github.com/uriddle/docker@v0.0.0-20210926094723-4072e6aeb013/contrib/check-config.sh (about) 1 #!/usr/bin/env bash 2 set -e 3 4 # bits of this were adapted from lxc-checkconfig 5 # see also https://github.com/lxc/lxc/blob/lxc-1.0.2/src/lxc/lxc-checkconfig.in 6 7 possibleConfigs=( 8 '/proc/config.gz' 9 "/boot/config-$(uname -r)" 10 "/usr/src/linux-$(uname -r)/.config" 11 '/usr/src/linux/.config' 12 ) 13 14 if [ $# -gt 0 ]; then 15 CONFIG="$1" 16 else 17 : ${CONFIG:="${possibleConfigs[0]}"} 18 fi 19 20 if ! command -v zgrep &> /dev/null; then 21 zgrep() { 22 zcat "$2" | grep "$1" 23 } 24 fi 25 26 kernelVersion="$(uname -r)" 27 kernelMajor="${kernelVersion%%.*}" 28 kernelMinor="${kernelVersion#$kernelMajor.}" 29 kernelMinor="${kernelMinor%%.*}" 30 31 is_set() { 32 zgrep "CONFIG_$1=[y|m]" "$CONFIG" > /dev/null 33 } 34 is_set_in_kernel() { 35 zgrep "CONFIG_$1=y" "$CONFIG" > /dev/null 36 } 37 is_set_as_module() { 38 zgrep "CONFIG_$1=m" "$CONFIG" > /dev/null 39 } 40 41 color() { 42 local codes=() 43 if [ "$1" = 'bold' ]; then 44 codes=( "${codes[@]}" '1' ) 45 shift 46 fi 47 if [ "$#" -gt 0 ]; then 48 local code= 49 case "$1" in 50 # see https://en.wikipedia.org/wiki/ANSI_escape_code#Colors 51 black) code=30 ;; 52 red) code=31 ;; 53 green) code=32 ;; 54 yellow) code=33 ;; 55 blue) code=34 ;; 56 magenta) code=35 ;; 57 cyan) code=36 ;; 58 white) code=37 ;; 59 esac 60 if [ "$code" ]; then 61 codes=( "${codes[@]}" "$code" ) 62 fi 63 fi 64 local IFS=';' 65 echo -en '\033['"${codes[*]}"'m' 66 } 67 wrap_color() { 68 text="$1" 69 shift 70 color "$@" 71 echo -n "$text" 72 color reset 73 echo 74 } 75 76 wrap_good() { 77 echo "$(wrap_color "$1" white): $(wrap_color "$2" green)" 78 } 79 wrap_bad() { 80 echo "$(wrap_color "$1" bold): $(wrap_color "$2" bold red)" 81 } 82 wrap_warning() { 83 wrap_color >&2 "$*" red 84 } 85 86 check_flag() { 87 if is_set_in_kernel "$1"; then 88 wrap_good "CONFIG_$1" 'enabled' 89 elif is_set_as_module "$1"; then 90 wrap_good "CONFIG_$1" 'enabled (as module)' 91 else 92 wrap_bad "CONFIG_$1" 'missing' 93 fi 94 } 95 96 check_flags() { 97 for flag in "$@"; do 98 echo "- $(check_flag "$flag")" 99 done 100 } 101 102 check_command() { 103 if command -v "$1" >/dev/null 2>&1; then 104 wrap_good "$1 command" 'available' 105 else 106 wrap_bad "$1 command" 'missing' 107 fi 108 } 109 110 check_device() { 111 if [ -c "$1" ]; then 112 wrap_good "$1" 'present' 113 else 114 wrap_bad "$1" 'missing' 115 fi 116 } 117 118 if [ ! -e "$CONFIG" ]; then 119 wrap_warning "warning: $CONFIG does not exist, searching other paths for kernel config ..." 120 for tryConfig in "${possibleConfigs[@]}"; do 121 if [ -e "$tryConfig" ]; then 122 CONFIG="$tryConfig" 123 break 124 fi 125 done 126 if [ ! -e "$CONFIG" ]; then 127 wrap_warning "error: cannot find kernel config" 128 wrap_warning " try running this script again, specifying the kernel config:" 129 wrap_warning " CONFIG=/path/to/kernel/.config $0 or $0 /path/to/kernel/.config" 130 exit 1 131 fi 132 fi 133 134 wrap_color "info: reading kernel config from $CONFIG ..." white 135 echo 136 137 echo 'Generally Necessary:' 138 139 echo -n '- ' 140 cgroupSubsystemDir="$(awk '/[, ](cpu|cpuacct|cpuset|devices|freezer|memory)[, ]/ && $3 == "cgroup" { print $2 }' /proc/mounts | head -n1)" 141 cgroupDir="$(dirname "$cgroupSubsystemDir")" 142 if [ -d "$cgroupDir/cpu" -o -d "$cgroupDir/cpuacct" -o -d "$cgroupDir/cpuset" -o -d "$cgroupDir/devices" -o -d "$cgroupDir/freezer" -o -d "$cgroupDir/memory" ]; then 143 echo "$(wrap_good 'cgroup hierarchy' 'properly mounted') [$cgroupDir]" 144 else 145 if [ "$cgroupSubsystemDir" ]; then 146 echo "$(wrap_bad 'cgroup hierarchy' 'single mountpoint!') [$cgroupSubsystemDir]" 147 else 148 echo "$(wrap_bad 'cgroup hierarchy' 'nonexistent??')" 