Adding lxc specific hooks.
This commit is contained in:
Daniel Baumann
parent
7ce82acee7
commit
1db5b4a96e
|
|
@ -0,0 +1,9 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# Disabling loginuid (requires read-write proc filesystem)
|
||||
if grep -E -qs "^ *session *required *pam_loginuid.so" /etc/pam.d/login
|
||||
then
|
||||
sed -i -e 's|^.*\(session.*required.*pam_loginuid.so\)$|#\1|' /etc/pam.d/login
|
||||
fi
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# Disabling loginuid (requires read-write proc filesystem)
|
||||
if grep -E -qs "^ *session *required *pam_loginuid.so" /etc/pam.d/cron
|
||||
then
|
||||
sed -i -e 's|^.*\(session.*required.*pam_loginuid.so\)$|#\1|' /etc/pam.d/cron
|
||||
fi
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# /etc/default/hwclock is supported as of util-linux version 2.20.1-5
|
||||
_UTIL_LINUX_VERSION="$(dpkg -l util-linux | awk '/^ii/ { print $3 }')"
|
||||
|
||||
if dpkg --compare-versions "${_UTIL_LINUX_VERSION}" lt 2.20.1-5~
|
||||
then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -e /etc/default/hwclock ]
|
||||
then
|
||||
. /etc/default/hwclock
|
||||
|
||||
# HWCLOCKACCESS is commented in /etc/default/hwclock
|
||||
if [ -z "${HWCLOCKACCESS}" ]
|
||||
then
|
||||
# uncommenting it
|
||||
sed -e "s|^# *HWCLOCKACCESS=|HWCLOCKACCESS=|" \
|
||||
/etc/default/hwclock > /etc/default/hwclock.tmp
|
||||
else
|
||||
cp /etc/default/hwclock /etc/default/hwclock.tmp
|
||||
fi
|
||||
else
|
||||
touch /etc/default/hwclock.tmp
|
||||
fi
|
||||
|
||||
# Set the hwclock parameters
|
||||
grep -Eq '^ *HWCLOCKACCESS=' /etc/default/hwclock.tmp || \
|
||||
echo "HWCLOCKACCESS=" >> /etc/default/hwclock.tmp
|
||||
|
||||
sed -i -e "s|^ *HWCLOCKACCESS=.*|HWCLOCKACCESS=\"${_HWCLOCKACCESS}\"|" \
|
||||
/etc/default/hwclock.tmp
|
||||
|
||||
mv /etc/default/hwclock.tmp /etc/default/hwclock
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
for _FILE in /etc/rsyslog.conf /etc/rsyslog.d/*
|
||||
do
|
||||
if [ -e "${_FILE}" ]
|
||||
then
|
||||
sed -i -e 's|^ *$ModLoad *imklog|#$ModLoad imklog|' "${_FILE}"
|
||||
fi
|
||||
done
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# Disable SELinux
|
||||
mkdir -p /sys/fs/selinux
|
||||
echo 0 > /sys/fs/selinux/enforce.tmp
|
||||
mv /sys/fs/selinux/enforce.tmp /sys/fs/selinux/enforce
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
# Disabling loginuid (requires read-write proc filesystem)
|
||||
if grep -E -qs "^ *session *required *pam_loginuid.so" /etc/pam.d/sshd
|
||||
then
|
||||
