From 461e4bca05c91e89dd07187af51899eac9cb8faa Mon Sep 17 00:00:00 2001 From: Tommy Date: Wed, 7 Feb 2024 10:37:36 -0700 Subject: [PATCH] Fix gVisor Updater Signed-off-by: Tommy --- Generic.ign | 7 ++++++- Generic.yml | 18 ++++++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/Generic.ign b/Generic.ign index 1ab7ba3..af4fe25 100644 --- a/Generic.ign +++ b/Generic.ign @@ -221,7 +221,12 @@ "name": "setsebool.service" }, { - "contents": "[Unit]\nDescription=gVisor Update\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n", + "contents": "[Unit]\nDescription=gVisor Download\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\n\n[Install]\nWantedBy=multi-user.target\n", + "enabled": true, + "name": "gvisor-download.service" + }, + { + "contents": "[Unit]\nDescription=Copy gVisor to the correct location\nAfter=gvisor-download.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n", "enabled": true, "name": "gvisor-updater.service" }, diff --git a/Generic.yml b/Generic.yml index caeddcc..05a3526 100644 --- a/Generic.yml +++ b/Generic.yml @@ -85,15 +85,16 @@ systemd: RemainAfterExit=yes [Install] WantedBy=multi-user.target - - name: gvisor-updater.service + - name: gvisor-download.service enabled: true contents: | [Unit] - Description=gVisor Update + Description=gVisor Download Requires=network-online.target Before=docker.service [Service] + User=unpriv WorkingDirectory=/var/home/unpriv Type=oneshot ExecStart=/usr/bin/sleep 5 @@ -101,6 +102,19 @@ systemd: ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512 ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1 ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512 + + [Install] + WantedBy=multi-user.target + - name: gvisor-updater.service + enabled: true + contents: | + [Unit] + Description=Copy gVisor to the correct location + After=gvisor-download.service + + [Service] + WorkingDirectory=/var/home/unpriv + Type=oneshot ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512 ExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512 ExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1