From: Enrico Scholz Date: Tue, 13 Jan 2004 23:18:05 +0000 (+0000) Subject: initial checkin (moved from ../) X-Git-Tag: VERSION_0_10~952 X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33943e4d3dcc3ae3f3b2634fac0de0920109cd22;p=util-vserver.git initial checkin (moved from ../) git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@575 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- diff --git a/util-vserver/scripts/legacy/save_s_context b/util-vserver/scripts/legacy/save_s_context new file mode 100755 index 0000000..535c14e --- /dev/null +++ b/util-vserver/scripts/legacy/save_s_context @@ -0,0 +1,32 @@ +#!/bin/sh + +# Copyright (C) 2003 Enrico Scholz +# based on save_s_context by Jacques Gelinas +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +if [ $# -lt 1 ] ;then + echo save_s_context file command + echo Save the security context in file and execute a command +else + CTX=`grep ^s_context: /proc/self/status | sed s/s_context:// | (read a b; echo $a)` + CTX=`eval expr $CTX + 0` + echo S_CONTEXT=$CTX >$1 + echo S_PROFILE=$PROFILE >>$1 + shift + exec "$@" +fi + + diff --git a/util-vserver/scripts/legacy/vps.pathsubst b/util-vserver/scripts/legacy/vps.pathsubst new file mode 100755 index 0000000..ea32a37 --- /dev/null +++ b/util-vserver/scripts/legacy/vps.pathsubst @@ -0,0 +1,125 @@ +#!/usr/bin/perl + +# Copyright (C) 2003 Enrico Scholz +# based on vps by Krischan Jodies +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +# Wrapper for ps. Adds security context number and name +# to the PID column. +# +# (c) 2002 krischan.jodies@sernet.de +# version 1.0 + +# 1.1 Added error messages + +if ($ARGV[0] eq "--help") { + exec("ps @ARGV"); + exit; +} + + +$lockdir = "/var/run/vservers"; + +$pid_length = 5; +get_server_names(); +$context=get_context("self"); + +if ($context == -1) { + print "Can not find my security context. Is this a ctx kernel?\n"; + exit; +} +if ($context != 1) { + exec("@SBINDIR@/chcontext --silent --ctx 1 $0 @ARGV"); + print "Can not execute chcontext\n"; + exit; # not reached +} + + +if (! open PS, "ps @ARGV|") { + print "Can not execute ps\n"; + exit; +} +while () { + chomp; + push @ps,$_; +} + +$header = shift @ps; +$header =~ /(.*) PID(.+)/; +$left = $1; +$right = $2; +$left_length = length($left); +print "${left} PID CONTEXT ${right}\n"; +foreach $line (@ps) { + $pid = substr $line,$left_length,$pid_length; + print substr $line,0,$left_length; + print "$pid"; + $context = get_context($pid); + $context_name = getcontextname($context); + printf " %-3s %-10s",$context,$context_name; + print substr $line,$left_length + $pid_length; + print "\n"; + +} + +exit; + +sub get_context +{ + my $pid = $_[0]; + $pid =~ s/ //g; + open STATUS, "/proc/$pid/status"; + while () + { + chomp; + if (/s_context: (\d+)/) { + close STATUS; + return $1; + } + } + close STATUS; + return -1; +} + +sub getcontextname { + if (exists $name{$_[0]}) { + return $name{$_[0]}; + } + if ($_[0] == 1) { + return "ALL_PROCS"; + } + elsif ($_[0] == 0) { + return "MAIN"; + } + return "UNKNOWN"; +} + + +sub get_server_names +{ + opendir LOCKDIR, "$lockdir"; + while ($file=readdir(LOCKDIR)) { + if (-f "$lockdir/$file") { + open FILE, "$lockdir/$file"; + $file =~ s/(.