sed -i -e 's|^.*\(session.*required.*pam_loginuid.so\)$|#\1|' /etc/pam.d/sshd
|
||||
fi
|
||||
|
|
@ -0,0 +1,177 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
_LXC_CONSOLES="6"
|
||||
_LXC_DISABLE_SERVICES="checkroot.sh hwclockfirst.sh hwclock.sh kmod module-init-tools mountall.sh mountkernfs.sh umountfs umountroot"
|
||||
|
||||
if [ ! -e /usr/share/sysvinit/inittab ]
|
||||
then
|
||||
# System does not use sysvinit
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Revert /etc/inittab
|
||||
cp -p /usr/share/sysvinit/inittab /etc/inittab.tmp
|
||||
|
||||
# Disable sulogin
|
||||
# ~~:S:wait:/sbin/sulogin
|
||||
sed -i -e 's|\(^[^#].*S:wait:.*$\)|#\1|' /etc/inittab.tmp
|
||||
|
||||
# Disable ctrlaltdel
|
||||
# ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
|
||||
sed -i -e 's|\(^[^#].*:ctrlaltdel:.*$\)|#\1|' /etc/inittab.tmp
|
||||
|
||||
# Disable power
|
||||
# pf::powerwait:/etc/init.d/powerfail start
|
||||
# pn::powerfailnow:/etc/init.d/powerfail now
|
||||
# po::powerokwait:/etc/init.d/powerfail stop
|
||||
sed -i -e 's|\(^[^#].*:power.*:.*$\)|#\1|' /etc/inittab.tmp
|
||||
|
||||
# Disable normal getty
|
||||
# 1:2345:respawn:/sbin/getty 38400 tty1
|
||||
# 2:23:respawn:/sbin/getty 38400 tty2
|
||||
# 3:23:respawn:/sbin/getty 38400 tty3
|
||||
# ...
|
||||
# Keep container getty
|
||||
# 1:2345:respawn:/sbin/getty 38400 console
|
||||
# c1:23:respawn:/sbin/getty 38400 tty1
|
||||
# c2:23:respawn:/sbin/getty 38400 tty2
|
||||
# ...
|
||||
sed -i -e 's|\(^[^#,^c].*:respawn:/sbin/getty.*[^console,linux]$\)|#\1|' /etc/inittab.tmp
|
||||
|
||||
# Enable container getty
|
||||
# 1:2345:respawn:/sbin/getty 38400 console
|
||||
# c1:23:respawn:/sbin/getty 38400 tty1
|
||||
# c2:23:respawn:/sbin/getty 38400 tty2
|
||||
|
||||
if [ -e /etc/progress-linux_version ]
|
||||
then
|
||||
_OPTIONS="--nohostname 38400"
|
||||
else
|
||||
_OPTIONS="38400"
|
||||
fi
|
||||
|
||||
# Assemble new entries
|
||||
_CONSOLES="\n#-- live-debconfig begin\n1:2345:respawn:/sbin/getty ${_OPTIONS} console"
|
||||
|
||||
for _CONSOLE in $(seq 1 ${_LXC_CONSOLES})
|
||||
do
|
||||
_CONSOLES="${_CONSOLES}\nc${_CONSOLE}:12345:respawn:/sbin/getty ${_OPTIONS} tty${_CONSOLE} linux"
|
||||
done
|
||||
|
||||
_CONSOLES="${_CONSOLES}\n#-- live-debconfig end"
|
||||
|
||||
# Remove old entries
|
||||
sed -i -e '/#-- live-debconfig begin/,/#-- live-debconfig end/d' /etc/inittab.tmp
|
||||
|
||||
# Add new entries
|
||||
_CONSOLE="$(grep '#[0-9].*:respawn:/sbin/getty' /etc/inittab.tmp | tail -1)"
|
||||
|
||||
sed -i -e "s|\(${_CONSOLE}\)|\1${_CONSOLES}|" /etc/inittab.tmp
