From 1ce955ec83b76280068120c76443a62fce460ec5 Mon Sep 17 00:00:00 2001 From: Joakim Roubert Date: Mon, 24 May 2021 12:13:59 +0200 Subject: [PATCH] contrib/check-config.sh: Make script POSIX On systems that do not have bash, the current bash-based check-config.sh won't run. Making check-config.sh a POSIX shell script instead makes it more portable. Signed-off-by: Joakim Roubert --- contrib/check-config.sh | 146 +++++++++++++++++++++------------------- 1 file changed, 78 insertions(+), 68 deletions(-) diff --git a/contrib/check-config.sh b/contrib/check-config.sh index 253595ef90..5b0abb515c 100755 --- a/contrib/check-config.sh +++ b/contrib/check-config.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +#!/usr/bin/env sh set -e EXITCODE=0 @@ -6,20 +6,20 @@ EXITCODE=0 # bits of this were adapted from lxc-checkconfig # see also https://github.com/lxc/lxc/blob/lxc-1.0.2/src/lxc/lxc-checkconfig.in -possibleConfigs=( - '/proc/config.gz' - "/boot/config-$(uname -r)" - "/usr/src/linux-$(uname -r)/.config" - '/usr/src/linux/.config' -) +possibleConfigs=" + /proc/config.gz + /boot/config-$(uname -r) + /usr/src/linux-$(uname -r)/.config + /usr/src/linux/.config +" if [ $# -gt 0 ]; then CONFIG="$1" else - : "${CONFIG:="${possibleConfigs[0]}"}" + : "${CONFIG:=/proc/config.gz}" fi -if ! command -v zgrep &> /dev/null; then +if ! command -v zgrep > /dev/null 2>&1; then zgrep() { zcat "$2" | grep "$1" } @@ -41,13 +41,13 @@ is_set_as_module() { } color() { - local codes=() + codes= if [ "$1" = 'bold' ]; then - codes=("${codes[@]}" '1') + codes='1' shift fi if [ "$#" -gt 0 ]; then - local code= + code= case "$1" in # see https://en.wikipedia.org/wiki/ANSI_escape_code#Colors black) code=30 ;; @@ -60,17 +60,20 @@ color() { white) code=37 ;; esac if [ "$code" ]; then - codes=("${codes[@]}" "$code") + [ "$codes" ] && codes="$codes " + codes="$codes$code" fi fi - local IFS=';' - echo -en '\033['"${codes[*]}"'m' + oldIFS=$IFS + IFS=';' + printf '\033[%sm' "$codes" + IFS=$oldIFS } wrap_color() { text="$1" shift color "$@" - echo -n "$text" + printf '%s' "$text" color reset echo } @@ -98,7 +101,7 @@ check_flag() { check_flags() { for flag in "$@"; do - echo -n "- " + printf -- '- ' check_flag "$flag" done } @@ -122,20 +125,26 @@ check_device() { } check_distro_userns() { - source /etc/os-release 2> /dev/null || /bin/true - if [[ "${ID}" =~ ^(centos|rhel)$ && "${VERSION_ID}" =~ ^7 ]]; then - # this is a CentOS7 or RHEL7 system - grep -q "user_namespace.enable=1" /proc/cmdline || { - # no user namespace support enabled - wrap_bad " (RHEL7/CentOS7" "User namespaces disabled; add 'user_namespace.enable=1' to boot command line)" - EXITCODE=1 - } - fi + . /etc/os-release 2> /dev/null || /bin/true + case "$ID" in + centos | rhel) + case "$VERSION_ID" in + 7*) + # this is a CentOS7 or RHEL7 system + grep -q 'user_namespace.enable=1' /proc/cmdline || { + # no user namespace support enabled + wrap_bad " (RHEL7/CentOS7" "User namespaces disabled; add 'user_namespace.enable=1' to boot command line)" + EXITCODE=1 + } + ;; + esac + ;; + esac } if [ ! -e "$CONFIG" ]; then wrap_warning "warning: $CONFIG does not exist, searching other paths for kernel config ..." - for tryConfig in "${possibleConfigs[@]}"; do + for tryConfig in $possibleConfigs; do if [ -e "$tryConfig" ]; then CONFIG="$tryConfig" break @@ -154,9 +163,9 @@ echo echo 'Generally Necessary:' -echo -n '- ' +printf -- '- ' if [ "$(stat -f -c %t /sys/fs/cgroup 2> /dev/null)" = '63677270' ]; then - echo "$(wrap_good 'cgroup hierarchy' 'cgroupv2')" + wrap_good 'cgroup hierarchy' 'cgroupv2' else cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)" cgroupDir="$(dirname "$cgroupSubsystemDir")" @@ -174,15 +183,15 @@ else fi if [ "$(cat /sys/module/apparmor/parameters/enabled 2> /dev/null)" = 'Y' ]; then - echo -n '- ' - if command -v apparmor_parser &> /dev/null; then + printf -- '- ' + if command -v apparmor_parser > /dev/null 2>&1; then wrap_good 'apparmor' 'enabled and tools installed' else wrap_bad 'apparmor' 'enabled, but apparmor_parser missing' - echo -n ' ' - if command -v apt-get &> /dev/null; then + printf ' ' + if command -v apt-get > /dev/null 2>&1; then wrap_color '(use "apt-get install apparmor" to fix this)' - elif command -v yum &> /dev/null; then + elif command -v yum > /dev/null 2>&1; then wrap_color '(your best bet is "yum install apparmor-parser")' else wrap_color '(look for an "apparmor" package for your distribution)' @@ -191,20 +200,23 @@ if [ "$(cat /sys/module/apparmor/parameters/enabled 2> /dev/null)" = 'Y' ]; then fi fi -flags=( - NAMESPACES {NET,PID,IPC,UTS}_NS - CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG - KEYS - VETH BRIDGE BRIDGE_NETFILTER - IP_NF_FILTER IP_NF_TARGET_MASQUERADE - NETFILTER_XT_MATCH_{ADDRTYPE,CONNTRACK,IPVS} - NETFILTER_XT_MARK - IP_NF_NAT NF_NAT - - # required for bind-mounting /dev/mqueue into containers +check_flags \ + NAMESPACES NET_NS \ + NAMESPACES PID_NS \ + NAMESPACES IPC_NS \ + NAMESPACES UTS_NS \ + CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG \ + KEYS \ + VETH BRIDGE BRIDGE_NETFILTER \ + IP_NF_FILTER IP_NF_TARGET_MASQUERADE \ + NETFILTER_XT_MATCH_ADDRTYPE \ + NETFILTER_XT_MATCH_CONNTRACK \ + NETFILTER_XT_MATCH_IPVS \ + NETFILTER_XT_MARK \ + IP_NF_NAT NF_NAT \ POSIX_MQUEUE -) -check_flags "${flags[@]}" +# (POSIX_MQUEUE is required for bind-mounting /dev/mqueue into containers) + if [ "$kernelMajor" -lt 4 ] || ([ "$kernelMajor" -eq 4 ] && [ "$kernelMinor" -lt 8 ]); then check_flags DEVPTS_MULTIPLE_INSTANCES fi @@ -251,14 +263,14 @@ echo 'Optional Features:' } { if is_set LEGACY_VSYSCALL_NATIVE; then - echo -n "- " + printf -- '- ' wrap_bad "CONFIG_LEGACY_VSYSCALL_NATIVE" 'enabled' echo " $(wrap_color '(dangerous, provides an ASLR-bypassing target with usable ROP gadgets.)' bold black)" elif is_set LEGACY_VSYSCALL_EMULATE; then - echo -n "- " + printf -- '- ' wrap_good "CONFIG_LEGACY_VSYSCALL_EMULATE" 'enabled' elif is_set LEGACY_VSYSCALL_NONE; then - echo -n "- " + printf -- '- ' wrap_bad "CONFIG_LEGACY_VSYSCALL_NONE" 'enabled' echo " $(wrap_color '(containers using eglibc <= 2.13 will not work. Switch to' bold black)" echo " $(wrap_color ' "CONFIG_VSYSCALL_[NATIVE|EMULATE]" or use "vsyscall=[native|emulate]"' bold black)" @@ -289,22 +301,20 @@ if [ "$kernelMajor" -lt 5 ]; then check_flags IOSCHED_CFQ CFQ_GROUP_IOSCHED fi -flags=( - BLK_CGROUP BLK_DEV_THROTTLING - CGROUP_PERF - CGROUP_HUGETLB - NET_CLS_CGROUP $netprio - CFS_BANDWIDTH FAIR_GROUP_SCHED RT_GROUP_SCHED - IP_NF_TARGET_REDIRECT - IP_VS - IP_VS_NFCT - IP_VS_PROTO_TCP - IP_VS_PROTO_UDP - IP_VS_RR - SECURITY_SELINUX +check_flags \ + BLK_CGROUP BLK_DEV_THROTTLING \ + CGROUP_PERF \ + CGROUP_HUGETLB \ + NET_CLS_CGROUP $netprio \ + CFS_BANDWIDTH FAIR_GROUP_SCHED RT_GROUP_SCHED \ + IP_NF_TARGET_REDIRECT \ + IP_VS \ + IP_VS_NFCT \ + IP_VS_PROTO_TCP \ + IP_VS_PROTO_UDP \ + IP_VS_RR \ + SECURITY_SELINUX \ SECURITY_APPARMOR -) -check_flags "${flags[@]}" if ! is_set EXT4_USE_FOR_EXT2; then check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY @@ -369,11 +379,11 @@ check_flags OVERLAY_FS | sed 's/^/ /' EXITCODE=0 echo " - \"$(wrap_color 'zfs' blue)\":" -echo -n " - " +printf ' - ' check_device /dev/zfs -echo -n " - " +printf ' - ' check_command zfs -echo -n " - " +printf ' - ' check_command zpool [ "$EXITCODE" = 0 ] && STORAGE=0 EXITCODE=0