This file is indexed.

/usr/share/lxc/templates/lxc-fedora is in lxc-templates 2.0.0-0ubuntu2.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

   1
   2
   3
   4
   5
   6
   7
   8
   9
  10
  11
  12
  13
  14
  15
  16
  17
  18
  19
  20
  21
  22
  23
  24
  25
  26
  27
  28
  29
  30
  31
  32
  33
  34
  35
  36
  37
  38
  39
  40
  41
  42
  43
  44
  45
  46
  47
  48
  49
  50
  51
  52
  53
  54
  55
  56
  57
  58
  59
  60
  61
  62
  63
  64
  65
  66
  67
  68
  69
  70
  71
  72
  73
  74
  75
  76
  77
  78
  79
  80
  81
  82
  83
  84
  85
  86
  87
  88
  89
  90
  91
  92
  93
  94
  95
  96
  97
  98
  99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 123
 124
 125
 126
 127
 128
 129
 130
 131
 132
 133
 134
 135
 136
 137
 138
 139
 140
 141
 142
 143
 144
 145
 146
 147
 148
 149
 150
 151
 152
 153
 154
 155
 156
 157
 158
 159
 160
 161
 162
 163
 164
 165
 166
 167
 168
 169
 170
 171
 172
 173
 174
 175
 176
 177
 178
 179
 180
 181
 182
 183
 184
 185
 186
 187
 188
 189
 190
 191
 192
 193
 194
 195
 196
 197
 198
 199
 200
 201
 202
 203
 204
 205
 206
 207
 208
 209
 210
 211
 212
 213
 214
 215
 216
 217
 218
 219
 220
 221
 222
 223
 224
 225
 226
 227
 228
 229
 230
 231
 232
 233
 234
 235
 236
 237
 238
 239
 240
 241
 242
 243
 244
 245
 246
 247
 248
 249
 250
 251
 252
 253
 254
 255
 256
 257
 258
 259
 260
 261
 262
 263
 264
 265
 266
 267
 268
 269
 270
 271
 272
 273
 274
 275
 276
 277
 278
 279
 280
 281
 282
 283
 284
 285
 286
 287
 288
 289
 290
 291
 292
 293
 294
 295
 296
 297
 298
 299
 300
 301
 302
 303
 304
 305
 306
 307
 308
 309
 310
 311
 312
 313
 314
 315
 316
 317
 318
 319
 320
 321
 322
 323
 324
 325
 326
 327
 328
 329
 330
 331
 332
 333
 334
 335
 336
 337
 338
 339
 340
 341
 342
 343
 344
 345
 346
 347
 348
 349
 350
 351
 352
 353
 354
 355
 356
 357
 358
 359
 360
 361
 362
 363
 364
 365
 366
 367
 368
 369
 370
 371
 372
 373
 374
 375
 376
 377
 378
 379
 380
 381
 382
 383
 384
 385
 386
 387
 388
 389
 390
 391
 392
 393
 394
 395
 396
 397
 398
 399
 400
 401
 402
 403
 404
 405
 406
 407
 408
 409
 410
 411
 412
 413
 414
 415
 416
 417
 418
 419
 420
 421
 422
 423
 424
 425
 426
 427
 428
 429
 430
 431
 432
 433
 434
 435
 436
 437
 438
 439
 440
 441
 442
 443
 444
 445
 446
 447
 448
 449
 450
 451
 452
 453
 454
 455
 456
 457
 458
 459
 460
 461
 462
 463
 464
 465
 466
 467
 468
 469
 470
 471
 472
 473
 474
 475
 476
 477
 478
 479
 480
 481
 482
 483
 484
 485
 486
 487
 488
 489
 490
 491
 492
 493
 494
