Use a specific script to set the capabilities

Instead of having the capabilities to be set automatically,
it will be up to the user to set them through a specific
script 'lxc-setcap'.

After installing the lxc tools, if we want them to be available,
for a non-root user, lxc-setcap will set the needed capabilities.
If, after thinking it, we want to remove the capabilities,
the 'lxc-setcap -d' will do this for us.

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
Acked-by: Guido Trotter <ultrotter@google.com>

diff --git a/.gitignore b/.gitignore
index a61d6102b6294e300fc2c7330cd81d01b311ea0d..3c9c0b428f6a3fe56faed9ef4a80080fc8b05312 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -43,6 +43,7 @@ src/lxc/lxc-init
 src/lxc/lxc-ls
 src/lxc/lxc-monitor
 src/lxc/lxc-netstat
+src/lxc/lxc-setcap
 src/lxc/lxc-ps
 src/lxc/lxc-restart
 src/lxc/lxc-start

diff --git a/configure.in b/configure.in
index fa94008b6d1995bb9d7d5386dd35b336dd85cd4c..0cc2f6e11f2c43e2556575f8f6e2067b1e97061e 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -96,7 +96,8 @@ AC_CONFIG_FILES([
        src/lxc/lxc-ps
        src/lxc/lxc-ls
        src/lxc/lxc-netstat
-       src/lxc/lxc-checkconfig 
+       src/lxc/lxc-checkconfig
+       src/lxc/lxc-setcap
 
        etc/Makefile
        etc/lxc-macvlan.conf
@@ -142,12 +143,10 @@ else
 Advice:
 -------
 
-When installing the tools, it is adviced to install as
-root, so the privilege for the commands will be set and
-they will be usable by non-root user
-
-    make && sudo make install
-
+If you which to have a non root user to use the lxc tools,
+you can add the needed capabilities to the tools by invoking
+the 'lxc-setcap' script. To remove the capabilities, use
+'lxc-setcap -d'
 ])
 
 fi

diff --git a/lxc.spec.in b/lxc.spec.in
index 86832d1f138b2fecccadb9a496cfcfa937298333..eb3829b60ac2c185e3700d68c5ecaa21a5079c46 100644 (file)
--- a/lxc.spec.in
+++ b/lxc.spec.in
@@ -71,29 +71,12 @@ rm -rf %{buildroot}
 mkdir -p /var/lxc
 chmod ugo+w /var/lxc
 
-setcap cap_sys_admin=ep %{_bindir}/lxc-init
-
-setcap cap_sys_admin=ep %{_bindir}/lxc-netstat
-
-setcap cap_sys_admin=ep %{_bindir}/lxc-create
-
-setcap cap_sys_chroot,cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-    %{_bindir}/lxc-execute
-
-setcap cap_sys_chroot,cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-    %{_bindir}/lxc-start
-
-setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-    %{_bindir}/lxc-restart
-
-setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-    %{_bindir}/lxc-unshare
-
 %files
 %defattr(-,root,root)
 %{_sysconfdir}/%{name}/*
 %{_libdir}/*.so*
 %{_bindir}/*
+%{_libexecdir}/*
 %{_mandir}/*
 
 %files devel
@@ -104,6 +87,9 @@ setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
 
 %changelog
 
+* Mon Mar 24 2009 Daniel Lezcano <daniel.lezcano@free.fr> - Version 0.6.1
+- Removed capability setting, let the user to do that through "lxc-setcap"
+
 * Mon Feb 16 2009 Daniel Lezcano <daniel.lezcano@free.fr> - Version 0.6.0
 - Added more capabilities to the executables
 

diff --git a/src/lxc/Makefile.am b/src/lxc/Makefile.am
index 28b7ac4b48f54e8fa93c37b427addeb892bf1d7b..1c13c856a17e48cf62cb6bc91f4587d3fc14df77 100644 (file)
--- a/src/lxc/Makefile.am
+++ b/src/lxc/Makefile.am
@@ -54,7 +54,8 @@ bin_SCRIPTS = \
        lxc-ps \
        lxc-netstat \
        lxc-ls \
-       lxc-checkconfig
+       lxc-checkconfig \
+       lxc-setcap
 
 bin_PROGRAMS = \
        lxc-unshare \
@@ -128,38 +129,6 @@ lxc_restart_LDADD = liblxc.la
 lxc_version_SOURCES = lxc_version.c
 lxc_version_LDADD = liblxc.la
 
