You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

226 lines
6.7 KiB

3 years ago
#!/bin/sh
# This scripts is borrowed from distrobuilder.
# awk '/content := `/ {match($0, /.*`([^`]*)/, l); print l[1]; a=1; next} /^`$/ {a=0} a {print $0}' < main.go
# Probably, it will need to be updated from time to time.
[ -h /sbin/init ] || exit 0
generators_dir=/etc/systemd/system-generators
mkdir -p "$generators_dir"
cat > "$generators_dir"/lxc <<'@@@'
#!/bin/sh
# NOTE: systemctl is not available for systemd-generators
set -eu
## Helper functions
# is_lxc_container succeeds if we're running inside a LXC container
is_lxc_container() {
grep -qa container=lxc /proc/1/environ
}
# is_lxd_vm succeeds if we're running inside a LXD VM
is_lxd_vm() {
[ -e /dev/virtio-ports/org.linuxcontainers.lxd ]
}
# is_in_path succeeds if the given file exists in on of the paths
is_in_path() {
# Don't use $PATH as that may not include all relevant paths
for path in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin; do
[ -e "${path}/$1" ] && return 0
done
return 1
}
## Fix functions
# fix_ro_paths avoids udevd issues with /sys and /proc being writable
fix_ro_paths() {
mkdir -p /run/systemd/system/$1.d
cat <<-EOF > /run/systemd/system/$1.d/zzz-lxc-ropath.conf
[Service]
BindReadOnlyPaths=/sys /proc
EOF
}
# fix_nm_force_up sets up a unit override to force NetworkManager to start the system connection
fix_nm_force_up() {
# Check if the device exists
[ -e "/sys/class/net/$1" ] || return 0
# Check if NetworkManager exists
[ "${nm_exists}" -eq 1 ] || return 0
cat <<-EOF > /run/systemd/system/network-connection-activate.service
[Unit]
Description=Activate connection
After=NetworkManager.service NetworkManager-wait-online.service
[Service]
ExecStart=-/usr/bin/nmcli c up "System $1"
Type=oneshot
RemainAfterExit=true
[Install]
WantedBy=default.target
EOF
mkdir -p /run/systemd/system/default.target.wants
ln -sf /run/systemd/system/network-connection-activate.service /run/systemd/system/default.target.wants/network-connection-activate.service
}
# fix_nm_link_state forces the network interface to a DOWN state ahead of NetworkManager starting up
fix_nm_link_state() {
[ -e "/sys/class/net/$1" ] || return 0
ip_path=
if [ -f /sbin/ip ]; then
ip_path=/sbin/ip
elif [ -f /bin/ip ]; then
ip_path=/bin/ip
else
return 0
fi
cat <<-EOF > /run/systemd/system/network-device-down.service
[Unit]
Description=Turn off network device
Before=NetworkManager.service
[Service]
ExecStart=-${ip_path} link set $1 down
Type=oneshot
RemainAfterExit=true
[Install]
WantedBy=default.target
EOF
mkdir -p /run/systemd/system/default.target.wants
ln -sf /run/systemd/system/network-device-down.service /run/systemd/system/default.target.wants/network-device-down.service
}
# fix_systemd_override_unit generates a unit specific override
fix_systemd_override_unit() {
dropin_dir="/run/systemd/${1}.d"
mkdir -p "${dropin_dir}"
echo "[Service]" > "${dropin_dir}/zzz-lxc-service.conf"
[ "${systemd_version}" -ge 247 ] && echo "ProtectProc=default" >> "${dropin_dir}/zzz-lxc-service.conf"
[ "${systemd_version}" -ge 232 ] && echo "ProtectControlGroups=no" >> "${dropin_dir}/zzz-lxc-service.conf"
[ "${systemd_version}" -ge 232 ] && echo "ProtectKernelTunables=no" >> "${dropin_dir}/zzz-lxc-service.conf"
# Additional settings for privileged containers
if grep -q 4294967295 /proc/self/uid_map; then
echo "ProtectHome=no" >> "${dropin_dir}/zzz-lxc-service.conf"
echo "ProtectSystem=no" >> "${dropin_dir}/zzz-lxc-service.conf"
echo "PrivateDevices=no" >> "${dropin_dir}/zzz-lxc-service.conf"
echo "PrivateTmp=no" >> "${dropin_dir}/zzz-lxc-service.conf"
[ "${systemd_version}" -ge 244 ] && echo "ProtectKernelLogs=no" >> "${dropin_dir}/zzz-lxc-service.conf"
[ "${systemd_version}" -ge 232 ] && echo "ProtectKernelModules=no" >> "${dropin_dir}/zzz-lxc-service.conf"
echo "ReadWritePaths=" >> "${dropin_dir}/zzz-lxc-service.conf"