 495
 496
 497
 498
 499
 500
 501
 502
 503
 504
 505
 506
 507
 508
 509
 510
 511
 512
 513
 514
 515
 516
 517
 518
 519
 520
 521
 522
 523
 524
 525
 526
 527
 528
 529
 530
 531
 532
 533
 534
 535
 536
 537
 538
 539
 540
 541
 542
 543
 544
 545
 546
 547
 548
 549
 550
 551
 552
 553
 554
 555
 556
 557
 558
 559
 560
 561
 562
 563
 564
 565
 566
 567
 568
 569
 570
 571
 572
 573
 574
 575
 576
 577
 578
 579
 580
 581
 582
 583
 584
 585
 586
 587
 588
 589
 590
 591
 592
 593
 594
 595
 596
 597
 598
 599
 600
 601
 602
 603
 604
 605
 606
 607
 608
 609
 610
 611
 612
 613
 614
 615
 616
 617
 618
 619
 620
 621
 622
 623
 624
 625
 626
 627
 628
 629
 630
 631
 632
 633
 634
 635
 636
 637
 638
 639
 640
 641
 642
 643
 644
 645
 646
 647
 648
 649
 650
 651
 652
 653
 654
 655
 656
 657
 658
 659
 660
 661
 662
 663
 664
 665
 666
 667
 668
 669
 670
 671
 672
 673
 674
 675
 676
 677
 678
 679
 680
 681
 682
 683
 684
 685
 686
 687
 688
 689
 690
 691
 692
 693
 694
 695
 696
 697
 698
 699
 700
 701
 702
 703
 704
 705
 706
 707
 708
 709
 710
 711
 712
 713
 714
 715
 716
 717
 718
 719
 720
 721
 722
 723
 724
 725
 726
 727
 728
 729
 730
 731
 732
 733
 734
 735
 736
 737
 738
 739
 740
 741
 742
 743
 744
 745
 746
 747
 748
 749
 750
 751
 752
 753
 754
 755
 756
 757
 758
 759
 760
 761
 762
 763
 764
 765
 766
 767
 768
 769
 770
 771
 772
 773
 774
 775
 776
 777
 778
 779
 780
 781
 782
 783
 784
 785
 786
 787
 788
 789
 790
 791
 792
 793
 794
 795
 796
 797
 798
 799
 800
 801
 802
 803
 804
 805
 806
 807
 808
 809
 810
 811
 812
 813
 814
 815
 816
 817
 818
 819
 820
 821
 822
 823
 824
 825
 826
 827
 828
 829
 830
 831
 832
 833
 834
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853
 854
 855
 856
 857
 858
 859
 860
 861
 862
 863
 864
 865
 866
 867
 868
 869
 870
 871
 872
 873
 874
 875
 876
 877
 878
 879
 880
 881
 882
 883
 884
 885
 886
 887
 888
 889
 890
 891
 892
 893
 894
 895
 896
 897
 898
 899
 900
 901
 902
 903
 904
 905
 906
 907
 908
 909
 910
 911
 912
 913
 914
 915
 916
 917
 918
 919
 920
 921
 922
 923
 924
 925
 926
 927
 928
 929
 930
 931
 932
 933
 934
 935
 936
 937
 938
 939
 940
 941
 942
 943
 944
 945
 946
 947
 948
 949
 950
 951
 952
 953
 954
 955
 956
 957
 958
 959
 960
 961
 962
 963
 964
 965
 966
 967
 968
 969
 970
 971
 972
 973
 974
 975
 976
 977
 978
 979
 980
 981
 982
 983
 984
 985
 986
 987
 988
 989
 990
 991
 992
 993
 994
 995
 996
 997
 998
 999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
#!/bin/bash

