summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@open-infrastructure.net>2017-04-03 09:57:55 +0000
committerDaniel Baumann <daniel.baumann@open-infrastructure.net>2017-04-03 10:09:14 +0000
commit622fe63eb37f957ee5c29684e24f1d2d636fd086 (patch)
treea676a1cd790b291222041918fad77bd59f381a16
parentAllowing multiple container commands to be executed in a row. (diff)
downloadcompute-tools-622fe63eb37f957ee5c29684e24f1d2d636fd086.tar.xz
compute-tools-622fe63eb37f957ee5c29684e24f1d2d636fd086.zip
Adding support for bind-ro nspawn option for read-only bind mounts.
Signed-off-by: Daniel Baumann <daniel.baumann@open-infrastructure.net>
-rwxr-xr-xlib/container/create24
-rwxr-xr-xlib/container/move29
-rwxr-xr-xlib/container/remove17
-rwxr-xr-xlib/container/start23
-rwxr-xr-xlib/container/stop17
-rw-r--r--share/bash-completion/container2
-rw-r--r--share/config/container.conf.in1
-rw-r--r--share/doc/examples/dschinn-backports.cfg1
-rw-r--r--share/man/container-create.1.txt5
-rwxr-xr-xshare/scripts/curl7
-rwxr-xr-xshare/scripts/debconf42
-rwxr-xr-xshare/scripts/debootstrap7
12 files changed, 161 insertions, 14 deletions
diff --git a/lib/container/create b/lib/container/create
index 54cbb1d..b4fc5e9 100755
--- a/lib/container/create
+++ b/lib/container/create
@@ -27,7 +27,7 @@ SCRIPTS="/usr/share/container-tools/scripts"
Parameters ()
{
- GETOPT_LONGOPTIONS="name:,cnt.auto:,cnt.overlay:,bind:,capability:,drop-capability:script:,"
+ GETOPT_LONGOPTIONS="name:,cnt.auto:,cnt.overlay:,bind:,bind-ro:,capability:,drop-capability:script:,"
GETOPT_OPTIONS="n:,b:,c:,d:,s:,"
PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${COMMAND} --options ${GETOPT_OPTIONS} --shell sh -- ${@})"
@@ -63,6 +63,11 @@ Parameters ()
shift 2
;;
+ --bind-ro)
+ BIND_RO="${2}"
+ shift 2
+ ;;
+
-c|--capability)
CAPABILITY="${2}"
shift 2
@@ -93,7 +98,7 @@ Parameters ()
Usage ()
{
- echo "Usage: container ${COMMAND} -n|--name NAME [--cnt.auto=true|false|FQDN] [--cnt.overlay=DIRECTORY_LOWER:DIRECTORY_UPPER:DIRECTORY_WORK:DIRECTORY_MERGED] [-b|--bind DIRECTORY:DIRECTORY[:OPTIONS]] [-c|--capability CAPABILITY[,CAPABILITY]] [-d|--drop-capability DROP_CAPABILITY[,DROP_CAPABILITY]] [-s|--script SCRIPT] [-- SCRIPT_OPTIONS]" >&2
+ echo "Usage: container ${COMMAND} -n|--name NAME [--cnt.auto=true|false|FQDN] [--cnt.overlay=DIRECTORY_LOWER:DIRECTORY_UPPER:DIRECTORY_WORK:DIRECTORY_MERGED] [-b|--bind DIRECTORY:DIRECTORY[:OPTIONS]] [--bind-ro DIRECTORY:DIRECTORY[:OPTIONS]] [-c|--capability CAPABILITY[,CAPABILITY]] [-d|--drop-capability DROP_CAPABILITY[,DROP_CAPABILITY]] [-s|--script SCRIPT] [-- SCRIPT_OPTIONS]" >&2
exit 1
}
@@ -151,7 +156,7 @@ do
fi
done
-# Creating bind mounts
+# Creating rw bind mounts
if [ -n "${BIND}" ]
then
BINDS="$(echo ${BIND} | sed -e 's|;| |g')"
@@ -164,6 +169,19 @@ then
done
fi
+# Creating ro bind mounts
+if [ -n "${BIND_RO}" ]
+then
+ BINDS="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for BIND_RO in ${BINDS_RO}
+ do
+ DIRECTORY="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"
+
+ mkdir -p "${DIRECTORY}"
+ done
+fi
+
# Creating overlay mounts
if [ -n "${CNT_OVERLAY}" ]
then
diff --git a/lib/container/move b/lib/container/move
