clean() +{ + cache=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc/devuan"} + + if [ ! -e "$cache" ]; then + exit 0 + fi + + # lock, so we won't purge while someone is creating a repository + ( + flock -x 9 + if [ $? != 0 ]; then + echo "Cache repository is busy." + exit 1 + fi + + echo -n "Purging the download cache..." + rm --preserve-root --one-file-system -rf "$cache" && echo "Done." || exit 1 + exit 0 + + ) 9>$LOCALSTATEDIR/lock/subsys/lxc-devuan +} + +usage() +{ + cat < [-c|--clean] [-a|--arch=] [-r|--release=] + [--mirror=] [--security-mirror=] + [--package=] + [-I|--interpreter-path=] + [-F | --flush-cache] [-S|--auth-key=] + +Options : + + -h, --help print this help text + -p, --path=PATH directory where config and rootfs of this VM will be kept + -S, --auth-key=KEYFILE SSH public key to inject into the container as the root user. + -a, --arch=ARCH The container architecture. Can be one of: i686, x86_64, + amd64, armhf, armel, powerpc. Defaults to host arch. + -r, --release=RELEASE Devuan release. Can be one of: ascii, beowulf, chimaera, ceres. + Defaults to current stable. + --mirror=MIRROR Devuan mirror to use during installation. Overrides the MIRROR + environment variable (see below). + --security-mirror=SECURITY_MIRROR + Devuan mirror to use for security updates. Overrides the + SECURITY_MIRROR environment variable (see below). + --packages=PACKAGE_NAME1,PACKAGE_NAME2,... + List of additional packages to install. Comma separated, without space. + -c, --clean only clean up the cache and terminate + --enable-non-free include also Devuan's contrib and non-free repositories. + -I|--interpreter-path=INTERPRETER-PATH + Path of the binfmt interpreter to copy to the rootfs + -F | --flush-cache Flush the devuan release cache + +Environment variables: + + MIRROR The Devuan package mirror to use. See also the --mirror switch above. + Defaults to '$MIRROR' + SECURITY_MIRROR The Devuan package security mirror to use. See also the --security-mirror switch above. + Defaults to '$SECURITY_MIRROR' + DOWNLOAD_KEYRING Sets whether to download keyring when missing or ignore keyring checks + Defaults to 1 + +EOF + return 0 +} + +options=$(getopt -o hp:n:a:r:cI:FS: -l arch:,auth-key:,clean,help,enable-non-free,mirror:,name:,packages:,path:,release:,rootfs:,security-mirror:,interpreter-path:,flush-cache -- "$@") +if [ $? -ne 0 ]; then + usage "$(basename "$0")" + exit 1 +fi +eval set -- "$options" + +littleendian=$(lscpu | grep '^Byte Order' | grep -q Little && echo yes) + +arch=$(uname -m) +if [ "$arch" = "i686" ]; then + arch="i386" +elif [ "$arch" = "x86_64" ]; then + arch="amd64" +elif [ "$arch" = "armv7l" ]; then + arch="armhf" +elif [ "$arch" = "aarch64" ]; then + arch="arm64" +elif [ "$arch" = "ppc" ]; then + arch="powerpc" +elif [ "$arch" = "ppc64le" ]; then + arch="ppc64el" +elif [ "$arch" = "mips" -a "$littleendian" = "yes" ]; then + arch="mipsel" +elif [ "$arch" = "mips64" -a "$littleendian" = "yes" ]; then + arch="mips64el" +fi +hostarch=$arch +mainonly=1 +flushcache=0 + +while true +do + case "$1" in + -h|--help) usage "$0" && exit 1;; + --) shift 1; break ;; + + -a|--arch) arch=$2; shift 2;; + -S|--auth-key) authkey=$2; shift 2;; + -I|--interpreter-path) + interpreter="$2"; shift 2;; + -c|--clean) clean=1; shift 1;; + --enable-non-free) mainonly=0; shift 1;; + --mirror) MIRROR=$2; shift 2;; + -n|--name) name=$2; shift 2;; + --packages) packages=$2; shift 