#
# template script for generating fedora container for LXC
#

#
# lxc: linux Container library

# Authors:
# Daniel Lezcano <daniel.lezcano@free.fr>
# Ramez Hanna <rhanna@informatiq.org>
# Michael H. Warfield <mhw@WittsEnd.com>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.

# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

#Configurations
default_path=/var/lib/lxc

# Some combinations of the tuning knobs below do not exactly make sense.
# but that's ok.
#
# If the "root_password" is non-blank, use it, else set a default.
# This can be passed to the script as an environment variable and is
# set by a shell conditional assignment.  Looks weird but it is what it is.
#
# If the root password contains a ding ($) then try to expand it.
# That will pick up things like ${name} and ${RANDOM}.
# If the root password contains more than 3 consecutive X's, pass it as
# a template to mktemp and take the result.
#
# If root_display_password = yes, display the temporary root password at exit.
# If root_store_password = yes, store it in the configuration directory
# If root_prompt_password = yes, invoke "passwd" to force the user to change
# the root password after the container is created.
# If root_expire_password = yes, you will be prompted to change the root
# password at the first login.
#
# These are conditional assignments...  The can be overridden from the
# preexisting environment variables...
#
# Make sure this is in single quotes to defer expansion to later!
# :{root_password='Root-${name}-${RANDOM}'}
: ${root_password='Root-${name}-XXXXXX'}

# Now, it doesn't make much sense to display, store, and force change
# together.  But, we gotta test, right???
: ${root_display_password='no'}
: ${root_store_password='yes'}
# Prompting for something interactive has potential for mayhem
# with users running under the API...  Don't default to "yes"
: ${root_prompt_password='no'}

# Expire root password? Default to yes, but can be overridden from
# the environment variable
: ${root_expire_password='yes'}

# These are only going into comments in the resulting config...
lxc_network_type=veth
lxc_network_link=lxcbr0

# is this fedora?
# Alow for weird remixes like the Raspberry Pi
#
# Use the Mitre standard CPE identifier for the release ID if possible...
# This may be in /etc/os-release or /etc/system-release-cpe.  We
# should be able to use EITHER.  Give preference to /etc/os-release for now.

# Detect use under userns (unsupported)
for arg in "$@"; do
    [ "$arg" = "--" ] && break
    if [ "$arg" = "--mapped-uid" -o "$arg" = "--mapped-gid" ]; then
        echo "This template can't be used for unprivileged containers." 1>&2
        echo "You may want to try the \"download\" template instead." 1>&2
        exit 1
    fi
done

# Make sure the usual locations are in PATH
export PATH=$PATH:/usr/sbin:/usr/bin:/sbin:/bin

if [ -e /etc/os-release ]
then
# This is a shell friendly configuration file.  We can just source it.
# What we're looking for in here is the ID, VERSION_ID and the CPE_NAME
    . /etc/os-release
    echo "Host CPE ID from /etc/os-release: ${CPE_NAME}"
fi

if [ "${CPE_NAME}" = "" -a -e /etc/system-release-cpe ]
then
    CPE_NAME=$(head -n1 /etc/system-release-cpe)
    CPE_URI=$(expr ${CPE_NAME} : '\([^:]*:[^:]*\)')
    if [ "${CPE_URI}" != "cpe:/o" ]
    then
        CPE_NAME=
    else
        echo "Host CPE ID from /etc/system-release-cpe: ${CPE_NAME}"
        # Probably a better way to do this but sill remain posix
        # compatible but this works, shrug...
        # Must be nice and not introduce convenient bashisms here.
        ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:\([^:]*\)')
        VERSION_ID=$(expr ${CPE_NAME} : '[^:]*:[^:]*:[^:]*:[^:]*:\([^:]*\)')
    fi
fi

if [ "${CPE_NAME}" != "" -a "${ID}" = "fedora" -a "${VERSION_ID}" != "" ]
then
    fedora_host_ver=${VERSION_ID}
    is_fedora=true
elif [ -e /etc/redhat-release ]
then
    # Only if all other methods fail, try to parse the redhat-release file.
    fedora_host_ver=$( sed -e '/^Fedora /!d' -e 's/Fedora.*\srelease\s*\([0-9][0-9]*\)\s.*/\1/' < /etc/redhat-release )
    if [ "$fedora_host_ver" != "" ]
    then
        is_fedora=true
    fi
fi

configure_fedora()
{

    # disable selinux in fedora
    mkdir -p $rootfs_path/selinux
    echo 0 > $rootfs_path/selinux/enforce

    # Also kill it in the /etc/selinux/config file if it's there...
    if [[ -f $rootfs_path/etc/selinux/config ]]
    then
        sed -i '/^SELINUX=/s/.*/SELINUX=disabled/' $rootfs_path/etc/selinux/config
    fi

