server/configs/lxc-templates/tizen-common-wayland.sh

   1 #!/bin/bash
   2
   3 #  lxc-tizen template script
   4 #
   5 #  Copyright (c) 2000 - 2014 Samsung Electronics Co., Ltd All Rights Reserved
   6 #
   7 #  Contact: Dariusz Michaluk  <d.michaluk@samsung.com>
   8 #
   9 #  Licensed under the Apache License, Version 2.0 (the "License");
  10 #  you may not use this file except in compliance with the License.
  11 #  You may obtain a copy of the License at
  12 #
  13 #  http://www.apache.org/licenses/LICENSE-2.0
  14 #
  15 #  Unless required by applicable law or agreed to in writing, software
  16 #  distributed under the License is distributed on an "AS IS" BASIS,
  17 #  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18 #  See the License for the specific language governing permissions and
  19 #  limitations under the License.
  20
  21 usage()
  22 {
  23     cat <<EOF
  24 usage:
  25     $1 -n|--name=<zone_name>
  26         [-p|--path=<path>] [--rootfs=<rootfs>] [--vt=<vt>]
  27         [--ipv4=<ipv4>] [--ipv4-gateway=<ipv4_gateway>] [-h|--help]
  28 Mandatory args:
  29   -n,--name         zone name
  30 Optional args:
  31   -p,--path         path to zone config files
  32   --rootfs          path to zone rootfs
  33   --vt              zone virtual terminal
  34   --ipv4            zone IP address
  35   --ipv4-gateway    zone gateway
  36   -h,--help         print help
  37 EOF
  38     return 0
  39 }
  40
  41 options=$(getopt -o hp:n: -l help,rootfs:,path:,vt:,name:,ipv4:,ipv4-gateway: -- "$@")
  42 if [ $? -ne 0 ]; then
  43     usage $(basename $0)
  44     exit 1
  45 fi
  46 eval set -- "$options"
  47
  48 while true
  49 do
  50     case "$1" in
  51         -h|--help)      usage $0 && exit 0;;
  52         --rootfs)       rootfs=$2; shift 2;;
  53         -p|--path)      path=$2; shift 2;;
  54         --vt)           vt=$2; shift 2;;
  55         -n|--name)      name=$2; shift 2;;
  56         --ipv4)         ipv4=$2; shift 2;;
  57         --ipv4-gateway) ipv4_gateway=$2; shift 2;;
  58         --)             shift 1; break ;;
  59         *)              break ;;
  60     esac
  61 done
  62
  63 if [ "$(id -u)" != "0" ]; then
  64     echo "This script should be run as 'root'"
  65     exit 1
  66 fi
  67
  68 if [ -z $name ]; then
  69     echo "Zone name must be given"
  70     exit 1
  71 fi
  72
  73 if [ -z "$path" ]; then
  74     echo "'path' parameter is required"
  75     exit 1
  76 fi
  77
  78 br_name="virbr-${name}"
  79
  80 # Prepare zone rootfs
  81 ROOTFS_DIRS="\
  82 ${rootfs}/bin \
  83 ${rootfs}/dev \
  84 ${rootfs}/etc \
  85 ${rootfs}/home \
  86 ${rootfs}/home/alice \
  87 ${rootfs}/home/bob \
  88 ${rootfs}/home/carol \
  89 ${rootfs}/home/guest \
  90 ${rootfs}/lib \
  91 ${rootfs}/media \
  92 ${rootfs}/mnt \
  93 ${rootfs}/opt \
  94 ${rootfs}/proc \
  95 ${rootfs}/root \
  96 ${rootfs}/run \
  97 ${rootfs}/sbin \
  98 ${rootfs}/sys \
  99 ${rootfs}/tmp \
 100 ${rootfs}/usr \
 101 ${rootfs}/var \
 102 ${rootfs}/var/run \
 103 ${path}/hooks \
 104 ${path}/scripts \
 105 ${path}/systemd \
 106 ${path}/systemd/system \
 107 ${path}/systemd/user
 108 "
 109 /bin/mkdir ${ROOTFS_DIRS}
 110 /bin/chown alice:users ${rootfs}/home/alice
 111 /bin/chown bob:users ${rootfs}/home/bob
 112 /bin/chown carol:users ${rootfs}/home/carol
 113 /bin/chown guest:users ${rootfs}/home/guest
 114
 115 /bin/ln -s /dev/null ${path}/systemd/system/bluetooth.service
 116 /bin/ln -s /dev/null ${path}/systemd/system/sshd.service
 117 /bin/ln -s /dev/null ${path}/systemd/system/sshd.socket
 118 /bin/ln -s /dev/null ${path}/systemd/system/sshd@.service
 119 /bin/ln -s /dev/null ${path}/systemd/system/systemd-udevd.service
 120 /bin/ln -s /dev/null ${path}/systemd/system/user-session-launch@seat0-5100.service
 121 /bin/ln -s /dev/null ${path}/systemd/system/vconf-setup.service
 122
 123 cat <<EOF >>${path}/systemd/system/display-manager-run.service
 124 # Run weston with framebuffer backend on selected virtual terminal.