index 78b0c7f..4d64c8a 100755
--- a/lib/container/move
+++ b/lib/container/move
@@ -141,7 +141,7 @@ done
mv "${CONFIG}/${OLD}.conf" "${CONFIG}/${NEW}.conf"
mv "${MACHINES}/${OLD}" "${MACHINES}/${NEW}"
-# bind mounts
+# rw bind mounts
BIND="$(awk -F= '/^bind=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
if [ -n "${BIND}" ]
@@ -168,6 +168,33 @@ then
done
fi
+# ro bind mounts
+BIND_RO="$(awk -F= '/^bind-ro=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
+
+if [ -n "${BIND_RO}" ]
+then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for BIND_RO in ${BINDS_RO}
+ do
+ SOURCE_OLD="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"
+ SOURCE_NEW="$(echo ${SOURCE_OLD} | sed -e "s|${OLD}|${NEW}|g")"
+
+ if [ "${SOURCE_OLD}" != "${SOURCE_NEW}" ]
+ then
+ mv "${SOURCE_OLD}" "${SOURCE_NEW}"
+ fi
+
+ TARGET_OLD="$(echo ${BIND_RO} | awk -F: '{ print $2 }')"
+ TARGET_NEW="$(echo ${TARGET_OLD} | sed -e "s|${OLD}|${NEW}|g")"
+
+ if [ "${TARGET_OLD}" != "${TARGET_NEW}" ]
+ then
+ mv "${MACHINES}/${NEW}/${TARGET_OLD}" "${MACHINES}/${NEW}/${TARGET_NEW}"
+ fi
+ done
+fi
+
# config
sed -i -e "s|${OLD}|${NEW}|g" "${CONFIG}/${NEW}.conf"
diff --git a/lib/container/remove b/lib/container/remove
index 03549a4..1b1ba7d 100755
--- a/lib/container/remove
+++ b/lib/container/remove
@@ -141,7 +141,7 @@ done
# data
if [ -e "${CONFIG}/${NAME}.conf" ]
then
- # Removing bind mounts
+ # Removing rw bind mounts
BIND="$(awk -F= '/^bind=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
if [ -n "${BIND}" ]
@@ -155,6 +155,21 @@ then
rmdir --ignore-fail-on-non-empty --parents ${DIRECTORY} > /dev/null 2>&1 || true
done
fi
+
+ # Removing ro bind mounts
+ BIND_RO="$(awk -F= '/^bind-ro=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
+
+ if [ -n "${BIND_RO}" ]
+ then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for BIND_RO in ${BINDS_RO}
+ do
+ DIRECTORY="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"
+
+ rmdir --ignore-fail-on-non-empty --parents ${DIRECTORY} > /dev/null 2>&1 || true
+ done
+ fi
fi
# Run
diff --git a/lib/container/start b/lib/container/start
index 0009fd0..014e859 100755
--- a/lib/container/start
+++ b/lib/container/start
@@ -221,6 +221,27 @@ then
done
fi
+ BIND_RO="$(awk -F= '/^bind-ro=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
+
+ if [ -n "${BIND_RO}" ]
+ then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for BIND_RO in ${BINDS_RO}
+ do
+ DIRECTORY="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"
+
+ mkdir -p "${DIRECTORY}"
+ done
+
+ BIND_RO=""
+
+ for DIRECTORIES in ${BINDS_RO}
+ do
+ BIND_RO="${BIND_RO} --bind ${DIRECTORIES}"
+ done
+ fi
+
BOOT="$(awk -F= '/^boot=/ { print $2 }' ${CONFIG}/${NAME}.conf || echo yes)"
case "${BOOT}" in
@@ -437,7 +458,7 @@ case "${START}" in
*)
# Run
- ${SETARCH} systemd-nspawn --keep-unit ${BIND} ${BOOT} ${CAPABILITY} ${DIRECTORY} ${DROP_CAPABILITY} ${MACHINE} ${NETWORK_VETH_EXTRA} ${LINK_JOURNAL} ${REGISTER}
+ ${SETARCH} systemd-nspawn --keep-unit ${BIND} ${BIND_RO} ${BOOT} ${CAPABILITY} ${DIRECTORY} ${DROP_CAPABILITY} ${MACHINE} ${NETWORK_VETH_EXTRA} ${LINK_JOURNAL} ${REGISTER}
# Post hooks
for FILE in "${HOOKS}/post-${COMMAND}".* "${HOOKS}/${NAME}.post-${COMMAND}"