+)\.ctx/$1/; + while () { + if (/S_CONTEXT=(\d+)/) { + $name{$1} = $file; + } + } + } + } +} diff --git a/util-vserver/scripts/legacy/vserver b/util-vserver/scripts/legacy/vserver new file mode 100755 index 0000000..ea7d84d --- /dev/null +++ b/util-vserver/scripts/legacy/vserver @@ -0,0 +1,781 @@ +#!/bin/sh + +# Copyright (C) 2003 Enrico Scholz +# based on vserver by Jacques Gelinas +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +# This is a script to control a virtual server + +: ${UTIL_VSERVER_VARS:=$(dirname $0)/util-vserver-vars} +test -e "$UTIL_VSERVER_VARS" || { + echo "Can not find util-vserver installation; aborting..." + exit 1 +} +. "$UTIL_VSERVER_VARS" + +USR_SBIN=$SBINDIR +USR_LIB_VSERVER=$PKGLIBDIR +VSERVERKILLALL_CMD=$LEGACYDIR/vserverkillall +DEFAULTPATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin + +vserver_mknod(){ + mknod $1 $2 $3 $4 + chmod $5 $1 +} + +mountproc() +{ + mkdir -p $1/proc $1/dev/pts + if [ ! -d $1/proc/1 ] ; then + mount -t proc none $1/proc + mount -t devpts -o gid=5,mode=0620 none $1/dev/pts + fi +} +umountproc() +{ + umount $1/proc 2>/dev/null + umount $1/dev/pts 2>/dev/null +} + +# Check that the vservers parent directory has permission 000 +# This is the key to avoid chroot escape +testperm() +{ + return + PERM=`$USR_LIB_VSERVER/showperm $DEFAULT_VSERVERDIR/$1/..` + if [ "$PERM" != 000 ] ; then + echo + echo "**********************************************************" + echo $DEFAULT_VSERVERDIR/$1/.. has insecure permissions. + echo A vserver administrator may be able to visit the root server. + echo To fix this, do + echo " " chmod 000 $DEFAULT_VSERVERDIR/$1/.. + echo do it anytime you want, even if vservers are running. + echo "**********************************************************" + echo + fi +} +# Set the IP alias needed by a vserver +ifconfig_iproot() +{ + if [ "$NODEV" = "" -a "$IPROOT" != "" -a "$IPROOT" != "0.0.0.0" -a "$IPROOT" != "ALL" ] ;then + # A vserver may have more than one IP + # The first alias is dev:vserver + # and the other are dev:vserver1,2,3 and so on + # An IP may hold the device. The following is valid + # IPROOT="1.2.4.5 eth1:1.2.3.5" + # IPROOTDEV=eth0 + # The first IP 1.2.3.4 will go on eth0 and the other on eth1 + # VLAN devices are also supported (eth0.231 for vlan 231) + SUFFIX= + for oneip in $IPROOT + do + IPDEV=$IPROOTDEV + MASK=$IPROOTMASK + BCAST=$IPROOTBCAST + # Split the device and IP if available + case $oneip in + *:*) + eval `echo $oneip | tr : ' ' | (read dev ip; echo oneip=$ip; echo IPDEV=$dev)` + ;; + esac + # Split the IP and the netmask if available + case $oneip in + */*) + eval `echo $oneip | tr / ' ' | (read ip msk; echo oneip=$ip; echo MASK=$msk)` + eval `$USR_LIB_VSERVER/ifspec "" "$oneip" "$MASK" "$BCAST"` + ;; + esac + if [ "$IPDEV" != "" ] ; then + case $IPDEV in + *.*) + if [ ! -f /proc/net/vlan/$IPDEV ] ; then + /sbin/vconfig add `echo $IPDEV | tr . ' '` + # Put a dummy IP + /sbin/ifconfig $IPDEV 127.0.0.1 + fi + ;; + esac + # Compute the default netmask, if missing + eval `$USR_LIB_VSERVER/ifspec $IPDEV "$oneip" "$MASK" "$BCAST"` + IPROOTMASK=$NETMASK + IPROOTBCAST=$BCAST + #echo /sbin/ifconfig $IPDEV:$1$SUFFIX $oneip netmask $IPROOTMASK broadcast $IPROOTBCAST + /sbin/ifconfig $IPDEV:$1$SUFFIX $oneip netmask $IPROOTMASK broadcast $IPROOTBCAST + fi + if [ "$SUFFIX" = "" ] ; then + SUFFIX=1 + else + SUFFIX=`expr $SUFFIX + 1` + fi + done + fi + if [ "$IPROOTBCAST" = "" ] ; then + IPROOTBCAST=255.255.255.255 + fi +} +ifconfig_iproot_off() +{ + if [ "$NODEV" = "" -a "$IPROOT" != "" -a "$IPROOT" != "0.0.0.0" -a "$IPROOT" != "ALL" -a "$IPROOTDEV" != "" ] ;then + SUFFIX= + for oneip in $IPROOT + do + IPDEV=$IPROOTDEV + # Split the device and IP if available + case $oneip in + *:*) + eval `echo $oneip | tr : ' ' | (read dev ip; echo IPDEV=$dev)` + ;; + esac + /sbin/ifconfig $IPDEV:$1$SUFFIX down 2>/dev/null + if [ "$SUFFIX" = "" ] ; then + SUFFIX=1 + else + SUFFIX=`expr $SUFFIX + 1` + fi + done + fi +} +# Split an IPROOT definition, trash the devices and +# compose a set of --ip option for chbind +setipopt(){ + RET= + IPS="$*" + if [ "$IPS" = "" ] ; then + IPS=0.0.0.0 + fi + if [ "$1" = "ALL" ] ; then + IPS=`$USR_LIB_VSERVER/listdevip` + fi + for oneip in $IPS + do + # Split the device and IP if available + case $oneip in + *:*) + eval `echo $oneip | tr : ' ' | (read dev ip; echo oneip=$ip)` + ;; + esac + #case $oneip in + #*/*) + # eval `echo $oneip | tr / ' ' | (read ip msk; echo oneip=$ip)` + # ;; + #esac + echo --ip $oneip + done +} + +# Extract the initial runlevel from the vserver inittab +get_initdefault() +{ + INITDEFAULT=`grep :initdefault $DEFAULT_VSERVERDIR/$1/etc/inittab | sed 's/:/ /g' | ( read a level b; echo $level)` +} + +# Read the vserver configuration file, reusing the PROFILE value +# found in /var/run/vservers +readlastconf() +{ + if [ -f /var/run/vservers/$1.ctx ] ; then + . /var/run/vservers/$1.ctx + if [ "$S_PROFILE" != "" ] ; then + export PROFILE=$S_PROFILE + fi + fi + export PROFILE + . /etc/vservers/$1.conf +} +usage() +{ + echo vserver [ options ] server-name command ... + echo + echo server-name is a directory in $DEFAULT_VSERVERDIR + echo + echo The commands are: + echo " build : Create a virtual server by copying the packages" + echo " of the root server" + echo " enter : Enter in the virtual server context and starts a shell" + echo " Same as \"vserver name exec /bin/sh\"" + echo " exec : Exec a command in the virtual server context" + echo " suexec : Exec a command in the virtual server context uid" + echo " service : Control a service inside a vserver" + echo " vserver name service service-name start/stop/restart/status" + echo " start : Starts the various services in the vserver, runlevel 3" + echo " stop : Ends all services and kills the remaining processes" + echo " running : Tells if a virtual server is running" + echo " It returns proper exit code, so you can use it as a test" + echo " status : Tells some information about a vserver" + echo " chkconfig : It turns a server on or off in a vserver" + echo + echo "--nodev : Do not configure the IP aliases of the vserver" + echo " Useful to enter a vserver without enabling its network" + echo " and avoiding conflicts with another copy of this vserver" + echo " running elsewhere" + echo "--silent : No informative messages about vserver context and IP numbers" + echo " Useful when you want to redirect the output" +} + +calculateCaps() +{ + local f + for f in "$@"; do + case $f in + !CAP_SYS_CHROOT) + CHROOTOPT=--nochroot + ;; + *) + CAPS="$CAPS --cap $f" + ;; + esac + done +} + +SILENT= +NODEV= +while