-install-libexecPROGRAMS:
-        setcap cap_sys_admin=ep $(libexecdir)/lxc-init
-
 install-exec-local:
-       -@export PATH=$$PATH:/sbin:/usr/sbin && \
-        mkdir -p $(localstatedir) && \
-               \
-        setcap cap_sys_admin=ep $(bindir)/lxc-create && \
-               \
-        setcap cap_sys_chroot,cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-               $(bindir)/lxc-execute && \
-               \
-        setcap cap_sys_chroot,cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-               $(bindir)/lxc-start && \
-               \
-        setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-               $(bindir)/lxc-restart && \
-               \
-        setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep \
-               $(bindir)/lxc-unshare && \
-               \
-        setcap cap_sys_admin=ep \
-               $(bindir)/lxc-netstat && \
-               \
-        mkdir -p $(prefix)/var/lxc && \
-        chmod ugo+rw $(prefix)/var/lxc || \
-       (echo && echo && \
-        echo "*****************************************************************" && \
-        echo "*                                                               *" && \
-        echo "* The installation failed to set file capabilities, that is ok, *" && \
-        echo "* but you won't have enough privilege to run the 'lxc' commands *" && \
-        echo "* and you will need to run them as 'root' yourself.             *" && \
-        echo "*                                                               *" && \
-        echo "*****************************************************************" && \
-        echo && echo)
+       @mkdir -p $(localstatedir) && mkdir -p $(prefix)/var/lxc && \
+       chmod ugo+rw $(prefix)/var/lxc

diff --git a/src/lxc/lxc-setcap.in b/src/lxc/lxc-setcap.in
new file mode 100644 (file)
index 0000000..df903ba
--- /dev/null
+++ b/src/lxc/lxc-setcap.in
@@ -0,0 +1,103 @@
+#!/bin/bash
+
+#
+# lxc: linux Container library
+
+# Authors:
+# Daniel Lezcano <daniel.lezcano@free.fr>
+
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+
+#
+# This script allows to set or remove the capabilities on the lxc tools.
+# When the capabilities are set, a non root user can manage the containers.
+#
+
+LXC_CREATE_CAPS="cap_sys_admin"
+LXC_NETSTAT_CAPS="cap_sys_admin"
+LXC_INIT_CAPS="cap_sys_admin"
+LXC_UNSHARE_CAPS="cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override"
+LXC_START_CAPS="cap_sys_chroot,cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override"
+LXC_EXECUTE_CAPS=$LXC_START_CAPS
+LXC_RESTART_CAPS=$LXC_START_CAPS
+
+LXC_DROP_CAPS=""
+
+usage()
+{
+    echo "lxc-setcap [-d] : set or remove capabilities on the lxc tools"
+}
+
+lxc_setcaps()
+{
+    setcap $LXC_CREATE_CAPS=ep @BINDIR@/lxc-create
+    setcap $LXC_EXECUTE_CAPS=ep @BINDIR@/lxc-execute
+    setcap $LXC_START_CAPS=ep @BINDIR@/lxc-start
+    setcap $LXC_RESTART_CAPS=ep @BINDIR@/lxc-restart
+    setcap $LXC_UNSHARE_CAPS=ep @BINDIR@/lxc-unshare
+    setcap $LXC_NETSTAT_CAPS=ep @BINDIR@/lxc-netstat
+    setcap $LXC_INIT_CAPS=ep @LIBEXECDIR@/lxc-init
+}
+
+lxc_dropcaps()
+{
+    setcap -r @BINDIR@/lxc-create
+    setcap -r @BINDIR@/lxc-execute
+    setcap -r @BINDIR@/lxc-start
+    setcap -r @BINDIR@/lxc-restart
+    setcap -r @BINDIR@/lxc-unshare
+    setcap -r @BINDIR@/lxc-netstat
+    setcap -r @LIBEXECDIR@/lxc-init
+}
+
+if [ "$(id -u)" != "0" ]; then
+    echo "You have to be root to run this script"
+    exit 1
+fi
+
+
+if [ $? != 0 ]; then
+    usage
+    exit 1
+fi
+
+set -- $(getopt dh $*)
+
+for i in $*; do
+    case "$1" in
+       -d)
+           LXC_DROP_CAPS="yes"
+           shift
+           ;;
+       -h)
+           usage
+           exit 0
+           ;;
+       --)
+           shift
+           break
+           ;;
+       *)
+           usage
+           exit 1
+           ;;
+    esac
+done;
+
+if [ -z "$LXC_DROP_CAPS" ]; then
+    lxc_setcaps
+else
+    lxc_dropcaps
+fi