#!/bin/bash

#
# lxc: linux Container library

# Authors:
# Daniel Lezcano <daniel.lezcano@free.fr>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.

# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

#
# This script allows to set or remove the capabilities on the lxc tools.
# When the capabilities are set, a non root user can manage the containers.
#

LXC_ATTACH_CAPS="cap_sys_admin,cap_dac_override"
LXC_CREATE_CAPS="cap_sys_admin"
LXC_NETSTAT_CAPS="cap_sys_admin"
LXC_INIT_CAPS="cap_sys_admin,cap_dac_override"
LXC_COMMON_CAPS="cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override"
LXC_UNSHARE_CAPS=$LXC_COMMON_CAPS
LXC_START_CAPS="$LXC_COMMON_CAPS,cap_fowner,cap_sys_chroot,cap_setpcap"
LXC_EXECUTE_CAPS=$LXC_START_CAPS
LXC_RESTART_CAPS="$LXC_START_CAPS,cap_mknod"
LXC_CHECKPOINT_CAPS="$LXC_COMMON_CAPS,cap_sys_ptrace,cap_mknod"
LXC_DROP_CAPS=""

usage() {
    echo "usage: $(basename $0) [-d]" >&2
}

help() {
    usage
    echo >&2
    echo "Set or drop file capabilities on the lxc tools." >&2
    echo >&2
    echo "Options:" >&2
    echo "  -d   drop file capabilities" >&2
}

lxc_setcaps()
{
    setcap $LXC_ATTACH_CAPS=ep /usr/bin/lxc-attach
    setcap $LXC_CREATE_CAPS=ep /usr/bin/lxc-create
    setcap $LXC_EXECUTE_CAPS=ep /usr/bin/lxc-execute
    setcap $LXC_START_CAPS=ep /usr/bin/lxc-start
    setcap $LXC_RESTART_CAPS=ep /usr/bin/lxc-restart
    setcap $LXC_UNSHARE_CAPS=ep /usr/bin/lxc-unshare
    setcap $LXC_NETSTAT_CAPS=ep /usr/bin/lxc-netstat
    setcap $LXC_CHECKPOINT_CAPS=ep /usr/bin/lxc-checkpoint
    setcap $LXC_INIT_CAPS=ep ${libexecdir}/lxc-init

    test -e /var/lib/lxc || mkdir -p /var/lib/lxc
    chmod 0777 /var/lib/lxc
}

lxc_dropcaps()
{
    setcap -r /usr/bin/lxc-attach
    setcap -r /usr/bin/lxc-create
    setcap -r /usr/bin/lxc-execute
    setcap -r /usr/bin/lxc-start
    setcap -r /usr/bin/lxc-restart
    setcap -r /usr/bin/lxc-unshare
    setcap -r /usr/bin/lxc-netstat
    setcap -r /usr/bin/lxc-checkpoint
    setcap -r ${libexecdir}/lxc-init

    chmod 0755 /var/lib/lxc
}

shortoptions='hd'
longoptions='help'

getopt=$(getopt -o $shortoptions --longoptions  $longoptions -- "$@")
if [ $? != 0 ]; then
    usage
    exit 1
fi

eval set -- "$getopt"

while true; do
    case "$1" in
	-d)
	    LXC_DROP_CAPS="yes"
	    shift
	    ;;
	-h|--help)
	    help
	    exit 0
	    ;;
	--)
	    shift
	    break
	    ;;
	*)
	    usage
	    exit 1
	    ;;
    esac
done;

if [ "$(id -u)" != "0" ]; then
   echo "$(basename $0): must be run as root" >&2
   exit 1
fi

if [ -z "$LXC_DROP_CAPS" ]; then
    lxc_setcaps
else
    lxc_dropcaps
fi