    # Nice catch from Dwight Engen in the Oracle template.
    # Wantonly plagerized here with much appreciation.
    if [ -f $rootfs_path/usr/sbin/selinuxenabled ]; then
        mv $rootfs_path/usr/sbin/selinuxenabled $rootfs_path/usr/sbin/selinuxenabled.lxcorig
        ln -s /bin/false $rootfs_path/usr/sbin/selinuxenabled
    fi

    # This is a known problem and documented in RedHat bugzilla as relating
    # to a problem with auditing enabled.  This prevents an error in
    # the container "Cannot make/remove an entry for the specified session"
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/login
    sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/sshd

    if [ -f ${rootfs_path}/etc/pam.d/crond ]
    then
        sed -i '/^session.*pam_loginuid.so/s/^session/# session/' ${rootfs_path}/etc/pam.d/crond
    fi

    # In addition to disabling pam_loginuid in the above config files
    # we'll also disable it by linking it to pam_permit to catch any
    # we missed or any that get installed after the container is built.
    #
    # Catch either or both 32 and 64 bit archs.
    if [ -f ${rootfs_path}/lib/security/pam_loginuid.so ]
    then
        ( cd ${rootfs_path}/lib/security/
        mv pam_loginuid.so pam_loginuid.so.disabled
        ln -s pam_permit.so pam_loginuid.so
        )
    fi

    if [ -f ${rootfs_path}/lib64/security/pam_loginuid.so ]
    then
        ( cd ${rootfs_path}/lib64/security/
        mv pam_loginuid.so pam_loginuid.so.disabled
        ln -s pam_permit.so pam_loginuid.so
        )
    fi

    # Set default localtime to the host localtime if not set...
    if [ -e /etc/localtime -a ! -e ${rootfs_path}/etc/localtime ]
    then
        # if /etc/localtime is a symlink, this should preserve it.
        cp -a /etc/localtime ${rootfs_path}/etc/localtime
    fi

    # Deal with some dain bramage in the /etc/init.d/halt script.
    # Trim it and make it our own and link it in before the default
    # halt script so we can intercept it.  This also preventions package
    # updates from interferring with our interferring with it.
    #
    # There's generally not much in the halt script that useful but what's
    # in there from resetting the hardware clock down is generally very bad.
    # So we just eliminate the whole bottom half of that script in making
    # ourselves a copy.  That way a major update to the init scripts won't
    # trash what we've set up.
    #
    # This is mostly for legacy distros since any modern systemd Fedora
    # release will not have this script so we won't try to intercept it.
    if [ -f ${rootfs_path}/etc/init.d/halt ]
    then
        sed -e '/hwclock/,$d' \
            < ${rootfs_path}/etc/init.d/halt \
            > ${rootfs_path}/etc/init.d/lxc-halt

        echo '$command -f' >> ${rootfs_path}/etc/init.d/lxc-halt
        chmod 755 ${rootfs_path}/etc/init.d/lxc-halt

        # Link them into the rc directories...
        (
             cd ${rootfs_path}/etc/rc.d/rc0.d
             ln -s ../init.d/lxc-halt S00lxc-halt
             cd ${rootfs_path}/etc/rc.d/rc6.d
             ln -s ../init.d/lxc-halt S00lxc-reboot
        )
    fi

