The following pull request was submitted through Github. It can be accessed and reviewed at: https://github.com/lxc/lxc/pull/1587
This e-mail was sent by the LXC bot, direct replies will not reach the author unless they happen to be subscribed to this list. === Description (from pull-request) === This is a modification of lxc-debian.in and debian template to support Kali Linux. Tested on Ubuntu 16. Supports following issue: https://github.com/lxc/lxc/issues/140 Signed-off-by: binkybear <[email protected]>
From dafb6456aa6f086e8a493bb0d1887cf8562ef655 Mon Sep 17 00:00:00 2001 From: binkybear <[email protected]> Date: Wed, 7 Sep 2016 21:03:36 -0500 Subject: [PATCH] Modify debian template for Kali Linux MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Modified the lxc-debian.in and templates to support Kali Linux. Some menu items were removed as Kali only supports kali-rolling and bleeding edge release. Tested on Ubuntu 16 and working. https://github.com/lxc/lxc/issues/140 Signed-off-by: binkybear <[email protected]> Package not in kali libui-dialog-perl Use qemu-deboostrap; fix arm builds Fix interpreter missing from build. Remove keyring Signed-off-by: binkybear <[email protected]> Make sure network folder is there… …this seems to build find on qemu-debootstrap but has issues on regular deboostrap. Signed-off-by: binkybear <[email protected]> Bring kali up-to-date with debian template Signed-off-by: binkybear <[email protected]> --- config/templates/Makefile.am | 2 + config/templates/kali.common.conf.in | 28 ++ config/templates/kali.userns.conf.in | 2 + configure.ac | 3 + templates/Makefile.am | 1 + templates/lxc-kali.in | 813 +++++++++++++++++++++++++++++++++++ 6 files changed, 849 insertions(+) create mode 100644 config/templates/kali.common.conf.in create mode 100644 config/templates/kali.userns.conf.in create mode 100644 templates/lxc-kali.in diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am index 387c7a1d7..b71e36be9 100644 --- a/config/templates/Makefile.am +++ b/config/templates/Makefile.am @@ -20,6 +20,8 @@ templatesconfig_DATA = \ gentoo.common.conf \ gentoo.moresecure.conf \ gentoo.userns.conf \ + kali.common.conf \ + kali.userns.conf \ nesting.conf \ opensuse.common.conf \ opensuse.userns.conf \ diff --git a/config/templates/kali.common.conf.in b/config/templates/kali.common.conf.in new file mode 100644 index 000000000..07c2bc8b1 --- /dev/null +++ b/config/templates/kali.common.conf.in @@ -0,0 +1,28 @@ +# This derives from the global common config +lxc.include = @LXCTEMPLATECONFIG@/common.conf + +# Doesn't support consoles in /dev/lxc/ +lxc.devttydir = + +# When using LXC with apparmor, the container will be confined by default. +# If you wish for it to instead run unconfined, copy the following line +# (uncommented) to the container's configuration file. +#lxc.aa_profile = unconfined + +# If you wish to allow mounting block filesystems, then use the following +# line instead, and make sure to grant access to the block device and/or loop +# devices below in lxc.cgroup.devices.allow. +#lxc.aa_profile = lxc-container-default-with-mounting + +# Extra cgroup device access +## rtc +lxc.cgroup.devices.allow = c 254:0 rm +## tun +lxc.cgroup.devices.allow = c 10:200 rwm +## hpet +lxc.cgroup.devices.allow = c 10:228 rwm +## kvm +lxc.cgroup.devices.allow = c 10:232 rwm +## To use loop devices, copy the following line to the container's +## configuration file (uncommented). +#lxc.cgroup.devices.allow = b 7:* rwm diff --git a/config/templates/kali.userns.conf.in b/config/templates/kali.userns.conf.in new file mode 100644 index 000000000..707bb30c0 --- /dev/null +++ b/config/templates/kali.userns.conf.in @@ -0,0 +1,2 @@ +# This derives from the global userns config +lxc.include = @LXCTEMPLATECONFIG@/userns.conf diff --git a/configure.ac b/configure.ac index 0e29cb9d9..10eca693a 100644 --- a/configure.ac +++ b/configure.ac @@ -732,6 +732,8 @@ AC_CONFIG_FILES([ config/templates/gentoo.common.conf config/templates/gentoo.moresecure.conf config/templates/gentoo.userns.conf + config/templates/kali.common.conf + config/templates/kali.userns.conf config/templates/nesting.conf config/templates/opensuse.common.conf config/templates/opensuse.userns.conf @@ -896,6 +898,7 @@ AC_CONFIG_FILES([ templates/lxc-fedora templates/lxc-fedora-legacy templates/lxc-gentoo + templates/lxc-kali templates/lxc-openmandriva templates/lxc-opensuse templates/lxc-oracle diff --git a/templates/Makefile.am b/templates/Makefile.am index 61f062d42..2ab9f6bc2 100644 --- a/templates/Makefile.am +++ b/templates/Makefile.am @@ -12,6 +12,7 @@ templates_SCRIPTS = \ lxc-fedora \ lxc-fedora-legacy \ lxc-gentoo \ + lxc-kali \ lxc-openmandriva \ lxc-opensuse \ lxc-oracle \ diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in new file mode 100644 index 000000000..0cb28397b --- /dev/null +++ b/templates/lxc-kali.in @@ -0,0 +1,813 @@ +#!/bin/bash + +# +# lxc: linux Container library + +# Authors: +# Daniel Lezcano <[email protected]> + +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. + +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. + +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + +# Detect use under userns (unsupported) +for arg in "$@"; do + [ "$arg" = "--" ] && break + if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then + echo "This template can't be used for unprivileged containers." 1>&2 + echo "You may want to try the \"download\" template instead." 1>&2 + exit 1 + fi +done + +# Make sure the usual locations are in PATH +export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin +export GREP_OPTIONS="" + +MIRROR=${MIRROR:-http://repo.kali.org/kali} +RELEASE="kali-rolling" +LOCALSTATEDIR="@LOCALSTATEDIR@" +LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@" +# Allows the lxc-cache directory to be set by environment variable +LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc"} + +find_interpreter() +{ + given_interpreter=$(basename "$1") + + if [ ! -d /proc/sys/fs/binfmt_misc/ ] ; then + return 1 + fi + for file in /proc/sys/fs/binfmt_misc/* ; do + if [ "$file" = "/proc/sys/fs/binfmt_misc/register" -o \ + "$file" = "/proc/sys/fs/binfmt_misc/status" ] ; then + continue + fi + interpreter_path=$(sed -n "/^interpreter/s/interpreter \([^[:space:]]*\)/\1/p" "$file") + interpreter=$(basename "$interpreter_path") + + if [ "$given_interpreter" = "$interpreter" ] ; then + echo "$interpreter_path" + return 0 + fi + done + return 1 +} + +configure_kali() +{ + rootfs=$1 + hostname=$2 + num_tty=$3 + + # squeeze only has /dev/tty and /dev/tty0 by default, + # therefore creating missing device nodes for tty1-4. + for tty in $(seq 1 "$num_tty"); do + if [ ! -e "$rootfs/dev/tty$tty" ]; then + mknod "$rootfs/dev/tty$tty" c 4 "$tty" + fi + done + + # configure the inittab + cat <<EOF > $rootfs/etc/inittab +id:3:initdefault: +si::sysinit:/etc/init.d/rcS +l0:0:wait:/etc/init.d/rc 0 +l1:1:wait:/etc/init.d/rc 1 +l2:2:wait:/etc/init.d/rc 2 +l3:3:wait:/etc/init.d/rc 3 +l4:4:wait:/etc/init.d/rc 4 +l5:5:wait:/etc/init.d/rc 5 +l6:6:wait:/etc/init.d/rc 6 +# Normally not reached, but fallthrough in case of emergency. +z6:6:respawn:/sbin/sulogin +1:2345:respawn:/sbin/getty 38400 console +$(for tty in $(seq 1 "$num_tty"); do echo "c${tty}:12345:respawn:/sbin/getty 38400 tty${tty} linux" ; done;) +p6::ctrlaltdel:/sbin/init 6 +p0::powerfail:/sbin/init 0 +EOF + + # symlink mtab + [ -e "$rootfs/etc/mtab" ] && rm "$rootfs/etc/mtab" + ln -s /proc/self/mounts "$rootfs/etc/mtab" + + # disable selinux in Kali + mkdir -p "$rootfs/selinux" + echo 0 > "$rootfs/selinux/enforce" + + # configure the network using the dhcp + mkdir -p "$rootfs/etc/network" + cat <<EOF > $rootfs/etc/network/interfaces +auto lo +iface lo inet loopback + +auto eth0 +iface eth0 inet dhcp +EOF + + # set the hostname + cat <<EOF > $rootfs/etc/hostname +$hostname +EOF + + # Set default root password to toor + password="toor" + echo "root:$password" | chroot $rootfs chpasswd + echo "Root password is '$password', please change !" + + # reconfigure some services + + # but first reconfigure locales - so we get no noisy perl-warnings + if [ -z "$LANG" ]; then + cat >> "$rootfs/etc/locale.gen" << EOF +en_US.UTF-8 UTF-8 +EOF + chroot "$rootfs" locale-gen en_US.UTF-8 UTF-8 + chroot "$rootfs" update-locale LANG=en_US.UTF-8 + else + encoding=$(echo "$LANG" | cut -d. -f2) + chroot "$rootfs" sed -e "s/^# \(${LANG} ${encoding}\)/\1/" \ + -i /etc/locale.gen 2> /dev/null + cat >> "$rootfs/etc/locale.gen" << EOF +$LANG $encoding +EOF + chroot "$rootfs" locale-gen "$LANG" "$encoding" + chroot "$rootfs" update-locale LANG="$LANG" + fi + + # remove pointless services in a container + chroot "$rootfs" /usr/sbin/update-rc.d -f checkroot.sh disable + chroot "$rootfs" /usr/sbin/update-rc.d -f umountfs disable + chroot "$rootfs" /usr/sbin/update-rc.d -f hwclock.sh disable + chroot "$rootfs" /usr/sbin/update-rc.d -f hwclockfirst.sh disable + + # generate new SSH keys + if [ -x "$rootfs/var/lib/dpkg/info/openssh-server.postinst" ]; then + cat > "$rootfs/usr/sbin/policy-rc.d" << EOF +#!/bin/sh +exit 101 +EOF + chmod +x "$rootfs/usr/sbin/policy-rc.d" + + # Disable SSH on boot + #if [ -f "$rootfs/etc/init/ssh.conf" ]; then + # mv "$rootfs/etc/init/ssh.conf" "$rootfs/etc/init/ssh.conf.disabled" + #fi + + rm -f "$rootfs/etc/ssh/"ssh_host_*key* + + DPKG_MAINTSCRIPT_PACKAGE=openssh DPKG_MAINTSCRIPT_NAME=postinst chroot "$rootfs" /var/lib/dpkg/info/openssh-server.postinst configure + sed -i "s/root@$(hostname)/root@$hostname/g" "$rootfs/etc/ssh/"ssh_host_*.pub + + if [ -f "$rootfs/etc/init/ssh.conf.disabled" ]; then + mv "$rootfs/etc/init/ssh.conf.disabled" "$rootfs/etc/init/ssh.conf" + fi + + # Allow root login with password by default + sed -i -e "s/PermitRootLogin without-password/PermitRootLogin yes/" $rootfs/etc/ssh/sshd_config + sed -i -e 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' $rootfs/etc/ssh/sshd_config + + rm -f "$rootfs/usr/sbin/policy-rc.d" + fi + + # set initial timezone as on host + if [ -f /etc/timezone ]; then + cat /etc/timezone > "$rootfs/etc/timezone" + chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata + elif [ -f /etc/sysconfig/clock ]; then + . /etc/sysconfig/clock + echo "$ZONE" > "$rootfs/etc/timezone" + chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata + else + echo "Timezone in container is not configured. Adjust it manually." + fi + + if [ -n "$authkey" ]; then + local ssh_dir_path="${rootfs}/root/.ssh" + mkdir -p "$ssh_dir_path" + cp "$authkey" "${ssh_dir_path}/authorized_keys" + chmod 700 "$ssh_dir_path" + echo "Inserted SSH public key from '$authkey' into /root/.ssh/authorized_keys" + fi + + return 0 +} + +write_sourceslist() +{ + local rootfs="$1"; shift + local release="$1"; shift + local arch="$1"; shift + + local prefix="deb" + if [ -n "${arch}" ]; then + prefix="deb [arch=${arch}]" + fi + + cat >> "${rootfs}/etc/apt/sources.list" << EOF +deb http://http.kali.org/kali ${RELEASE} main contrib non-free +EOF +} + +install_packages() +{ + local rootfs="$1"; shift + local packages="$*" + + chroot "${rootfs}" apt-key adv --keyserver hkp://keys.gnupg.net --recv-keys 7D8D0BF6 + + chroot "${rootfs}" apt-get update + if [ -n "${packages}" ]; then + chroot "${rootfs}" apt-get install --force-yes -y --no-install-recommends ${packages} + fi +} + +configure_kali_systemd() +{ + path=$1 + rootfs=$2 + config=$3 + num_tty=$4 + + # this only works if we have [email protected] to manipulate + if [ -f "${rootfs}/lib/systemd/system/[email protected]" ]; then + sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \ + -e 's/After=dev-%i.device/After=/' \ + < "${rootfs}/lib/systemd/system/[email protected]" \ + > "${rootfs}/etc/systemd/system/[email protected]" + fi + + # just in case systemd is not installed + mkdir -p "${rootfs}/lib/systemd/system" + mkdir -p "${rootfs}/etc/systemd/system/getty.target.wants" + + # Fix getty-static-service as debootstrap does not install dbus + if [ -e "$rootfs//lib/systemd/system/getty-static.service" ] ; then + local tty_services + tty_services=$(for i in $(seq 2 "$num_tty"); do echo -n "getty@tty${i}.service "; done; ) + sed 's/ getty@tty.*/'" $tty_services "'/g' \ + "$rootfs/lib/systemd/system/getty-static.service" | \ + sed 's/\(tty2-tty\)[5-9]/\1'"${num_tty}"'/g' > "$rootfs/etc/systemd/system/getty-static.service" + fi + + # This function has been copied and adapted from lxc-fedora + rm -f "${rootfs}/etc/systemd/system/default.target" + chroot "${rootfs}" ln -s /dev/null /etc/systemd/system/udev.service + chroot "${rootfs}" ln -s /dev/null /etc/systemd/system/systemd-udevd.service + chroot "${rootfs}" ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target + # Setup getty service on the ttys we are going to allow in the + # default config. Number should match lxc.tty + ( cd "${rootfs}/etc/systemd/system/getty.target.wants" + for i in $(seq 1 "$num_tty") ; do ln -sf ../getty\@.service getty@tty"${i}".service; done ) + + # Since we use static-getty.target; we need to mask [email protected] generated by + # container-getty-generator, so we don't get multiple instances of agetty running. + # See https://github.com/lxc/lxc/issues/520 and https://github.com/lxc/lxc/issues/484 + ( cd "${rootfs}/etc/systemd/system/getty.target.wants" + for i in $(seq 0 "$num_tty"); do ln -sf /dev/null container-getty\@"${i}".service; done ) + + return 0 +} + +# Check if given path is in a btrfs partition +is_btrfs() +{ + [ -e "$1" -a "$(stat -f -c '%T' "$1")" = "btrfs" ] +} + +# Check if given path is the root of a btrfs subvolume +is_btrfs_subvolume() +{ + [ -d "$1" -a "$(stat -f -c '%T' "$1")" = "btrfs" -a "$(stat -c '%i' "$1")" -eq 256 ] +} + +try_mksubvolume() +{ + path=$1 + [ -d "$path" ] && return 