diff --git a/Makefile b/Makefile index f5ed282..3f92549 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,6 @@ UBUNTU_BOXES= precise quantal raring saucy trusty DEBIAN_BOXES= squeeze wheezy sid jessie +CENTOS_BOXES= 6 TODAY=$(shell date -u +"%Y-%m-%d") # Replace i686 with i386 and x86_64 with amd64 @@ -11,6 +12,7 @@ all: ubuntu debian ubuntu: $(UBUNTU_BOXES) debian: $(DEBIAN_BOXES) +centos: $(CENTOS_BOXES) # REFACTOR: Figure out how can we reduce duplicated code $(UBUNTU_BOXES): CONTAINER = "vagrant-base-${@}-$(ARCH)" @@ -27,6 +29,13 @@ $(DEBIAN_BOXES): @sudo -E ./mk-debian.sh debian $(@) $(ARCH) $(CONTAINER) $(PACKAGE) @sudo chmod +rw $(PACKAGE) @sudo chown ${USER}: $(PACKAGE) +$(CENTOS_BOXES): CONTAINER = "vagrant-base-centos-${@}-$(ARCH)" +$(CENTOS_BOXES): PACKAGE = "output/${TODAY}/vagrant-lxc-centos-${@}-$(ARCH).box" +$(CENTOS_BOXES): + @mkdir -p $$(dirname $(PACKAGE)) + @sudo -E ./mk-centos.sh $(@) $(ARCH) $(CONTAINER) $(PACKAGE) + @sudo chmod +rw $(PACKAGE) + @sudo chown ${USER}: $(PACKAGE) acceptance: CONTAINER = "vagrant-base-acceptance-$(ARCH)" acceptance: PACKAGE = "output/${TODAY}/vagrant-lxc-acceptance-$(ARCH).box" @@ -36,7 +45,13 @@ acceptance: @sudo chmod +rw $(PACKAGE) @sudo chown ${USER}: $(PACKAGE) -clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} acceptance +release: + @test -z '$(version)' && echo 'version parameter not provided to `make`!' && exit 1 || return 0 + gh release create -d -a output/${TODAY} $(version) + git tag $(version) + git push && git push --tags + +clean: ALL_BOXES = ${DEBIAN_BOXES} ${UBUNTU_BOXES} ${CENTOS_BOXES} acceptance clean: @for r in $(ALL_BOXES); do \ sudo -E ./clean.sh $${r}\ diff --git a/centos/clean.sh b/centos/clean.sh new file mode 100755 index 0000000..9a56013 --- /dev/null +++ b/centos/clean.sh @@ -0,0 +1,16 @@ +#!/bin/bash +set -e + +source common/ui.sh +source common/utils.sh + +debug 'Bringing container up' +utils.lxc.start + +info "Cleaning up '${CONTAINER}'..." + +log 'Removing temporary files...' +rm -rf ${ROOTFS}/tmp/* + +log 'cleaning up dhcp leases' +rm -f ${ROOTFS}/var/lib/dhcp/* diff --git a/centos/install-extras.sh b/centos/install-extras.sh new file mode 100755 index 0000000..1c21647 --- /dev/null +++ b/centos/install-extras.sh @@ -0,0 +1,18 @@ +#!/bin/bash +set -e + +source common/ui.sh +source common/utils.sh + +info 'Installing extra packages and upgrading' + +debug 'Bringing container up' +utils.lxc.start + +# Sleep for a bit so that the container can get an IP +log 'Sleeping for 10 seconds...' +sleep 10 + +# TODO: Support for appending to this list from outside +PACKAGES=(vim curl wget man-db bash-completion python-software-properties ca-certificates sudo nfs-common) +utils.lxc.attach yum install install ${PACKAGES[*]} -y diff --git a/common/prepare-vagrant-user.sh b/common/prepare-vagrant-user.sh index fdeebaf..9f0fadf 100755 --- a/common/prepare-vagrant-user.sh +++ b/common/prepare-vagrant-user.sh @@ -17,6 +17,11 @@ elif $(grep -q 'ubuntu' ${ROOTFS}/etc/shadow); then chroot ${ROOTFS} groupmod -n vagrant ubuntu &>> ${LOG} echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd log 'Renamed ubuntu user to vagrant and changed password.' +elif [ ${DISTRIBUTION} = 'centos' ]; then + debug 'Creating vagrant user...' + chroot ${ROOTFS} useradd --create-home -s /bin/bash -u 1000 vagrant &>> ${LOG} + echo -n 'vagrant:vagrant' | chroot ${ROOTFS} chpasswd + sed -i 's/^Defaults\s\+requiretty/# Defaults requiretty/' $ROOTFS/etc/sudoers else debug 'Creating vagrant user...' chroot ${ROOTFS} useradd --create-home -s /bin/bash vagrant &>> ${LOG} diff --git a/common/ui.sh b/common/ui.sh index 6372a8d..244c1b0 100644 --- a/common/ui.sh +++ b/common/ui.sh @@ -6,21 +6,25 @@ export ERROR_COLOR='\033[31;01m' export WARN_COLOR='\033[33;01m' log() { - echo " [${RELEASE}] ${1}" >>${LOG} - echo " [${RELEASE}] ${1}" >&2 + LOG_PREFIX="${DISTRIBUTION}-${RELEASE}" + echo " [${LOG_PREFIX}] ${1}" >>${LOG} + echo " [${LOG_PREFIX}] ${1}" >&2 } warn() { - echo "==> [${RELEASE}] [WARN] ${1}" >>${LOG} - echo -e "${WARN_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}" + LOG_PREFIX="${DISTRIBUTION}-${RELEASE}" + echo "==> [${LOG_PREFIX}] [WARN] ${1}" >>${LOG} + echo -e "${WARN_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}" } info() { - echo "==> [${RELEASE}] [INFO] ${1}" >>${LOG} - echo -e "${OK_COLOR}==> [${RELEASE}] ${1}${NO_COLOR}" + LOG_PREFIX="${DISTRIBUTION}-${RELEASE}" + echo "==> [${LOG_PREFIX}] [INFO] ${1}" >>${LOG} + echo -e "${OK_COLOR}==> [${LOG_PREFIX}] ${1}${NO_COLOR}" } confirm() { + LOG_PREFIX="${DISTRIBUTION}-${RELEASE}" question=${1} default=${2} default_prompt= @@ -33,7 +37,7 @@ confirm() { default='Yes' fi - echo -e -n "${WARN_COLOR}==> [${RELEASE}] ${question} [${default_prompt}] ${NO_COLOR}" >&2 + echo -e -n "${WARN_COLOR}==> [${LOG_PREFIX}] ${question} [${default_prompt}] ${NO_COLOR}" >&2 read answer if [ -z $answer ]; then @@ -49,5 +53,6 @@ confirm() { } debug() { - [ ! $DEBUG ] || echo " [${RELEASE}] [DEBUG] ${1}" >&2 + LOG_PREFIX="${DISTRIBUTION}-${RELEASE}" + [ ! $DEBUG ] || echo " [${LOG_PREFIX}] [DEBUG] ${1}" >&2 } diff --git a/conf/centos b/conf/centos new file mode 100644 index 0000000..2b0121c --- /dev/null +++ b/conf/centos @@ -0,0 +1,51 @@ +# Taken from the oracle.common.conf.in +# Console settings + +lxc.devttydir = lxc +lxc.tty = 4 +lxc.pts = 1024 + +# Mount entries +lxc.mount.auto = proc:mixed sys:ro + +# Ensure hostname is changed on clone +lxc.hook.clone = /usr/share/lxc/hooks/clonehostname + +# Capabilities +# Uncomment these if you don't run anything that needs the capability, and +# would like the container to run with less privilege. +# +# Dropping sys_admin disables container root from doing a lot of things +# that could be bad like re-mounting lxc fstab entries rw for example, +# but also disables some useful things like being able to nfs mount, and +# things that are already namespaced with ns_capable() kernel checks, like +# hostname(1). +# lxc.cap.drop = sys_admin +# lxc.cap.drop = net_raw # breaks dhcp/ping +# lxc.cap.drop = setgid # breaks login (initgroups/setgroups) +# lxc.cap.drop = dac_read_search # breaks login (pam unix_chkpwd) +# lxc.cap.drop = setuid # breaks sshd,nfs statd +# lxc.cap.drop = audit_control # breaks sshd (set_loginuid failed) +# lxc.cap.drop = audit_write +# +lxc.cap.drop = mac_admin mac_override setfcap setpcap +lxc.cap.drop = sys_module sys_nice sys_pacct +lxc.cap.drop = sys_rawio sys_time + +# Control Group devices: all denied except those whitelisted +lxc.cgroup.devices.deny = a +# Allow any mknod (but not reading/writing the node) +lxc.cgroup.devices.allow = c *:* m +lxc.cgroup.devices.allow = b *:* m +lxc.cgroup.devices.allow = c 1:3 rwm # /dev/null +lxc.cgroup.devices.allow = c 1:5 rwm # /dev/zero +lxc.cgroup.devices.allow = c 1:7 rwm # /dev/full +lxc.cgroup.devices.allow = c 5:0 rwm # /dev/tty +lxc.cgroup.devices.allow = c 1:8 rwm # /dev/random +lxc.cgroup.devices.allow = c 1:9 rwm # /dev/urandom +lxc.cgroup.devices.allow = c 136:* rwm # /dev/tty[1-4] ptys and lxc console +lxc.cgroup.devices.allow = c 5:2 rwm # /dev/ptmx pty master + +# Blacklist some syscalls which are not safe in privileged +# containers +lxc.seccomp = /usr/share/lxc/config/common.seccomp diff --git a/mk-centos.sh b/mk-centos.sh new file mode 100755 index 0000000..365a82f --- /dev/null +++ b/mk-centos.sh @@ -0,0 +1,47 @@ +#!/bin/bash +set -e + +source common/ui.sh + +if [ "$(id -u)" != "0" ]; then + echo "You should run this script as root (sudo)." + exit 1 +fi + +export DISTRIBUTION='centos' +export RELEASE=$1 +export ARCH=$2 +export CONTAINER=$3 +export PACKAGE=$4 +export ROOTFS="/var/lib/lxc/${CONTAINER}/rootfs" +export WORKING_DIR="/tmp/${CONTAINER}" +export NOW=$(date -u) +export LOG=$(readlink -f .)/log/${CONTAINER}.log + +mkdir -p $(dirname $LOG) +echo '############################################' > ${LOG} +echo "# Beginning build at $(date)" >> ${LOG} +touch ${LOG} +chmod +rw ${LOG} + +if [ -f ${PACKAGE} ]; then + warn "The box '${PACKAGE}' already exists, skipping..." + echo + exit +fi + +debug "Creating ${WORKING_DIR}" +mkdir -p ${WORKING_DIR} + +info "Building box to '${PACKAGE}'..." + +./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER} +# ./centos/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER} +./centos/install-extras.sh ${CONTAINER} +./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER} +./centos/clean.sh ${CONTAINER} +./common/package.sh ${CONTAINER} ${PACKAGE} + +info "Finished building '${PACKAGE}'!" +log "Run \`sudo lxc-destroy -n ${CONTAINER}\` or \`make clean\` to remove the container that was created along the way" +echo diff --git a/mk-debian.sh b/mk-debian.sh index c93aac5..75f6323 100755 --- a/mk-debian.sh +++ b/mk-debian.sh @@ -38,7 +38,7 @@ info "Building box to '${PACKAGE}'..." ./common/download.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER} ./debian/vagrant-lxc-fixes.sh ${DISTRIBUTION} ${RELEASE} ${ARCH} ${CONTAINER} ./debian/install-extras.sh ${CONTAINER} -./common/prepare-vagrant-user.sh ${CONTAINER} +./common/prepare-vagrant-user.sh ${DISTRIBUTION} ${CONTAINER} ./debian/clean.sh ${CONTAINER} ./common/package.sh ${CONTAINER} ${PACKAGE}