scripts: respect new unprivileged container model

scripts/container-manager.sh

@@ -8,17 +8,11 @@ set -x
 
 DATA_PATH=$SNAP_COMMON/var/lib/anbox
 ROOTFS_PATH=$DATA_PATH/rootfs
-RAMDISK_PATH=$DATA_PATH/ramdisk
-INITRD=$SNAP/ramdisk.img
-SYSTEM_IMG=$SNAP/system.img
+ANDROID_IMG=$SNAP/android.img
+CONTAINER_BASE_UID=100000
 
-if [ ! -e $INITRD ]; then
-	echo "ERROR: boot ramdisk does not exist"
-	exit 1
-fi
-
-if [ ! -e $SYSTEM_IMG ]; then
-	echo "ERROR: system image does not exist"
+if [ ! -e $ANDROID_IMG ]; then
+	echo "ERROR: android image does not exist"
 	exit 1
 fi
 
@@ -67,24 +61,14 @@ load_kernel_modules() {
 }
 
 start() {
-	# Extract ramdisk content instead of trying to bind mount the
-	# cpio image file to allow modifications.
-	rm -Rf $RAMDISK_PATH
-	mkdir -p $RAMDISK_PATH
-	cd $RAMDISK_PATH
-	cat $INITRD | gzip -d | cpio -i
-
-	# FIXME those things should be fixed in the build process
-	chmod +x $RAMDISK_PATH/anbox-init.sh
-
 	# Setup the read-only rootfs
 	mkdir -p $ROOTFS_PATH
-	mount -o bind,ro $RAMDISK_PATH $ROOTFS_PATH
-	mount -o loop,ro $SYSTEM_IMG $ROOTFS_PATH/system
+	mount -o loop,ro $ANDROID_IMG $ROOTFS_PATH
 
 	# but certain top-level directories need to be in a writable space
 	for dir in cache data; do
 		mkdir -p $DATA_PATH/android-$dir
+		chown $CONTAINER_BASE_UID:$CONTAINER_BASE_UID $DATA_PATH/android-$dir
 		mount -o bind $DATA_PATH/android-$dir $ROOTFS_PATH/$dir
 	done
 
@@ -104,6 +88,9 @@ start() {
 
 	load_kernel_modules
 
+	# Ensure FUSE support for user namespaces is enabled
+	echo Y > /sys/module/fuse/parameters/userns_mounts
+
 	exec $SNAP/usr/sbin/aa-exec -p unconfined -- $SNAP/bin/anbox-wrapper.sh container-manager
 }
 
@@ -111,7 +98,6 @@ stop() {
 	for dir in cache data; do
 		umount $ROOTFS_PATH/$dir
 	done
-	umount $ROOTFS_PATH/system
 	umount $ROOTFS_PATH
 
 	$SNAP/bin/anbox-bridge.sh stop

scripts/create-package.sh

@@ -1,45 +1,34 @@
 #!/bin/bash
 
-TOPDIR=`echo $ANDROID_BUILD_TOP`
-OUTDIR=`echo $ANDROID_PRODUCT_OUT`
-CURDIR=`pwd`
-TARGET=rootfs
+set -ex
 
-if [ -d $TARGET ] ; then
-	rm -rf $TARGET
-fi
+ramdisk=$1
+system=$2
 
-mkdir $TARGET
-cp -r $OUTDIR/root/* $TARGET/
-cp -r $OUTDIR/system/* $TARGET/system/
-
-mkdir $TARGET/cache
-
-find out -name filesystem_config.txt -exec cp {} $TARGET \;
-if [ ! -e $TARGET/filesystem_config.txt ] ; then
-	echo "ERROR: Filesystem config is not available. You have to run"
-	echo "ERROR: $ make target-files-package"
-	echo "ERROR: to generate it as part of the Android build."
-	rm -rf $TARGET
+if [ -z "$ramdisk" ] || [ -z "$system" ]; then
+	echo "Usage: $0 <ramdisk> <system image>"
 	exit 1
 fi
 
-if [ -z "$TOPDIR" ] || [ "$CURDIR" != "$TOPDIR" ] ; then
-	echo "ERROR: You have to execute this script from the ANDROID_BUILD_TOP"
-	echo "ERROR: directory."
-	exit 1
-fi
+workdir=`mktemp -d`
+rootfs=$workdir/rootfs
 
-cp anbox/scripts/anbox-init.sh $TARGET/
-chmod +x $TARGET/anbox-init.sh
+mkdir -p $rootfs
 
-chmod 755 $TARGET/init.*
-chmod 755 $TARGET/default.prop
-chmod 755 $TARGET/system/build.prop
-chmod +x $TARGET/anbox-init.sh
+# Extract ramdisk and preserve ownership of files
+(cd $rootfs ; cat $ramdisk | gzip -d | sudo cpio -i)
 
-TARBALL_NAME=anbox-rootfs-`date +%Y%m%d%H%M`.tar
-tar cf $TARBALL_NAME $TARGET
-rm -rf $TARGET
+mkdir $workdir/system
+sudo mount -o loop,ro $system $workdir/system
+sudo cp -ar $workdir/system/* $rootfs/system
+sudo umount $workdir/system
 
-echo "Created $TARBALL_NAME"
+gcc -o $workdir/uidmapshift external/nsexec/uidmapshift.c
+sudo $workdir/uidmapshift -b $rootfs 0 100000 65536
+
+# FIXME
+sudo chmod +x $rootfs/anbox-init.sh
+
+sudo mksquashfs $rootfs android.img -comp xz -no-xattrs
+
+sudo rm -rf $workdir