templates: improve refusing to run unprivileged

For all templates except lxc-ubuntu-cloud and lxc-download, detect not only --mapped-uid but also --mapped-gid and error out. Detecting will not be done after -- parameter because of non-option parameters. Also, change the mode of lxc-archlinux.in 100755 to 100644. Signed-off-by: TAMUKI Shoichi <tamuki@linet.gr.jp> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

templates: improve refusing to run unprivileged
c63c04fc · TAMUKI Shoichi · Stéphane Graber · 35f74671 · c63c04fc · c63c04fc
Commit c63c04fc authored Feb 06, 2014 by TAMUKI Shoichi Committed by Stéphane Graber Feb 06, 2014
15 changed files
--- a/templates/lxc-alpine.in
+++ b/templates/lxc-alpine.in
 #!/bin/bash
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-altlinux.in
+++ b/templates/lxc-altlinux.in
@@ -25,8 +25,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-archlinux.in
+++ b/templates/lxc-archlinux.in
@@ -26,8 +26,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-busybox.in
+++ b/templates/lxc-busybox.in
@@ -21,8 +21,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-centos.in
+++ b/templates/lxc-centos.in
@@ -73,8 +73,9 @@ lxc_network_link=lxcbr0
 # should be able to use EITHER.  Give preference to /etc/os-release for now.
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-cirros.in
+++ b/templates/lxc-cirros.in
@@ -22,8 +22,9 @@
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-debian.in
+++ b/templates/lxc-debian.in
@@ -21,8 +21,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-fedora.in
+++ b/templates/lxc-fedora.in
@@ -73,8 +73,9 @@ lxc_network_link=lxcbr0
 # should be able to use EITHER.  Give preference to /etc/os-release for now.
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-gentoo.in
+++ b/templates/lxc-gentoo.in
@@ -14,8 +14,9 @@
 #
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-openmandriva.in
+++ b/templates/lxc-openmandriva.in
@@ -27,8 +27,9 @@
 #
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-opensuse.in
+++ b/templates/lxc-opensuse.in
@@ -26,8 +26,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-oracle.in
+++ b/templates/lxc-oracle.in
@@ -28,8 +28,9 @@
 #
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-plamo.in
+++ b/templates/lxc-plamo.in
@@ -29,8 +29,9 @@
 #      lxc-ubuntu script
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-sshd.in
+++ b/templates/lxc-sshd.in
@@ -21,8 +21,9 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1

--- a/templates/lxc-ubuntu.in
+++ b/templates/lxc-ubuntu.in
@@ -25,8 +25,9 @@
 #  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 # Detect use under userns (unsupported)
-for arg in $*; do
+for arg in "$@"; do
-    if [ "$arg" == "--mapped-uid" ]; then
+    [ "$arg" == "--" ] && break
+    if [ "$arg" == "--mapped-uid" -o "$arg" == "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1