|
||||
|
||||
# Enable powerfail entries for lxc-shutdown
|
||||
if ! grep -qs ^p0:: /etc/inittab.tmp
|
||||
then
|
||||
echo "p0::powerfail:/sbin/init 0" >> /etc/inittab.tmp
|
||||
fi
|
||||
|
||||
if ! grep -qs ^p6:: /etc/inittab.tmp
|
||||
then
|
||||
echo "p6::ctrlaltdel:/sbin/init 6" >> /etc/inittab.tmp
|
||||
fi
|
||||
|
||||
mv /etc/inittab.tmp /etc/inittab
|
||||
|
||||
# squeeze and newer have /dev/tty and /dev/tty0 by default
|
||||
for _CONSOLE in $(seq 1 ${_LXC_CONSOLES})
|
||||
do
|
||||
if [ ! -e "/dev/tty${_CONSOLE}" ]
|
||||
then
|
||||
mknod "/dev/tty${_CONSOLE}" c 4 "${_CONSOLE}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Remove uneeded services in a container
|
||||
for _SERVICE in ${_LXC_DISABLE_SERVICES}
|
||||
do
|
||||
# service does not exist
|
||||
if [ ! -e /etc/init.d/${_SERVICE} ]
|
||||
then
|
||||
continue
|
||||
fi
|
||||
|
||||
_ALREADY_DISABLED="false"
|
||||
|
||||
# service is already disabled
|
||||
for _RUNLEVEL in /etc/rc*.d
|
||||
do
|
||||
if ! ls ${_RUNLEVEL}/K*${_SERVICE} > /dev/null 2>&1
|
||||
then
|
||||
# disabled services have stop links in all runlevels
|
||||
# if at least one runlevel does not have a stop link,
|
||||
# then the service was not disabled and we need to continue
|
||||
# with disabling the service later on
|
||||
_ALREADY_DISABLED="false"
|
||||
break
|
||||
fi
|
||||
|
||||
# service is indeed already disabled
|
||||
_ALREADY_DISABLED="true"
|
||||
done
|
||||
|
||||
if [ "${_ALREADY_DISABLED}" = "false" ]
|
||||
then
|
||||
if ls /etc/rc*.d/K*${_SERVICE} > /dev/null 2>&1 && \
|
||||
! ls /etc/rc*.d/S*${_SERVICE} > /dev/null 2>&1
|
||||
then
|
||||
# service has only stop links
|
||||
# therefore, using 'update-rc.d disable' does not work,
|
||||
# and using 'update-rc.d remove' is not upgrade safe
|
||||
# (on upgrades, the stop links would be re-added).
|
||||
for _SYMLINK in /etc/rc*.d/K*${_SERVICE}
|
||||
do
|
||||
LIVE_INITSCRIPT_EMPTY="true"
|
||||
|
||||
rm -f ${_SYMLINK}
|
||||
ln -s /bin/live-initscripts-empty-stop ${_SYMLINK}
|
||||
done
|
||||
fi
|
||||
|
||||
# service is a normal service with both start and stop links
|
||||
update-rc.d -f ${_SERVICE} disable 2>&1 | \
|
||||
grep -v -e "^insserv: warning:" \
|
||||
-e "^update-rc.d: warning:" \
|
||||
-e "^update-rc.d: using dependency based boot sequencing" \
|
||||
-e "^update-rc.d: error: .* Default-Start contains no runlevels, aborting." \
|
||||
|| true
|
||||
fi
|
||||
done
|
||||
|
||||
case ${LIVE_INITSCRIPT_EMPTY} in
|
||||
true)