0 + mkdir -p "$(dirname "$path")" + if which btrfs >/dev/null 2>&1 && is_btrfs "$(dirname "$path")"; then + btrfs subvolume create "$path" + else + mkdir -p "$path" + fi +} + +try_rmsubvolume() +{ + path=$1 + [ -d "$path" ] || return 0 + if which btrfs >/dev/null 2>&1 && is_btrfs_subvolume "$path"; then + btrfs subvolume delete "$path" + else + rm -rf "$path" + fi +} + +cleanup() +{ + try_rmsubvolume "$cache/partial-$RELEASE-$arch" + try_rmsubvolume "$cache/rootfs-$RELEASE-$arch" +} + +download_kali() +{ + packages=\ +init,\ +ifupdown,\ +locales,\ +dialog,\ +isc-dhcp-client,\ +netbase,\ +net-tools,\ +iproute,\ +openssh-server,\ +kali-archive-keyring,\ +kali-defaults,\ +kali-menu,\ +kali-root-login,\ +gnupg,\ +dirmngr,\ +sudo + + cache=$1 + arch=$2 + release=$3 + interpreter="$4" + interpreter_path="$5" + + trap cleanup EXIT SIGHUP SIGINT SIGTERM + + # Create the cache + mkdir -p "$cache" + + if [ ! -f "/usr/share/debootstrap/scripts/kali-rolling" ]; then + + # Use Kali debootstrap script + echo "Missing kali from debootstrap" + curl "http://git.kali.org/gitweb/?p=packages/debootstrap.git;a=blob_plain;f=scripts/kali;h=50d7ef5b4e9e905cc6da8655416cdf3ef559911e;hb=refs/heads/kali/master"; > /usr/share/debootstrap/scripts/kali + ln -s /usr/share/debootstrap/scripts/kali /usr/share/debootstrap/scripts/kali-rolling + fi + + # check the mini Kali was not already downloaded + try_mksubvolume "$cache/partial-$RELEASE-$arch" + if [ $? -ne 0 ]; then + echo "Failed to create '$cache/partial-$RELEASE-$arch' directory" + return 1 + fi + + # download a mini Kali into a cache + echo "Downloading Kali minimal ..." + if [ -n "$(which qemu-debootstrap)" ]; then + echo "Qemu-deboostrap" + qemu-debootstrap --verbose --variant=minbase --arch="$arch" \ + --include=$packages \ + "$RELEASE" "$cache/partial-$RELEASE-$arch" "$MIRROR" /usr/share/debootstrap/scripts/kali-rolling + if [ $? -ne 0 ]; then + echo "Failed to download the rootfs, aborting." + return 1 + fi + elif [ "$interpreter" = "" ]; then + debootstrap --foreign --verbose --variant=minbase --arch="$arch" \ + --include=$packages \ + "$RELEASE" "$cache/partial-$RELEASE-$arch" "$MIRROR" /usr/share/debootstrap/scripts/kali-rolling + if [ $? -ne 0 ]; then + echo "Failed to download the rootfs, aborting." + return 1 + fi + else + debootstrap --foreign --verbose --variant=minbase --arch="$arch" \ + --include=$packages \ + "$RELEASE" "$cache/partial-$RELEASE-$arch" "$MIRROR" /usr/share/debootstrap/scripts/kali-rolling + if [ $? -ne 0 ]; then + echo "Failed to download the rootfs, aborting." + return 1 + fi + mkdir -p "$(basename "$cache/partial-$RELEASE-$arch/$interpreter_path")" + cp "$interpreter" "$cache/partial-$RELEASE-$arch/$interpreter_path" + if [ $? -ne 0 ]; then + echo "failed to copy $interpreter to $cache/partial-$RELEASE-$arch/$interpreter_path" + return 1 + fi + chroot "$cache/partial-$RELEASE-$arch" debootstrap/debootstrap --second-stage + if [ $? -ne 0 ]; then + echo "failed to update the rootfs, aborting" + return 1 + fi + fi + + mv "$1/partial-$RELEASE-$arch" "$1/rootfs-$RELEASE-$arch" + echo "Download complete." + trap EXIT + trap SIGINT + trap SIGTERM + trap SIGHUP + + return 0 +} + +copy_kali() +{ + cache=$1 + arch=$2 + rootfs=$3 + + # make a local copy of the miniKali + echo -n "Copying rootfs to $rootfs..." + try_mksubvolume "$rootfs" + if which btrfs >/dev/null 2>&1 && \ + is_btrfs_subvolume "$cache/rootfs-$RELEASE-$arch" && \ + is_btrfs_subvolume "$rootfs"; then + realrootfs="$(dirname "$config")"/rootfs + [ "$rootfs" = "$realrootfs" ] || umount "$rootfs" || return 1 + btrfs subvolume delete "$realrootfs" || return 1 + btrfs subvolume snapshot "$cache/rootfs-$RELEASE-$arch" "$realrootfs" || return 1 + [ "$rootfs" = "$realrootfs" ] || mount --bind "$realrootfs" "$rootfs" || return 1 + else + rsync -Ha "$cache/rootfs-$RELEASE-$arch"/ "$rootfs"/ || return 1 + fi + return 0 +} + +install_kali() +{ + rootfs=$1 + release=$2 + arch=$3 + cache="$4/kali" + interpreter="$5" + interpreter_path="$6" + flushcache=$7 + mkdir -p $LOCALSTATEDIR/lock/subsys/ + ( + flock -x 9 + if [ $? -ne 0 ]; then + echo "Cache repository is busy." + return 1 + fi + + if [ "$flushcache" -eq 1 ]; then + echo "Flushing cache..." + cleanup + fi + + echo "Checking cache download in $cache/rootfs-$RELEASE-$arch ... " + if [ ! -e "$cache/rootfs-$RELEASE-$arch" ]; then + download_kali "$cache" "$arch" "$RELEASE" "$interpreter" "$interpreter_path" + if [ $? -ne 0 ]; then + echo "Failed to download 'Kali base'" + return 1 + fi + fi + + copy_kali "$cache" "$arch" "$rootfs" "$RELEASE" + if [ $? -ne 0 ]; then + echo "Failed to copy rootfs" + return 1 + fi + + return 0 + + ) 9>$LOCALSTATEDIR/lock/subsys/lxc-kali + + return $? +} + +copy_configuration() +{ + path=$1 + rootfs=$2 + hostname=$3 + arch=$4 + num_tty=$5 + + # Generate the configuration file + # if there is exactly one veth network entry, make sure it has an + # associated hwaddr. + nics=$(grep -ce '^lxc\.network\.type[ \t]*=[ \t]*veth' "$path/config") + if [ "$nics" -eq 1 ]; then + grep -q "^lxc.network.hwaddr" "$path/config" || sed -i -e "/^lxc\.network\.type[ \t]*=[ \t]*veth/a lxc.network.hwaddr = 00:16:3e:$(openssl rand -hex 3| sed 's/\(..\)/\1:/g; s/.$//')" "$path/config" + fi + + ## Add all the includes + echo "" >> "$path/config" + echo "# Common configuration" >> "$path/config" + if [ -e "${LXC_TEMPLATE_CONFIG}/kali.common.conf" ]; then + echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/kali.common.conf" >> "$path/config" + fi + if [ -e "${LXC_TEMPLATE_CONFIG}/kali.${RELEASE}.conf" ]; then + echo "lxc.include = ${LXC_TEMPLATE_CONFIG}/kali.${RELEASE}.conf" >> "$path/config" + fi + + ## Add the container-specific config + echo "" >> "$path/config" + echo "# Container specific configuration" >> "$path/config" + grep -q "^lxc.rootfs" "$path/config" 2> /dev/null || echo "lxc.rootfs = $rootfs" >> "$path/config" + + cat <<EOF >> $path/config +lxc.tty = $num_tty +lxc.utsname = $hostname +lxc.arch = $arch +lxc.pts=1023 +EOF + + if [ $? -ne 0 ]; then + echo "Failed to add configuration" + return 1 + fi + + return 0 +} + +post_process() +{ + local rootfs="$1"; shift + local arch="$1"; shift + local hostarch="$1"; shift + local interpreter="$1"; shift + local packages="$*" + + # Disable service startup + cat > "${rootfs}/usr/sbin/policy-rc.d" << EOF +#!/bin/sh +exit 101 +EOF + chmod +x "${rootfs}/usr/sbin/policy-rc.d" + + # If the container isn't running a native architecture, setup multiarch + if [ "$interpreter" = "" -a "${arch}" != "${hostarch}" ]; then + # Test if dpkg supports multiarch + if ! chroot "$rootfs" dpkg --print-foreign-architectures 2>&1; then + chroot "$rootfs" dpkg --add-architecture "${hostarch}" + fi + fi + + # Write a new sources.list containing both native and multiarch entries + > "${rootfs}/etc/apt/sources.list" + if [ "$interpreter" != "" -a "${arch}" = "${hostarch}" ]; then + write_sourceslist "${rootfs}" "${RELEASE}" "${arch}" + else + write_sourceslist "${rootfs}" "${RELEASE}" + fi + + # Install Packages in container + if [ -n "${packages}" ]; then + local pack_list + pack_list="${packages//,/ }" + echo "Installing packages: ${pack_list}" + install_packages "${rootfs}" "${pack_list}" + fi + + # Re-enable service startup + rm "${rootfs}/usr/sbin/policy-rc.d" + + # end +} + +clean() +{ + cache=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc/kali"} + + if [ ! -e "$cache" ]; then + exit 0 + fi + + # lock, so we won't purge while someone is creating a repository + ( + flock -x 9 + if [ $? != 0 ]; then + echo "Cache repository is busy." + exit 1 + fi + + echo -n "Purging the download cache..." + rm --preserve-root --one-file-system -rf "$cache" && echo "Done." || exit 1 + exit 0 + + ) 9>$LOCALSTATEDIR/lock/subsys/lxc-Kali +} + +usage() +{ + cat <<EOF +Template specific options can be passed to lxc-create after a '--' like this: + + lxc-create --name=NAME [-lxc-create-options] -- [-template-options] + +Usage: $1 -h|--help -p|--path=<path> [-c|--clean] [-a|--arch=<arch>] + [--mirror=<mirror>] + [--package=<package_name1,package_name2,...>] + [-I|--interpreter-path=<interpreter path>] + [-F | --flush-cache] [-S|--auth-key=<keyfile>] + +Options : + + -h, --help print this help text + -p, --path=PATH directory where config and rootfs of this VM will be kept + -S, --auth-key=KEYFILE SSH public key to inject into the container as the root user. + -a, --arch=ARCH The container architecture. Can be one of: i686, x86_64, + amd64, armhf, armel, powerpc. Defaults to host arch. + --mirror=MIRROR Kali mirror to use during installation. Overrides the MIRROR + environment variable (see below). + --packages=PACKAGE_NAME1,PACKAGE_NAME2,... + List of additional packages to install. Comma separated, without space. + -c, --clean only clean up the cache and terminate + -I|--interpreter-path=INTERPRETER-PATH + Path of the binfmt interpreter to copy to the rootfs + -F | --flush-cache Flush the Kali release cache + +Environment variables: + + MIRROR The Kali package mirror to use. See also the --mirror switch above. + Defaults to '$MIRROR' +EOF + return 0 +} +options=$(getopt -o hp:n:a:r:cI:F -l arch:,auth-key:,clean,help,mirror:,name:,packages:,path:,rootfs:,interpreter-path:,flush-cache -- "$@") +if [ $? -ne 0 ]; then + usage "$(basename "$0")" + exit 1 +fi +eval set -- "$options" + +littleendian=$(lscpu | grep '^Byte Order' | grep -q Little && echo yes) + +arch=$(uname -m) +if [ "$arch" = "i686" ]; then + arch="i386" +elif [ "$arch" = "x86_64" ]; then + arch="amd64" +elif [ "$arch" = "armv7l" ]; then + arch="armhf" +elif [ "$arch" = "mips" -a "$littleendian" = "yes" ]; then + arch="mipsel" +elif [ "$arch" = "mips64" -a "$littleendian" = "yes" ]; then + arch="mips64el" +fi +hostarch=$arch +mainonly=1 +flushcache=0 + +while true +do + case "$1" in + -h|--help) usage "$0" && exit 1;; + --) shift 1; break ;; + + -a|--arch) arch=$2; shift 2;; + -S|--auth-key) authkey=$2; shift 2;; + -I|--interpreter-path) + interpreter="$2"; shift 2;; + -c|--clean) clean=1; shift 1;; + --mirror) MIRROR=$2; shift 2;; + -n|--name) name=$2; shift 2;; + --packages) packages=$2; shift 2;; + -p|--path) path=$2; shift 2;; + -r|--release) release=$2; shift 2;; + --rootfs) rootfs=$2; shift 2;; + -F|--flush-cache) flushcache=1; shift 1;; + *) break ;; + esac +done + +if [ ! -z "$clean" -a -z "$path" ]; then + clean || exit 1 + exit 0 +fi + +if [ "$arch" = "i686" ]; then + arch=i386 +fi + +if [ "$arch" = "x86_64" ]; then + arch=amd64 +fi + +if [ "$interpreter" = "" ] ; then + if [ $hostarch = "i386" -a $arch = "amd64" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "armhf" -o $hostarch = "armel" ] && \ + [ $arch != "armhf" -a $arch != "armel" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "powerpc" -a $arch != "powerpc" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi + + if [ $hostarch = "mips" -a $arch != "mips" ] || \ + [ $hostarch = "mipsel" -a $arch != "mipsel" ] || \ + [ $hostarch = "mips64" -a $arch != "mips" -a $arch != "mips64" ] || \ + [ $hostarch = "mips64el" -a $arch != "mipsel" -a $arch != "mips64el" ]; then + echo "can't create $arch container on $hostarch" + exit 1 + fi +else + if ! file -b "${interpreter}" |grep -q "statically linked" ; then + echo "'${interpreter}' must be statically linked" 1>&2 + exit 1 + fi + interpreter_path=$(find_interpreter "$interpreter") + if [ $? -ne 0 ] ; then + echo "no binfmt interpreter using $(basename "$interpreter")" 1>&2 + exit 1 + fi +fi + +type debootstrap +if [ $? -ne 0 ]; then + echo "'debootstrap' command is missing" + exit 1 +fi + +if [ -z "$path" ]; then + echo "'path' parameter is required" + exit 1 +fi + +if [ "$(id -u)" != "0" ]; then + echo "This script should be run as 'root'" + exit 1 +fi + +if [ -n "$authkey" ]; then + if [ ! -f "$authkey" ]; then + echo "SSH keyfile '$authkey' not found" + exit 1 + fi + # This is mostly to prevent accidental uage of the private key instead + # of the public key. + if [ "${authkey: -4}" != ".pub" ]; then + echo "SSH keyfile '$authkey' does not end with '.pub'" + exit 1 + fi +fi + +# Release file is located in dists. +# Only one valid release at a time. e.g.: http://repo.kali.org/kali/dists/kali-rolling/Release +current_release=`wget ${MIRROR}/dists/kali-rolling/Release -O - 2> /dev/null | head |awk '/^Codename: (.*)$/ { print $2; }'` +release=${release:-${current_release}} +valid_releases=('kali-rolling' 'kali-bleeding-edge') +if [[ ! "${valid_releases[*]}" =~ (^|[^[:alpha:]])$release([^[:alpha:]]|$) ]]; then + echo "Invalid release ${release}, valid ones are: ${valid_releases[*]}" + exit 1 +fi + +# detect rootfs +config="$path/config" +if [ -z "$rootfs" ]; then + if grep -q '^lxc.rootfs' "$config" 2> /dev/null ; then + rootfs=$(awk -F= '/^lxc.rootfs[ \t]+=/{ print $2 }' "$config") + else + rootfs=$path/rootfs + fi +fi + +# determine the number of ttys - default is 4 +if grep -q '^lxc.tty' "$config" 2> /dev/null ; then + num_tty=$(awk -F= '/^lxc.tty[ \t]+=/{ print $2 }' "$config") +else + num_tty=4 +fi + +install_kali "$rootfs" "$RELEASE" "$arch" "$LXC_CACHE_PATH" "$interpreter" "$interpreter_path" "$flushcache" +if [ $? -ne 0 ]; then + echo "failed to install Kali" + exit 1 +fi + +configure_kali "$rootfs" "$name" $num_tty +if [ $? -ne 0 ]; then + echo "failed to configure Kali for a container" + exit 1 +fi + +copy_configuration "$path" "$rootfs" "$name" $arch $num_tty +if [ $? -ne 0 ]; then + echo "failed write configuration file" + exit 1 +fi + +configure_kali_systemd "$path" "$rootfs" "$config" $num_tty + +post_process "${rootfs}" "${RELEASE}" ${arch} ${hostarch} "${interpreter}" "${packages}" + +if [ ! -z "$clean" ]; then + clean || exit 1 + exit 0 +fi
_______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