    # configure the network using the dhcp
    cat <<EOF > ${rootfs_path}/etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
HOSTNAME=${utsname}
DHCP_HOSTNAME=\`hostname\`
NM_CONTROLLED=no
TYPE=Ethernet
MTU=${MTU}
EOF

    # set the hostname
    cat <<EOF > ${rootfs_path}/etc/sysconfig/network
NETWORKING=yes
HOSTNAME=${utsname}
EOF

    # set hostname on systemd Fedora systems
    if [ $release -gt 14 ]; then
        echo "${utsname}" > ${rootfs_path}/etc/hostname
    fi

    # set minimal hosts
    cat <<EOF > $rootfs_path/etc/hosts
127.0.0.1 localhost.localdomain localhost $utsname
::1                 localhost6.localdomain6 localhost6
EOF

    # These mknod's really don't make any sense with modern releases of
    # Fedora with systemd, devtmpfs, and autodev enabled.  They are left
    # here for legacy reasons and older releases with upstart and sysv init.
    dev_path="${rootfs_path}/dev"
    rm -rf $dev_path
    mkdir -p $dev_path
    mknod -m 666 ${dev_path}/null c 1 3
    mknod -m 666 ${dev_path}/zero c 1 5
    mknod -m 666 ${dev_path}/random c 1 8
    mknod -m 666 ${dev_path}/urandom c 1 9
    mkdir -m 755 ${dev_path}/pts
    mkdir -m 1777 ${dev_path}/shm
    mknod -m 666 ${dev_path}/tty c 5 0
    mknod -m 666 ${dev_path}/tty0 c 4 0
    mknod -m 666 ${dev_path}/tty1 c 4 1
    mknod -m 666 ${dev_path}/tty2 c 4 2
    mknod -m 666 ${dev_path}/tty3 c 4 3
    mknod -m 666 ${dev_path}/tty4 c 4 4
    mknod -m 600 ${dev_path}/console c 5 1
    mknod -m 666 ${dev_path}/full c 1 7
    mknod -m 600 ${dev_path}/initctl p
    mknod -m 666 ${dev_path}/ptmx c 5 2

    # setup console and tty[1-4] for login. note that /dev/console and
    # /dev/tty[1-4] will be symlinks to the ptys /dev/lxc/console and
    # /dev/lxc/tty[1-4] so that package updates can overwrite the symlinks.
    # lxc will maintain these links and bind mount ptys over /dev/lxc/*
    # since lxc.devttydir is specified in the config.

    # allow root login on console, tty[1-4], and pts/0 for libvirt
    echo "# LXC (Linux Containers)" >>${rootfs_path}/etc/securetty
    echo "lxc/console"  >>${rootfs_path}/etc/securetty
    echo "lxc/tty1"     >>${rootfs_path}/etc/securetty
    echo "lxc/tty2"     >>${rootfs_path}/etc/securetty
    echo "lxc/tty3"     >>${rootfs_path}/etc/securetty
    echo "lxc/tty4"     >>${rootfs_path}/etc/securetty
    echo "# For libvirt/Virtual Machine Monitor" >>${rootfs_path}/etc/securetty
    echo "pts/0"        >>${rootfs_path}/etc/securetty

    if [ ${root_display_password} = "yes" ]
    then
        echo "Setting root password to '$root_password'"
    fi
    if [ ${root_store_password} = "yes" ]
    then
        touch ${config_path}/tmp_root_pass
        chmod 600 ${config_path}/tmp_root_pass
        echo ${root_password} > ${config_path}/tmp_root_pass
        echo "Storing root password in '${config_path}/tmp_root_pass'"
    fi

    echo "root:$root_password" | chroot $rootfs_path chpasswd

    if [ ${root_expire_password} = "yes" ]
    then
        # Also set this password as expired to force the user to change it!
        chroot $rootfs_path passwd -e root
    fi