 125 [Unit]
 126 Description=Weston display daemon
 127
 128 [Service]
 129 User=display
 130 WorkingDirectory=/run/%u
 131 # FIXME: log files shouldn't be stored in tmpfs directories (can get quite big and have side effects)
 132 #ExecStart=/bin/sh -c 'backend=drm ; [ -d /dev/dri ] || backend=fbdev ; exec /usr/bin/weston --backend=$backend-backend.so -i0 --log=/run/%u/weston.log'
 133 ExecStart=/usr/bin/weston --backend=fbdev-backend.so -i0 --log=/tmp/weston.log --tty=${vt}
 134 #StandardInput=tty
 135 #TTYPath=/dev/tty7
 136 EnvironmentFile=/etc/systemd/system/weston
 137 Restart=on-failure
 138 RestartSec=10
 139
 140 #adding the capability to configure ttys
 141 #may be needed if the user 'display' doesn't own the tty
 142 CapabilityBoundingSet=CAP_SYS_TTY_CONFIG
 143
 144 [Install]
 145 WantedBy=graphical.target
 146 EOF
 147
 148 cat <<EOF >>${path}/systemd/system/display-manager.path
 149 # Wayland socket path is changed to /tmp directory.
 150 [Unit]
 151 Description=Wait for wayland socket
 152 Requires=display-manager-run.service
 153 After=display-manager-run.service
 154
 155 [Path]
 156 PathExists=/tmp/wayland-0
 157 EOF
 158
 159 cat <<EOF >>${path}/systemd/system/display-manager.service
 160 # Wayland socket path is changed to /tmp directory.
 161 [Unit]
 162 Description=Display manager setup service
 163 Requires=display-manager-run.service
 164 After=display-manager-run.service
 165
 166 [Service]
 167 Type=oneshot
 168 ExecStart=/usr/bin/chmod g+w /tmp/wayland-0
 169 #ExecStart=/usr/bin/chsmack -a User /tmp/wayland-0
 170
 171 [Install]
 172 WantedBy=graphical.target
 173 EOF
 174
 175 cat <<EOF >>${path}/systemd/system/weston
 176 # path to display manager runtime dir
 177 XDG_RUNTIME_DIR=/tmp
 178 XDG_CONFIG_HOME=/etc/systemd/system
 179 EOF
 180
 181 cat <<EOF >>${path}/systemd/system/weston.ini
 182 # Weston config for zone.
 183 [core]
 184 modules=desktop-shell.so
 185
 186 [shell]
 187 background-image=/usr/share/backgrounds/tizen/golfe-morbihan.jpg
 188 background-color=0xff002244
 189 background-type=scale-crop
 190 panel-color=0x95333333
 191 locking=true
 192 panel=false
 193 animation=zoom
 194 #binding-modifier=ctrl
 195 num-workspaces=4
 196 #cursor-theme=whiteglass
 197 #cursor-size=24
 198 startup-animation=fade
 199
 200 #lockscreen-icon=/usr/share/icons/gnome/256x256/actions/lock.png
 201 #lockscreen=/usr/share/backgrounds/gnome/Garden.jpg
 202 #homescreen=/usr/share/backgrounds/gnome/Blinds.jpg
 203
 204 ## weston
 205
 206 [launcher]
 207 icon=/usr/share/icons/tizen/32x32/terminal.png
 208 path=/usr/bin/weston-terminal
 209
 210 [screensaver]
 211 # Uncomment path to disable screensaver
 212 duration=600
 213
 214 [input-method]
 215 path=/usr/libexec/weston-keyboard
 216 #path=/bin/weekeyboard
 217
 218 #[keyboard]
 219 #keymap_layout=fr
 220
 221 #[output]
 222 #name=LVDS1
 223 #mode=1680x1050
 224 #transform=90
 225 #icc_profile=/usr/share/color/icc/colord/Bluish.icc
 226
 227 #[output]
 228 #name=VGA1
 229 #mode=173.00  1920 2048 2248 2576  1080 1083 1088 1120 -hsync +vsync
 230 #transform=flipped
 231
 232 #[output]
 233 #name=X1
 234 #mode=1024x768
 235 #transform=flipped-270
 236
 237 #[touchpad]
 238 #constant_accel_factor = 50
 239 #min_accel_factor = 0.16
 240 #max_accel_factor = 1.0
 241
 242 [output]
 243 name=DP1
 244 default_output=1
 245 EOF
 246
 247 cat <<EOF >>${path}/systemd/user/weston-user.service
 248 # Wayland socket path is changed to /tmp directory.