|
||||
|
||||
cat > /bin/live-initscripts-empty-stop < EOF
|
||||
#!/bin/sh
|
||||
|
||||
### BEGIN INIT INFO
|
||||
# Provides: live-build
|
||||
# Required-Start:
|
||||
# Required-Stop:
|
||||
# Should-Start:
|
||||
# Should-Stop:
|
||||
# Default-Start:
|
||||
# Default-Stop: 0 6
|
||||
# Short-Description: Live System Build Components
|
||||
# Description: live-build contains the components to build a live
|
||||
# system from a configuration directory.
|
||||
# X-Start-Before:
|
||||
# X-Stop-After:
|
||||
# X-Interactive:
|
||||
### END INIT INFO
|
||||
|
||||
exit 0
|
||||
EOF
|
||||
|
||||
;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -e
|
||||
|
||||
if [ ! -e /lib/systemd/systemd ]
|
||||
then
|
||||
# System does not use systemd
|
||||
exit 0
|
||||
fi
|
||||
|
||||
_LXC_CONSOLES="6"
|
||||
_LXC_DISABLE_SERVICES="checkroot.service dev-hugepages.mount dev-mqueue.mount proc-sys-fs-binfmt_misc.automount remount-rootfs.service run-lock.mount run-user.mount swap.target sys-kernel-debug.mount sys-kernel-security.mount systemd-modules-load.service systemd-remount-api-vfs.service systemd-sysctl.service systemd-update-utmp-runlevel.service udev.service udev-settle.service udev-trigger.service user.mount var-lock.mount systemd-update-utmp-runlevel.service rescue.target sys-fs-fuse-connections.mount"
|
||||
|
||||
# systemd starts counting consoles at 0, not 1 like sysvinit.
|
||||
_LXC_CONSOLES="$((${_LXC_CONSOLES} - 1))"
|
||||
|
||||
# Disable sulogin
|
||||
ln -sf /dev/null /etc/systemd/system/console-shell.service
|
||||
|
||||
# Disable ctrlaltdel
|
||||
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
|
||||
|
||||
# Disable normal getty
|
||||
rm -f /etc/systemd/system/getty.target.wants/getty@*.service
|
||||
|
||||
# Enable container getty
|
||||
sed -e 's|^ *BindTo=|#BindTo=|' /lib/systemd/system/getty@.service > /etc/systemd/system/getty.target.wants/getty@console.service
|
||||
|
||||
for _CONSOLE in $(seq 0 ${_LXC_CONSOLES})
|
||||
do
|
||||
if [ -L /etc/systemd/system/getty.target.wants/getty@tty${_CONSOLE}.service ]
|
||||
then
|
||||
rm -f /etc/systemd/system/getty.target.wants/getty@tty${_CONSOLE}.service
|
||||
fi
|
||||
|
||||
sed -e 's|^ *BindTo=|#BindTo=|' /lib/systemd/system/getty@.service > /etc/systemd/system/getty.target.wants/getty@tty${_CONSOLE}.service
|
||||
done
|
||||
|
||||
# Enable powerfail for lxc-shutdown
|
||||
ln -sf /lib/systemd/system/reboot.target /etc/systemd/system/sigpwr.target
|
||||
|
||||
# Disable default cpu and cpupacct
|
||||
grep -Eq '^ *JoinControllers=' /etc/systemd/system.conf || echo "JoinControllers=" >> /etc/systemd/system.conf
|
||||
|
||||
sed -e 's|^ *JoinControllers=.*|JoinControllers=|' /etc/systemd/system.conf > /etc/systemd/system.conf.tmp
|
||||
mv /etc/systemd/system.conf.tmp /etc/systemd/system.conf
|
||||
|
||||
# squeeze and newer have /dev/tty and /dev/tty0 by default
|
||||
for _CONSOLE in $(seq 0 ${_LXC_CONSOLES})
|
||||
do
|
||||
if [ ! -e "/dev/tty${_CONSOLE}" ]
|
||||
then
|
||||
mknod "/dev/tty${_CONSOLE}" c 4 "${_CONSOLE}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Remove uneeded services in a container
|
||||
for _SERVICE in ${_LXC_DISABLE_SERVICES}
|
||||
do
|
||||
ln -sf "/dev/null" "/etc/systemd/system/${_SERVICE}"
|
||||
done
|
||||
|
||||
# Disable setting CapabilityBoundingSet for journald
|
||||
sed -e 's/^ *CapabilityBoundingSet/\#&/' /lib/systemd/system/systemd-journald.service > /etc/systemd/system/systemd-journald.service
|
||||
|
||||
# Disable setting CapabilityBoundingSet for logind
|
||||
sed -e 's/^ *CapabilityBoundingSet/\#&/' /lib/systemd/system/systemd-logind.service > /etc/systemd/system/systemd-logind.service
|
||||
Loading…
Reference in New Issue