fi
}
# fix_systemd_mask masks the systemd unit
fix_systemd_mask() {
ln -sf /dev/null /run/systemd/system/$1
}
# fix_systemd_udev_trigger overrides the systemd-udev-trigger.service to match the latest version
# of the file which uses "ExecStart=-" instead of "ExecStart=".
fix_systemd_udev_trigger() {
mkdir -p /run/systemd/system/systemd-udev-trigger.service.d
cat <<-EOF > /run/systemd/system/systemd-udev-trigger.service.d/zzz-lxc-override.conf
[Service]
ExecStart=
ExecStart=-udevadm trigger --type=subsystems --action=add
ExecStart=-udevadm trigger --type=devices --action=add
EOF
}
# fix_systemd_sysctl overrides the systemd-sysctl.service to use "ExecStart=-" instead of "ExecStart=".
fix_systemd_sysctl() {
mkdir -p /run/systemd/system/systemd-sysctl.service.d
cat <<-EOF > /run/systemd/system/systemd-sysctl.service.d/zzz-lxc-override.conf
[Service]
ExecStart=
ExecStart=-/usr/lib/systemd/systemd-sysctl
EOF
}
## Main logic
# Exit immediately if not a LXC/LXD container or VM
if ! is_lxd_vm && ! is_lxc_container; then
exit
fi
# Check for NetworkManager and cloud-init
nm_exists=0
cloudinit_exists=0
is_in_path NetworkManager && nm_exists=1
is_in_path cloud-init && cloudinit_exists=1
# Determine systemd version
for path in /usr/lib/systemd/systemd /lib/systemd/systemd; do
[ -x "${path}" ] || continue
systemd_version="$("${path}" --version | head -n1 | cut -d' ' -f2)"
break
done
# Determine distro name and release
ID=""
VERSION_ID=""
if [ -e /etc/os-release ]; then
. /etc/os-release
fi
# Apply systemd overrides
if [ "${systemd_version}" -ge 244 ]; then
fix_systemd_override_unit system/service
else
# Setup per-unit overrides
find /lib/systemd /etc/systemd /run/systemd /usr/lib/systemd -name "*.service" -type f | sed 's#/\(lib\|etc\|run\|usr/lib\)/systemd/##g'| while read -r service_file; do
fix_systemd_override_unit "${service_file}"
done
fi
# Workarounds for all containers
if is_lxc_container; then
fix_systemd_udev_trigger
fix_systemd_sysctl
fix_systemd_mask dev-hugepages.mount
fix_systemd_mask systemd-journald-audit.socket
fix_systemd_mask run-ribchester-general.mount
fix_systemd_mask systemd-modules-load.service
fix_systemd_mask systemd-pstore.service
fix_systemd_mask ua-messaging.service
if [ ! -e /dev/tty1 ]; then
fix_systemd_mask vconsole-setup-kludge@tty1.service
fi
if ! grep -q 4294967295 /proc/self/uid_map && { [ "${ID}" = "altlinux" ] || [ "${ID}" = "arch" ] || [ "${ID}" = "fedora" ]; }; then
fix_ro_paths systemd-networkd.service
fix_ro_paths systemd_resolved.servce
fi
fi
# Workarounds for cloud containers
if is_lxc_container && { [ "${ID}" = "fedora" ] || [ "${ID}" = "rhel" ]; } && [ "${cloudinit_exists}" -eq 1 ]; then
fix_nm_force_up eth0
fi
# Workarounds for NetworkManager in containers
if [ "${nm_exists}" -eq 1 ]; then
if [ "${ID}" = "ol" ] || [ "${ID}" = "centos" ]; then
fix_nm_force_up eth0
fi
fix_nm_link_state eth0
fi
@@@
chmod 755 "$generators_dir"/lxc