 249 [Unit]
 250 Description=Shared weston session
 251
 252 [Service]
 253 ExecStartPre=/usr/bin/ln -sf /tmp/wayland-0 /run/user/%U/
 254 ExecStart=/bin/sh -l -c "/usr/bin/tz-launcher -c /usr/share/applications/tizen/launcher.conf %h/.applications/desktop"
 255 EnvironmentFile=/etc/sysconfig/weston-user
 256
 257 [Install]
 258 WantedBy=default.target
 259 EOF
 260
 261 # Prepare host configuration
 262 cat <<EOF >>/etc/udev/rules.d/99-tty.rules
 263 SUBSYSTEM=="tty", KERNEL=="tty${vt}", OWNER="display", SECLABEL{smack}="^"
 264 EOF
 265
 266 cat <<EOF >/etc/systemd/system/display-manager-run.service
 267 # Run weston with framebuffer backend on tty7.
 268 [Unit]
 269 Description=Weston display daemon
 270
 271 [Service]
 272 User=display
 273 WorkingDirectory=/run/%u
 274 # FIXME: log files shouldn't be stored in tmpfs directories (can get quite big and have side effects)
 275 #ExecStart=/bin/sh -c 'backend=drm ; [ -d /dev/dri ] || backend=fbdev ; exec /usr/bin/weston --backend=$backend-backend.so -i0 --log=/run/%u/weston.log'
 276 ExecStart=/usr/bin/weston --backend=fbdev-backend.so -i0 --log=/run/%u/weston.log
 277 StandardInput=tty
 278 TTYPath=/dev/tty7
 279 EnvironmentFile=/etc/sysconfig/weston
 280 Restart=on-failure
 281 RestartSec=10
 282
 283 #adding the capability to configure ttys
 284 #may be needed if the user 'display' doesn't own the tty
 285 #CapabilityBoundingSet=CAP_SYS_TTY_CONFIG
 286
 287 [Install]
 288 WantedBy=graphical.target
 289 EOF
 290
 291 # Prepare zone configuration file
 292 cat <<EOF >>${path}/config
 293 lxc.utsname = ${name}
 294 lxc.rootfs = ${rootfs}
 295
 296 #lxc.cap.drop = audit_control
 297 #lxc.cap.drop = audit_write
 298 #lxc.cap.drop = mac_admin
 299 #lxc.cap.drop = mac_override
 300 #lxc.cap.drop = mknod
 301 #lxc.cap.drop = setfcap
 302 #lxc.cap.drop = setpcap
 303 #lxc.cap.drop = sys_admin
 304 #lxc.cap.drop = sys_boot
 305 #lxc.cap.drop = sys_chroot #required by SSH
 306 #lxc.cap.drop = sys_module
 307 #lxc.cap.drop = sys_nice
 308 #lxc.cap.drop = sys_pacct
 309 #lxc.cap.drop = sys_rawio
 310 #lxc.cap.drop = sys_resource
 311 #lxc.cap.drop = sys_time
 312 #lxc.cap.drop = sys_tty_config #required by getty
 313
 314 lxc.cgroup.devices.deny = a
 315 lxc.cgroup.devices.allow = c 1:* rwm #/dev/null, /dev/zero, ...
 316 lxc.cgroup.devices.allow = c 5:* rwm #/dev/console, /dev/ptmx, ...
 317 lxc.cgroup.devices.allow = c 136:* rwm #/dev/pts/0 ...