2;; + -p|--path) path=$2; shift 2;; + -r|--release) release=$2; shift 2;; + --rootfs) rootfs=$2; shift 2;; + --security-mirror) SECURITY_MIRROR=$2; shift 2;; + -F|--flush-cache) flushcache=1; shift 1;; + *) break ;; + esac +done + +if [ ! -z "$clean" -a -z "$path" ]; then + clean || exit 1 + exit 0 +fi + +if [ "$arch" = "i686" ]; then + arch=i386 +fi + +if [ "$arch" = "x86_64" ]; then + arch=amd64 +fi + +if [ "$interpreter" = "" ] ; then + if [ $hostarch = "i386" -a $arch = "amd64" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "armhf" -o $hostarch = "armel" ] && \ + [ $arch != "armhf" -a $arch != "armel" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "powerpc" -a $arch != "powerpc" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "mips" -a $arch != "mips" ] || \ + [ $hostarch = "mipsel" -a $arch != "mipsel" ] || \ + [ $hostarch = "mips64" -a $arch != "mips" -a $arch != "mips64" ] || \ + [ $hostarch = "mips64el" -a $arch != "mipsel" -a $arch != "mips64el" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi +else + if ! file -b "${interpreter}" |grep -q "statically linked" ; then + echo "'${interpreter}' must be statically linked" 1>&2 + exit 1 + fi + interpreter_path=$(find_interpreter "$interpreter") + if [ $? -ne 0 ] ; then + echo "no binfmt interpreter using $(basename "$interpreter")" 1>&2 + exit 1 + fi +fi + +type debootstrap +if [ $? -ne 0 ]; then + echo "'debootstrap' command is missing" + exit 1 +fi + +if [ -z "$path" ]; then + echo "'path' parameter is required" + exit 1 +fi + +if [ "$(id -u)" != "0" ]; then + echo "This script should be run as 'root'" + exit 1 +fi + +if [ -n "$authkey" ]; then + if [ ! -f "$authkey" ]; then + echo "SSH keyfile '$authkey' not found" + exit 1 + fi + # This is mostly to prevent accidental uage of the private key instead + # of the public key. + if [ "${authkey: -4}" != ".pub" ]; then + echo "SSH keyfile '$authkey' does not end with '.pub'" + exit 1 + fi +fi + +release=${release:-stable} +permanent_releases=('stable' 'testing' 'ceres' 'unstable') +if [[ ! "${permanent_releases[*]}" =~ (^|[^[:alpha:]])$release([^[:alpha:]]|$) ]]; then + if ! wget "${MIRROR}/dists/${release}/Release" -O /dev/null 2> /dev/null; then + echo "Invalid release ${release} (not found in mirror)" + exit 1 + fi +fi + +# detect rootfs +config="$path/config" +if [ -z "$rootfs" ]; then + if grep -q '^lxc.rootfs.path' "$config" 2> /dev/null ; then + rootfs=$(awk -F= '/^lxc.rootfs.path[ \t]+=/{ print $2 }' "$config") + else + rootfs=$path/rootfs + fi +fi + +# determine the number of ttys - default is 4 +if grep -q '^lxc.tty.max' "$config" 2> /dev/null ; then + num_tty=$(awk -F= '/^lxc.tty.max[ \t]+=/{ print $2 }' "$config") +else + num_tty=4 +fi + +install_devuan "$rootfs" "$release" "$arch" "$LXC_CACHE_PATH" "$interpreter" "$interpreter_path" "$flushcache" +if [ $? -ne 0 ]; then + echo "failed to install devuan" + exit 1 +fi + +configure_devuan "$rootfs" "$name" $num_tty +if [ $? -ne 0 ]; then + echo "failed to configure devuan for a container" + exit 1 +fi + +copy_configuration "$path" "$rootfs" "$name" $arch $num_tty +if [ $? -ne 0 ]; then + echo "failed write configuration file" + exit 1 +fi + +post_process "${rootfs}" "${release}" ${arch} ${hostarch} "${interpreter}" "${packages}" + +if [ ! -z "$clean" ]; then + clean || exit 1 + exit 0 +fi diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in old mode 100755 new mode 100644