149 fi 150 echo " $(wrap_color '(see https://github.com/tianon/cgroupfs-mount)' yellow)" 151 fi 152 153 if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = 'Y' ]; then 154 echo -n '- ' 155 if command -v apparmor_parser &> /dev/null; then 156 echo "$(wrap_good 'apparmor' 'enabled and tools installed')" 157 else 158 echo "$(wrap_bad 'apparmor' 'enabled, but apparmor_parser missing')" 159 echo -n ' ' 160 if command -v apt-get &> /dev/null; then 161 echo "$(wrap_color '(use "apt-get install apparmor" to fix this)')" 162 elif command -v yum &> /dev/null; then 163 echo "$(wrap_color '(your best bet is "yum install apparmor-parser")')" 164 else 165 echo "$(wrap_color '(look for an "apparmor" package for your distribution)')" 166 fi 167 fi 168 fi 169 170 flags=( 171 NAMESPACES {NET,PID,IPC,UTS}_NS 172 DEVPTS_MULTIPLE_INSTANCES 173 CGROUPS CGROUP_CPUACCT CGROUP_DEVICE CGROUP_FREEZER CGROUP_SCHED CPUSETS MEMCG 174 MACVLAN VETH BRIDGE BRIDGE_NETFILTER 175 NF_NAT_IPV4 IP_NF_FILTER IP_NF_TARGET_MASQUERADE 176 NETFILTER_XT_MATCH_{ADDRTYPE,CONNTRACK} 177 NF_NAT NF_NAT_NEEDED 178 179 # required for bind-mounting /dev/mqueue into containers 180 POSIX_MQUEUE 181 ) 182 check_flags "${flags[@]}" 183 echo 184 185 echo 'Optional Features:' 186 { 187 check_flags USER_NS 188 } 189 { 190 check_flags SECCOMP 191 } 192 { 193 check_flags MEMCG_KMEM MEMCG_SWAP MEMCG_SWAP_ENABLED 194 if is_set MEMCG_SWAP && ! is_set MEMCG_SWAP_ENABLED; then 195 echo " $(wrap_color '(note that cgroup swap accounting is not enabled in your kernel config, you can enable it by setting boot option "swapaccount=1")' bold black)" 196 fi 197 } 198 199 if [ "$kernelMajor" -lt 3 ] || [ "$kernelMajor" -eq 3 -a "$kernelMinor" -le 18 ]; then 200 check_flags RESOURCE_COUNTERS 201 fi 202 203 if [ "$kernelMajor" -lt 3 ] || [ "$kernelMajor" -eq 3 -a "$kernelMinor" -le 13 ]; then 204 netprio=NETPRIO_CGROUP 205 else 206 netprio=CGROUP_NET_PRIO 207 fi 208 209 flags=( 210 BLK_CGROUP IOSCHED_CFQ BLK_DEV_THROTTLING 211 CGROUP_PERF 212 CGROUP_HUGETLB 213 NET_CLS_CGROUP $netprio 214 CFS_BANDWIDTH FAIR_GROUP_SCHED RT_GROUP_SCHED 215 ) 216 check_flags "${flags[@]}" 217 218 check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY 219 if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then 220 echo " $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)" 221 fi 222 223 check_flags EXT4_FS EXT4_FS_POSIX_ACL EXT4_FS_SECURITY 224 if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then 225 echo " $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)" 226 fi 227 228 echo '- Storage Drivers:' 229 { 230 echo '- "'$(wrap_color 'aufs' blue)'":' 231 check_flags AUFS_FS | sed 's/^/ /' 232 if ! is_set AUFS_FS && grep -q aufs /proc/filesystems; then 233 echo " $(wrap_color '(note that some kernels include AUFS patches but not the AUFS_FS flag)' bold black)" 234 fi 235 236 echo '- "'$(wrap_color 'btrfs' blue)'":' 237 check_flags BTRFS_FS | sed 's/^/ /' 238 239 echo '- "'$(wrap_color 'devicemapper' blue)'":' 240 check_flags BLK_DEV_DM DM_THIN_PROVISIONING | sed 's/^/ /' 241 242 echo '- "'$(wrap_color 'overlay' blue)'":' 243 check_flags OVERLAY_FS | sed 's/^/ /' 244 245 echo '- "'$(wrap_color 'zfs' blue)'":' 246 echo " - $(check_device /dev/zfs)" 247 echo " - $(check_command zfs)" 248 echo " - $(check_command zpool)" 249 } | sed 's/^/ /' 250 echo 251