 318 lxc.cgroup.devices.allow = c 10:223 rwm #/dev/uinput
 319 lxc.cgroup.devices.allow = c 13:64 rwm #/dev/input/event0
 320 lxc.cgroup.devices.allow = c 13:65 rwm #/dev/input/event1
 321 lxc.cgroup.devices.allow = c 13:66 rwm #/dev/input/event2
 322 lxc.cgroup.devices.allow = c 13:67 rwm #/dev/input/event3
 323 lxc.cgroup.devices.allow = c 13:68 rwm #/dev/input/event4
 324 lxc.cgroup.devices.allow = c 13:69 rwm #/dev/input/event5
 325 lxc.cgroup.devices.allow = c 13:63 rwm #/dev/input/mice
 326 lxc.cgroup.devices.allow = c 13:32 rwm #/dev/input/mouse0
 327 lxc.cgroup.devices.allow = c 226:0 rwm #/dev/dri/card0
 328 lxc.cgroup.devices.allow = c 2:* rwm #/dev/pty
 329
 330 lxc.pts = 256
 331 lxc.tty = 0
 332 #lxc.console=/dev/tty1
 333 lxc.kmsg = 0
 334
 335 #lxc.cgroup.cpu.shares = 1024
 336 #lxc.cgroup.cpuset.cpus = 0,1,2,3
 337 #lxc.cgroup.memory.limit_in_bytes       = 512M
 338 #lxc.cgroup.memory.memsw.limit_in_bytes = 1G
 339 #lxc.cgroup.blkio.weight                = 500
 340
 341 lxc.mount.auto = proc sys:rw cgroup
 342 lxc.mount = ${path}/fstab
 343
 344 # create a separate network per zone
 345 # - it forbids traffic sniffing (like macvlan in bridge mode)
 346 # - it enables traffic controlling from host using iptables
 347 lxc.network.type = veth
 348 lxc.network.link =  ${br_name}
 349 lxc.network.flags = up
 350 lxc.network.name = eth0
 351 lxc.network.veth.pair = veth-${name}
 352 lxc.network.ipv4.gateway = ${ipv4_gateway}
 353 lxc.network.ipv4 = ${ipv4}/24
 354
 355 lxc.hook.pre-start = ${path}/hooks/pre-start.sh
 356 #lxc.hook.post-stop = ${path}/hooks/post-stop.sh
 357 EOF
 358
 359 # Prepare zone hook files
 360 cat <<EOF >>${path}/hooks/pre-start.sh
 361 if [ -z "\$(/usr/sbin/brctl show | /bin/grep -P "${br_name}\t")" ]
 362 then
 363     /usr/sbin/brctl addbr ${br_name}
 364     /usr/sbin/brctl setfd ${br_name} 0
 365     /sbin/ifconfig ${br_name} ${ipv4_gateway} netmask 255.255.255.0 up
 366 fi
 367 if [ -z "\$(/usr/sbin/iptables -t nat -S | /bin/grep MASQUERADE)" ]
 368 then
 369     /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
 370     /usr/sbin/iptables -t nat -A POSTROUTING -s 10.0.0.0/16 ! -d 10.0.0.0/16 -j MASQUERADE
 371 fi
 372 EOF
 373
 374 chmod 770 ${path}/hooks/pre-start.sh
 375
 376 # Prepare zone fstab file
 377 cat <<EOF >>${path}/fstab
 378 /bin bin none ro,bind 0 0
 379 /etc etc none ro,bind 0 0
 380 ${path}/systemd/system etc/systemd/system none ro,bind 0 0
 381 ${path}/systemd/user etc/systemd/user none ro,bind 0 0
 382 /lib lib none ro,bind 0 0
 383 /media media none ro,bind 0 0
 384 /mnt mnt none ro,bind 0 0
 385 /sbin sbin none ro,bind 0 0
 386 /usr usr none ro,rbind 0 0
 387 /opt opt none rw,rbind 0 0
 388 devtmpfs dev devtmpfs rw,relatime,mode=755 0 0
 389 devpts dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0
 390 /sys/fs/smackfs sys/fs/smackfs none rw,bind 0 0
 391 /var/run/zones/${name}/run var/run none rw,bind 0 0
 392 #tmpfs run tmpfs rw,nosuid,nodev,mode=755 0 0
 393 EOF