true +do + if [ "$1" = "--silent" ] ; then + SILENT=--silent + shift + elif [ "$1" = "--nodev" ] ; then + NODEV=--nodev + shift + else + break + fi +done +# Setup the default ulimit for a vserver +setdefulimit(){ + # File handle are limited to half of the current system limit + # Virtual memory is limited to the ram size + NFILE=`cat /proc/sys/fs/file-max` + NFILE=`expr $NFILE / 2` + VMEM=`cat /proc/meminfo | grep MemTotal | (read a b c; echo $b)` + # Disabled for now, we need a different to set the security + # context limit than fiddling with ulimit + #ulimit -H -n $NFILE -v $VMEM +} +if [ $# -lt 2 ] ; then + usage +elif [ "$2" = "build" ] ; then + # Either the directory does not exist or is empty + NBSUB=`ls $DEFAULT_VSERVERDIR/$1 2>/dev/null | grep -v lost+found | wc -l` + NBSUB=`expr $NBSUB` + if [ "$NBSUB" != 0 ] ; then + echo Virtual server $DEFAULT_VSERVERDIR/$1 already exist + else + if [ ! -d $DEFAULT_VSERVERDIR ] ; then + mkdir $DEFAULT_VSERVERDIR || exit 1 + chmod 000 $DEFAULT_VSERVERDIR + echo Directory $DEFAULT_VSERVERDIR was created with permissions 000 + fi + mkdir -p $DEFAULT_VSERVERDIR/$1 || exit 1 + chmod 755 $DEFAULT_VSERVERDIR/$1 + if test "$UTIL_VSERVER_AVOID_COPY"; then + mkdir -p $DEFAULT_VSERVERDIR/$1/{etc/rc.d/init.d,sbin,var/run,var/log} + else + cp -ax /sbin /bin /etc /usr /var /lib $DEFAULT_VSERVERDIR/$1/. || exit 1 + fi + cd $DEFAULT_VSERVERDIR/$1 || exit 1 + rm -fr lib/modules/* + rm -f var/spool/mail/* + rm -f `find var/run -type f` + rm -f `find var/log -type f` + touch var/log/wtmp + rm -f var/lock/subsys/* + rm -f etc/cron.d/kmod + mkdir proc tmp home root boot + test -f /root/.bashrc && cp -a /root/.bashrc root/. + test -f /root/.bash_profile && cp -a /root/.bash_profile root/. + chmod 1777 tmp + chmod 750 root + # Create a minimal dev so the virtual server can't grab + # more privileges + mkdir dev dev/pts + vserver_mknod dev/null c 1 3 666 + vserver_mknod dev/zero c 1 5 666 + vserver_mknod dev/full c 1 7 666 + vserver_mknod dev/random c 1 8 644 + vserver_mknod dev/urandom c 1 9 644 + vserver_mknod dev/tty c 5 0 666 + vserver_mknod dev/ptmx c 5 2 666 + touch dev/hdv1 + # Turn off some service useless on a vserver + # vserver_turnoff apmd network autofs dhcpd gpm ipchains iptables \ + # irda isdn keytable kudzu linuxconf-setup netfs nfs nfslock \ + # pcmcia portmap pppoe random rawdevices rhnsd rstatd ruserd \ + # rwalld rwhod sendmail smb snmpd v_httpd h_xinetd v_sshd vservers \ + # xfs ypbind xinetd + ( + cd etc/init.d 2>/dev/null || cd etc/rc.d/init.d + for serv in * + do + case $serv in + *.bak|*~|functions|killall|halt|single) + ;; + *) + #$USR_LIB_VSERVER/capchroot $DEFAULT_VSERVERDIR/$1 /sbin/chkconfig --level 2345 $serv off + $0 --silent $1 chkconfig --level 2345 $serv off + ;; + esac + done + ) + rm -f etc/rc.d/rc6.d/S*reboot + # Create a dummy /etc/fstab and /etc/mtab to please + # df and linuxconf. We use hdv1, which does not exist + # to remind the admin that it is not the real drive + echo /dev/hdv1 / ext2 defaults 1 1 >etc/fstab + echo /dev/hdv1 / ext2 rw 0 0 >etc/mtab + # Install the vreboot utility + cp -a $USR_LIB_VSERVER/vreboot sbin/. + ln -sf vreboot sbin/vhalt + + echo Directory $DEFAULT_VSERVERDIR/$1 has been populated + if [ ! -d /etc/vservers ] ; then + mkdir /etc/vservers + chmod 600 /etc/vservers + echo Directory /etc/vservers has been created + fi + if [ ! -f /etc/vservers/$1.conf ] ; then + CONF=/etc/vservers/$1.conf + cat >$CONF <<-EOF +if [ "$PROFILE" = "" ] ; then + PROFILE=prod +fi +# Select the IP number assigned to the virtual server +# This IP must be one IP of the server, either an interface +# or an IP alias +# A vserver may have more than one IP. Separate them with spaces. +# do not forget double quotes. +# Some examples: +# IPROOT="1.2.3.4 2.3.4.5" +# IPROOT="eth0:1.2.3.4 eth1:2.3.4.5" +# If the device is not specified, IPROOTDEV is used +case \$PROFILE in +prod) + IPROOT=1.2.3.4 + # The netmask and broadcast are computed by default from IPROOTDEV + #IPROOTMASK= + #IPROOTBCAST= + # You can define on which device the IP alias will be done + # The IP alias will be set when the server is started and unset + # when the server is stopped + #IPROOTDEV=eth0 + # You can set a different host name for the vserver + # If empty, the host name of the main server is used + S_HOSTNAME= + ;; +backup) + IPROOT=1.2.3.4 + #IPROOTMASK= + #IPROOTBCAST= + #IPROOTDEV=eth0 + S_HOSTNAME= + ;; +esac +# Uncomment the onboot line if you want to enable this +# virtual server at boot time +#ONBOOT=yes +# You can set a different NIS domain for the vserver +# If empty, the current on is kept +# Set it to "none" to have no NIS domain set +S_DOMAINNAME= +# You can set the priority level (nice) of all process in the vserver +# Even root won't be able to raise it +S_NICE= +# You can set various flags for the new security context +# lock: Prevent the vserver from setting new security context +# sched: Merge scheduler priority of all processes in the vserver +# so that it acts a like a single one. +# nproc: Limit the number of processes in the vserver according to ulimit +# (instead of a per user limit, this becomes a per vserver limit) +# private: No other process can join this security context. Even root +# Do not forget the quotes around the flags +S_FLAGS="lock nproc" +# You can set various ulimit flags and they will be inherited by the +# vserver. You enter here various command line argument of ulimit +# ULIMIT="-HS -u 200" +# The example above, combined with the nproc S_FLAGS will limit the +# vserver to a maximum of 200 processes +ULIMIT="-HS -u 1000" +# You can set various capabilities. By default, the vserver are run +# with a limited set, so you can let root run in a vserver and not +# worry about it. He can't take over the machine. In some cases +# you can to give a little more capabilities (such as CAP_NET_RAW) +# S_CAPS="CAP_NET_RAW" +S_CAPS="" +# Select an unused context (this is optional) +# The default is to allocate a free context on the fly +# In general you don't need to force a context +#S_CONTEXT= + EOF + echo $CONF has been created. Look at it\! + fi + fi +elif [ ! -f /etc/vservers/$1.conf ] ; then + echo No configuration for this vserver: /etc/vservers/$1.conf + exit 1 +elif [ ! -d $DEFAULT_VSERVERDIR/$1/. ] ; then + echo No directory for this vserver: $DEFAULT_VSERVERDIR/$1 + exit 1 +elif [ "$2" = "start" ] ; then + echo Starting the virtual server $1 + testperm $1 + if ! $0 $1 running + then + test -x /etc/vservers/$1.sh && /etc/vservers/$1.sh pre-start $1 + IPROOT= + IPROOTMASK= + IPROOTBCAST= + IPROOTDEV= + S_NICE= + S_FLAGS= + . /etc/vservers/$1.conf + export PROFILE + ifconfig_iproot $1 + cd $DEFAULT_VSERVERDIR/$1 || exit 1 + + if [ "$PROFILE" != "" ] ; then + echo export PROFILE=$PROFILE >etc/PROFILE + fi + + rm -f `find var/run -type f` + touch var/run/utmp + chgrp ${UTMP_GROUP:-utmp} var/run/utmp + chmod 0664 var/run/utmp + rm -f var/lock/subsys/* + mountproc $DEFAULT_VSERVERDIR/$1 + CTXOPT= + HOSTOPT= + DOMAINOPT= + NICECMD= + FLAGS= + CAPS= + get_initdefault $1 + STARTCMD="/etc/rc.d/rc $INITDEFAULT" + if [ -x $DEFAULT_VSERVERDIR/$1/etc/init.d/rc ] ; then + STARTCMD="/etc/init.d/rc $INITDEFAULT" + elif [ -x $DEFAULT_VSERVERDIR/$1/usr/bin/emerge ] ; then + STARTCMD="/sbin/rc default" + elif [ -x $DEFAULT_VSERVERDIR/$1/etc/rc.d/rc.M ] ; then + STARTCMD="/etc/rc.d/rc.M" + fi + + DISCONNECT= + FAKEINIT= + for f in $S_FLAGS dummy + do + case $f in + dummy) + ;; + + minit) + FAKEINIT=true + FLAGS="$FLAGS --flag fakeinit" + STARTCMD=/sbin/minit-start + DISCONNECT=--disconnect + ;; + + fakeinit) + FAKEINIT=true + FLAGS="$FLAGS --flag $f" + STARTCMD=/sbin/init + DISCONNECT=--disconnect + ;; + *) + FLAGS="$FLAGS --flag $f" + ;; + esac + done + if [ "$FAKEINIT" = "" ] ; then + $USR_LIB_VSERVER/fakerunlevel $INITDEFAULT var/run/utmp + fi + + calculateCaps $S_CAPS + + if [ "$S_CONTEXT" != "" ] ; then + CTXOPT="--ctx $S_CONTEXT" + fi + if [ "$S_HOSTNAME" != "" ] ; then + HOSTOPT="--hostname $S_HOSTNAME" + export HOSTNAME=$S_HOSTNAME + fi + if [ "$S_DOMAINNAME" != "" ] ; then + DOMAINOPT="--domainname $S_DOMAINNAME" + fi + if [ "$S_NICE" != "" ] ; then + NICECMD="nice -$S_NICE" + fi + mkdir -p /var/run/vservers + chmod 700 /var/run/vservers + setdefulimit + if [ "$ULIMIT" != "" ] ; then + ulimit $ULIMIT + fi + #echo FLAGS=$FLAGS + #echo CAPS=$CAPS + # We switch to /vservers/$1 now, because after the + # security context switch /vservers directory becomes a dead zone. + cd $DEFAULT_VSERVERDIR/$1 + IPOPT=`setipopt $IPROOT` + export PATH=$DEFAULTPATH + $NICECMD $_CHBIND $SILENT $IPOPT --bcast $IPROOTBCAST \ + $_CHCONTEXT $SILENT $DISCONNECT $CAPS $FLAGS $CTXOPT $HOSTOPT $DOMAINOPT --secure \ + $_SAVE_S_CONTEXT /var/run/vservers/$1.ctx \ + $_CAPCHROOT $CHROOTOPT . $STARTCMD + sleep 2 + test -x /etc/vservers/$1.sh && /etc/vservers/$1.sh post-start $1 + fi +elif [ "$2" = "running" ] ; then + if [ ! -f /var/run/vservers/$1.ctx ] ; then + echo Server $1 is not running + exit 1 + else + . /var/run/vservers/$1.ctx + NB=$($USR_SBIN/vps ax | awk '{print $2}' | grep \^$S_CONTEXT\$ | wc -l) + #NB=`$_CHCONTEXT --silent --ctx $S_CONTEXT ps ax | wc -l` + #NB=`eval expr $NB + 0` + if [ "$NB" -gt 0 ] ; then + echo Server $1 is running + exit 0 + else + echo Server $1 is not running + exit 1 + fi + fi +elif [ "$2" = "status" ] ; then + if $0 $1 running + then + . /var/run/vservers/$1.ctx + NB=$($USR_SBIN/vps ax | awk '{print $2}' | grep \^$S_CONTEXT\$ | wc -l) + echo $NB processes running + echo Vserver uptime: `$USR_LIB_VSERVER/filetime /var/run/vservers/$1.ctx` + fi +elif [ "$2" = "stop" ] ; then + echo Stopping the virtual server $1 + IPROOT= + IPROOTMASK= + IPROOTBCAST= + IPROOTDEV= + CAPS= + IS_MINIT= + readlastconf $1 + if $0 $1 running + then + test -x /etc/vservers/$1.sh && /etc/vservers/$1.sh pre-stop $1 + ifconfig_iproot $1 + cd $DEFAULT_VSERVERDIR/$1 + mountproc $DEFAULT_VSERVERDIR/$1 + # The fakeinit flag tell us how to turn off the server + get_initdefault $1 + export PREVLEVEL=$INITDEFAULT + STOPCMD="/etc/rc.d/rc 6" + if [ -x $DEFAULT_VSERVERDIR/$1/etc/init.d/rc ] ; then + STOPCMD="/etc/init.d/rc 6" + elif [ -x $DEFAULT_VSERVERDIR/$1/usr/bin/emerge ] ; then + STOPCMD="/sbin/rc shutdown" + elif [ -x $DEFAULT_VSERVERDIR/$1/etc/rc.d/rc.6 ] ; then + STOPCMD="/etc/rc.d/rc.6" + fi + + for f in $S_FLAGS dummy + do + case $f in + minit) + IS_MINIT=1 + FLAGS="$FLAGS --flag fakeinit" + STOPCMD="/sbin/minit-stop" + ;; + + fakeinit) + FLAGS="$FLAGS --flag $f" + STOPCMD="/sbin/init 6" + ;; + *) + ;; + esac + done + + calculateCaps $S_CAPS + + cd $DEFAULT_VSERVERDIR/$1 + IPOPT=`setipopt $IPROOT` + export PATH=$DEFAULTPATH + $_CHBIND $SILENT $IPOPT --bcast $IPROOTBCAST \ + $_CHCONTEXT $SILENT $CAPS --secure --ctx $S_CONTEXT \ + $_CAPCHROOT . $STOPCMD + + if test "$IS_MINIT"; then + echo "Waiting for minit finish-signal" + dd if=var/run/minit-stop of=/dev/zero bs=1 count=1 &>/dev/null + sleep 1 + else + echo sleeping 5 seconds + sleep 5 + fi + + echo Killing all processes + $_CHBIND --silent $IPOPT --bcast $IPROOTBCAST \ + $_CHCONTEXT $CAPS --secure --silent --ctx $S_CONTEXT \ + $VSERVERKILLALL_CMD + fi + # We umount anyway, because "enter" establish the mount + # but when you exit, the server is considered not running + umountproc $DEFAULT_VSERVERDIR/$1 + cd / + test -x /etc/vservers/$1.sh && /etc/vservers/$1.sh post-stop $1 + ifconfig_iproot_off $1 +elif [ "$2" = "restart" ] ; then + if $0 $1 running + then + $0 $1 stop + $0 $1 start + fi +elif [ "$2" = "suexec" ] ; then + if [ -z "$3" ] ; then + echo "Missing user!" >&2 + echo "vserver vserver-name suexec user command [ args ... ]" >&2 + exit 1 + elif [ -z "$4" ] ; then + echo "Missing command and arguments!" >&2 + echo "vserver vserver-name suexec user command [ args ... ]" >&2 + exit 1 + else + IPROOT= + IPROOTMASK= + IPROOTBCAST= + IPROOTDEV= + readlastconf $1 + . /etc/vservers/$1.conf + cd $DEFAULT_VSERVERDIR/$1 + ifconfig_iproot $1 + mountproc $DEFAULT_VSERVERDIR/$1 + PS1="[\u@vserver:$1 \W]" + export PS1 + VSERVER=$1 + USERID=$3 + shift; shift; shift + CAPS= + for f in $S_CAPS dummy + do + case $f in + dummy) + ;; + !CAP_SYS_CHROOT) + CHROOTOPT=--nochroot + ;; + *) + CAPS="$CAPS --cap $f" + ;; + esac + done + FLAGS= + for f in $S_FLAGS dummy + do + case $f in + minit) + FLAGS="$FLAGS --flag fakeinit" + ;; + + dummy) + ;; + *) + FLAGS="$FLAGS --flag $f" + ;; + esac + done + setdefulimit + if [ "$ULIMIT" != "" ] ; then + ulimit $ULIMIT + fi + if $0 $VSERVER running >/dev/null + then + . /var/run/vservers/$VSERVER.ctx + cd $DEFAULT_VSERVERDIR/$VSERVER + IPOPT=`setipopt $IPROOT` + export PATH=$DEFAULTPATH + exec $_CHBIND $SILENT $IPOPT --bcast $IPROOTBCAST \ + $_CHCONTEXT $SILENT $FLAGS $CAPS --secure --ctx $S_CONTEXT \ + $_CAPCHROOT --suid $USERID . "$@" + else + test -x /etc/vservers/$1.sh && /etc/vservers/$1.sh pre-start $1 + CTXOPT= + HOSTOPT= + DOMAINOPT= + if [ "$S_CONTEXT" != "" ] ; then + CTXOPT="--ctx $S_CONTEXT" + fi + if [ "$S_HOSTNAME" != "" ] ; then + HOSTOPT="--hostname $S_HOSTNAME" + export HOSTNAME=$S_HOSTNAME + fi + if [ "$S_DOMAINNAME" != "" ] ; then + DOMAINOPT="--domainname $S_DOMAINNAME" + fi + mkdir -p /var/run/vservers + cd $DEFAULT_VSERVERDIR/$VSERVER + IPOPT=`setipopt $IPROOT` + export PATH=$DEFAULTPATH + exec $_CHBIND $SILENT $IPOPT --bcast $IPROOTBCAST \ + $_CHCONTEXT $SILENT $FLAGS $CAPS --secure $CTXOPT $HOSTOPT $DOMAINOPT \ + $_SAVE_S_CONTEXT /var/run/vservers/$VSERVER.ctx \ + $_CAPCHROOT --suid $USERID $CHROOTOPT . "$@" + fi + fi +elif [ "$2" = "exec" ] ; then + VSERV=$1 + shift; shift + exec $0 $NODEV $SILENT $VSERV suexec root "$@" +elif [ "$2" = "enter" ] ; then + testperm $1 + exec $0 $NODEV $SILENT $1 exec /bin/bash -login +elif [ "$2" = "service" ] ; then + VSERVER=$1 + shift + shift + exec $0 $NODEV $SILENT $VSERVER exec /sbin/service "$@" +elif [ "$2" = "chkconfig" ] ; then + VSERVER=$1 + shift + shift + if [ "$1" = "--level" ] ; then + shift + LEVELS=$1 + shift + fi + if [ $# != 2 -a ! -x $DEFAULT_VSERVERDIR/$VSERVER/sbin/chkconfig ] ; then + echo Invalid argument, expected vserver name chkconfig [ --level nnn ] service on\|off + elif [ -x $DEFAULT_VSERVERDIR/$VSERVER/sbin/chkconfig ] ; then + exec $0 --silent $VSERVER exec /sbin/chkconfig "$@" + elif [ -x $DEFAULT_VSERVERDIR/$VSERVER/usr/sbin/update-rc.d ] ; then + if [ "$2" = "on" -o "$2" = "start" ] ; then + $0 --silent $VSERVER exec /usr/sbin/update-rc.d -f $1 remove >/dev/null + exec $0 --silent $VSERVER exec /usr/sbin/update-rc.d $1 start 80 2 3 4 5 . stop 20 0 1 6 . >/dev/null + elif [ "$2" = "off" -o "$2" = "stop" ] ; then + $0 --silent $VSERVER exec /usr/sbin/update-rc.d -f $1 remove >/dev/null + exec $0 --silent $VSERVER exec /usr/sbin/update-rc.d $1 stop 20 0 1 2 3 4 5 6 . >/dev/null + else + echo vserver chkconfig: Expecting on or off + fi + else + echo chkconfig functionality is not available on this + echo vserver distribution. + echo Looked for /sbin/chkconfig and /usr/sbin/update-rc.d + fi +else + echo Command unknown $2 + echo + usage +fi + diff --git a/util-vserver/scripts/legacy/vserverkillall b/util-vserver/scripts/legacy/vserverkillall new file mode 100755 index 0000000..f49f339 --- /dev/null +++ b/util-vserver/scripts/legacy/vserverkillall @@ -0,0 +1,63 @@ +#!/bin/sh + +# Copyright (C) 2003 Enrico Scholz +# based on vserverkillall by Jacques Gelinas +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2, or (at your option) +# any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +# This script kills all process it can finds +# Only useful if you are using a security context. +# It does nothing in context 0 +USR_LIB_VSERVER=$(dirname $0) +CTX=`grep ^s_context /proc/self/status | sed s/s_context:// | (read a b; echo $a)` +CTX=`eval expr $CTX + 0` +if [ "$CTX" = 0 ] ; then + echo Running in security context 0, do nothing +else + cd /proc + for SIG in -TERM -TERM -TERM -9 + do + ONE=0 + for dir in * + do + case $dir in + 1) + ;; + $$) + ;; + [1-9]*) + ONE=1 + echo kill $SIG "`$USR_LIB_VSERVER/readlink /proc/$dir/exe`"[$dir] + kill $SIG $dir + ;; + *) + ;; + esac + done + if [ "$ONE" = 0 ] ; then + break + fi + sleep 1 + done + # Kill the fakeinit process. It is shown as process one, but can't + # be killed this way + INITPID=`cat /proc/self/status | grep initpid: | (read a b; expr $b)` + if [ "$INITPID" != "0" ] ; then + echo kill init, pid $INITPID + kill -9 $INITPID + fi +fi + +