diff --git a/lib/container/stop b/lib/container/stop
index b8793ac..359a136 100755
--- a/lib/container/stop
+++ b/lib/container/stop
@@ -127,7 +127,7 @@ case "${CLEAN}" in
done
fi
- # Removing bind mounts
+ # Removing rw bind mounts
BIND="$(awk -F= '/^bind=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
if [ -n "${BIND}" ]
@@ -142,6 +142,21 @@ case "${CLEAN}" in
done
fi
+ # Removing ro bind mounts
+ BIND_RO="$(awk -F= '/^bind-ro=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
+
+ if [ -n "${BIND_RO}" ]
+ then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for BIND_RO in ${BINDS_RO}
+ do
+ DIRECTORY="$(echo ${BIND_RO} | awk -F: '{ print $1 }')"
+
+ rmdir --ignore-fail-on-non-empty --parents ${DIRECTORY} > /dev/null 2>&1 || true
+ done
+ fi
+
# Removing network configuration
NETWORK_VETH_EXTRA_CONF="$(awk -F= '/^network-veth-extra=/ { print $2 }' ${CONFIG}/${NAME}.conf)"
diff --git a/share/bash-completion/container b/share/bash-completion/container
index 0bc22c0..3995a16 100644
--- a/share/bash-completion/container
+++ b/share/bash-completion/container
@@ -73,7 +73,7 @@ _container()
;;
*)
- opts="-n --name -c --capability -d --drop-capability -s --script -b --bind"
+ opts="-n --name -c --capability -d --drop-capability -s --script -b --bind --bind-ro"
COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
return 0
;;
diff --git a/share/config/container.conf.in b/share/config/container.conf.in
index b5678c0..bf1ecc5 100644
--- a/share/config/container.conf.in
+++ b/share/config/container.conf.in
@@ -5,6 +5,7 @@ cnt.auto=@CNT_AUTO@
cnt.network-bridge=@CNT_NETWORK_BRIDGE@
cnt.overlay=@CNT_OVERLAY@
bind=@BIND@
+bind-ro=@BIND_RO@
boot=@BOOT@
capability=@CAPABILITY@
directory=@DIRECTORY@
diff --git a/share/doc/examples/dschinn-backports.cfg b/share/doc/examples/dschinn-backports.cfg
index 75296dc..1cddcf2 100644
--- a/share/doc/examples/dschinn-backports.cfg
+++ b/share/doc/examples/dschinn-backports.cfg
@@ -64,3 +64,4 @@ container-tools cnt-debconf/nameserver/options string timeout:1 attempts:1
container-tools cnt-debconf/auto string FQDN
#container-tools cnt-debconf/overlay string
#container-tools cnt-debconf/bind string
+#container-tools cnt-debconf/bind-ro string
diff --git a/share/man/container-create.1.txt b/share/man/container-create.1.txt
index a45c1f2..22f9c8e 100644
--- a/share/man/container-create.1.txt
+++ b/share/man/container-create.1.txt
@@ -54,7 +54,10 @@ The following container-create options are available:
Specify container creation script, defaults to debootstrap.
*-b, --bind='DIRECTORY:DIRECTORY[:OPTIONS][;DIRECTORY:DIRECTORY[:OPTIONS]]'*::
- Specify container bind mounts, see systemd-nspawn(1) --bind option.
+ Specify container read-write bind mounts, see systemd-nspawn(1) --bind option.
+
+*--bind-ro='DIRECTORY:DIRECTORY[:OPTIONS][;DIRECTORY:DIRECTORY[:OPTIONS]]'*::
+ Specify container read-only bind mounts, see systemd-nspawn(1) --bind-ro option.
*--cnt-overlay='DIRECTORY_LOWER:DIRECTORY_UPPER:DIRECTORY_WORK:DIRECTORY_MERGED[;DIRECTORY_UPPER:DIRECTORY_LOWER:DIRECTORY_WORK:DIRECTORY_MERGED]'*::
Specify container overlay mounts, see Documentation/filesystems/overlayfs.txt.
diff --git a/share/scripts/curl b/share/scripts/curl
index 67691e3..18d49c0 100755
--- a/share/scripts/curl
+++ b/share/scripts/curl
@@ -26,7 +26,7 @@ CACHE="/var/cache/container-tools/images"
Parameters ()
{
- GETOPT_LONGOPTIONS="bind:,script:,name:,clean,image:,server:,password:"
+ GETOPT_LONGOPTIONS="bind:,bind-ro:,script:,name:,clean,image:,server:,password:"
GETOPT_OPTIONS="b:,s:,n:,p:"
PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${SCRIPT} --options ${GETOPT_OPTIONS} --shell sh -- ${@})"
@@ -47,6 +47,11 @@ Parameters ()
shift 2
;;
+ --bind-ro)
+ # ignore
+ shift 2
+ ;;
+
--cnt.auto)
# ignore
shift 2
diff --git a/share/scripts/debconf b/share/scripts/debconf
index 6d0410a..df9241c 100755
--- a/share/scripts/debconf
+++ b/share/scripts/debconf
@@ -26,7 +26,7 @@ MACHINES="/var/lib/machines"
Parameters ()
{
- GETOPT_LONGOPTIONS="bind:,script:,name:,preseed-file:"
+ GETOPT_LONGOPTIONS="bind:,bind-ro:,script:,name:,preseed-file:"
GETOPT_OPTIONS="b:,s:,n:,p:"
PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${SCRIPT} --options ${GETOPT_OPTIONS} --shell sh -- ${@})"
@@ -47,6 +47,11 @@ Parameters ()
shift 2
;;
+ --bind-ro)
+ # ignore
+ shift 2
+ ;;
+
--cnt.auto)
# ignore
shift 2
@@ -911,6 +916,7 @@ Commands ()
sed -i -e "s|^cnt.network-bridge=.*|cnt.network-bridge=${HOST_INTERFACE_NAME}:${NETWORK0_BRIDGE:-br0}|g" "${CONFIG}/${NAME}.conf"
sed -i -e "s|^cnt.overlay=.*|cnt.overlay=${CNT_OVERLAY}|g" "${CONFIG}/${NAME}.conf"
sed -i -e "s|^bind=.*|bind=${BIND}|" "${CONFIG}/${NAME}.conf"
+ sed -i -e "s|^bind-ro=.*|bind-ro=${BIND_RO}|" "${CONFIG}/${NAME}.conf"
sed -i -e "s|^network-veth-extra=.*|network-veth-extra=${HOST_INTERFACE_NAME}:eth0|g" "${CONFIG}/${NAME}.conf"
for NUMBER in $(seq 1 ${NETWORK_NUMBER})
@@ -1003,7 +1009,7 @@ Cleanup_system "${CACHE}/${DISTRIBUTION}_${ARCHITECTURE}"
mkdir -p "${MACHINES}"
cp -a "${CACHE}/${DISTRIBUTION}_${ARCHITECTURE}" "${MACHINES}/${NAME}"
-# Mounting bind mounts
+# Mounting rw bind mounts
if [ -n "${BIND}" ]
then
BINDS="$(echo ${BIND} | sed -e 's|;| |g')"
@@ -1020,6 +1026,23 @@ then
done
fi
+# Mounting ro bind mounts
+if [ -n "${BIND_RO}" ]
+then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for ENTRY in ${BINDS_RO}
+ do
+ SOURCE="$(echo ${ENTRY} | awk -F: '{ print $1 }')"
+ TARGET="$(echo ${ENTRY} | awk -F: '{ print $2 }')"
+
+ mkdir -p "${SOURCE}"
+ mkdir -p "${MACHINES}/${NAME}/${TARGET}"
+
+ mount -o rbind "${SOURCE}" "${MACHINES}/${NAME}/${TARGET}"
+ done
+fi
+
# Mounting overlay mounts
if [ -n "${CNT_OVERLAY}" ]
then
@@ -1069,7 +1092,20 @@ then
done
fi
-# Unmounting bind mounts
+# Unmounting ro bind mounts
+if [ -n "${BIND_RO}" ]
+then
+ BINDS_RO="$(echo ${BIND_RO} | sed -e 's|;| |g')"
+
+ for ENTRY in ${BINDS_RO}
+ do
+ TARGET="$(echo ${ENTRY} | awk -F: '{ print $2 }')"
+
+ umount "${MACHINES}/${NAME}/${TARGET}"
+ done
+fi
+
+# Unmounting rw bind mounts
if [ -n "${BIND}" ]
then
BINDS="$(echo ${BIND} | sed -e 's|;| |g')"
diff --git a/share/scripts/debootstrap b/share/scripts/debootstrap
index ecf167c..79a3193 100755
--- a/share/scripts/debootstrap
+++ b/share/scripts/debootstrap
@@ -25,7 +25,7 @@ MACHINES="/var/lib/machines"
Parameters ()
{
- GETOPT_LONGOPTIONS="bind:,script:,name:,architecture:,distribution:,mirror:,password:"
+ GETOPT_LONGOPTIONS="bind:,bind-ro:,script:,name:,architecture:,distribution:,mirror:,password:"
GETOPT_OPTIONS="b:,s:,n:,a:,d:,m:,p:"
PARAMETERS="$(getopt --longoptions ${GETOPT_LONGOPTIONS} --name=${SCRIPT} --options ${GETOPT_OPTIONS} --shell sh -- ${@})"
@@ -46,6 +46,11 @@ Parameters ()
shift 2
;;
+ --bind-ro)
+ # ignore
+ shift 2
+ ;;
+
--cnt.auto)
# ignore
shift 2