    # specifying this in the initial packages doesn't always work.
    # Even though it should have...
    echo "installing fedora-release package"
    mount -o bind /dev ${rootfs_path}/dev
    mount -t proc proc ${rootfs_path}/proc
    # Always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf ${rootfs_path}/etc/
    # Rebuild the rpm database based on the target rpm version...
    rm -f ${rootfs_path}/var/lib/rpm/__db*
    chroot ${rootfs_path} rpm --rebuilddb
    chroot ${rootfs_path} yum -y install fedora-release

    if [[ ! -e ${rootfs_path}/sbin/NetworkManager ]]
    then
        # NetworkManager has not been installed.  Use the
        # legacy chkconfig command to enable the network startup
        # scripts in the container.
        chroot ${rootfs_path} chkconfig network on
    fi

    umount ${rootfs_path}/proc
    umount ${rootfs_path}/dev

    # silence some needless startup errors
    touch ${rootfs_path}/etc/fstab

    # give us a console on /dev/console
    sed -i 's/ACTIVE_CONSOLES=.*$/ACTIVE_CONSOLES="\/dev\/console \/dev\/tty[1-4]"/' \
        ${rootfs_path}/etc/sysconfig/init

    return 0
}

configure_fedora_init()
{
    sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc/rc.sysinit
    sed -i 's|.sbin.start_udev||' ${rootfs_path}/etc/rc.d/rc.sysinit
    # don't mount devpts, for pete's sake
    sed -i 's/^.*dev.pts.*$/#\0/' ${rootfs_path}/etc/rc.sysinit
    sed -i 's/^.*dev.pts.*$/#\0/' ${rootfs_path}/etc/rc.d/rc.sysinit
    chroot ${rootfs_path} chkconfig udev-post off
    chroot ${rootfs_path} chkconfig network on

    if [ -d ${rootfs_path}/etc/init ]
    then
       # This is to make upstart honor SIGPWR.  Should do no harm
       # on systemd systems and some systems may have both.
        cat <<EOF >${rootfs_path}/etc/init/power-status-changed.conf
#  power-status-changed - shutdown on SIGPWR
#
start on power-status-changed
    
exec /sbin/shutdown -h now "SIGPWR received"
EOF
    fi
}

configure_fedora_systemd()
{
    rm -f ${rootfs_path}/etc/systemd/system/default.target
    touch ${rootfs_path}/etc/fstab
    chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/udev.service
    chroot ${rootfs_path} ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
    # Make systemd honor SIGPWR
    chroot ${rootfs_path} ln -s /usr/lib/systemd/system/halt.target /etc/systemd/system/sigpwr.target

    # if desired, prevent systemd from over-mounting /tmp with tmpfs
    if [ $masktmp -eq 1 ]; then
        chroot ${rootfs_path} ln -s /dev/null /etc/systemd/system/tmp.mount
    fi

    #dependency on a device unit fails it specially that we disabled udev
    # sed -i 's/After=dev-%i.device/After=/' ${rootfs_path}/lib/systemd/system/getty\@.service
    #
    # Actually, the After=dev-%i.device line does not appear in the
    # Fedora 17 or Fedora 18 systemd getty\@.service file.  It may be left
    # over from an earlier version and it's not doing any harm.  We do need
    # to disable the "ConditionalPathExists=/dev/tty0" line or no gettys are
    # started on the ttys in the container.  Lets do it in an override copy of
    # the service so it can still pass rpm verifies and not be automatically
    # updated by a new systemd version.  --  mhw  /\/\|=mhw=|\/\/

    sed -e 's/^ConditionPathExists=/# ConditionPathExists=/' \
        -e 's/After=dev-%i.device/After=/' \
        < ${rootfs_path}/lib/systemd/system/getty\@.service \
        > ${rootfs_path}/etc/systemd/system/getty\@.service
    # Setup getty service on the 4 ttys we are going to allow in the
    # default config.  Number should match lxc.tty
    ( cd ${rootfs_path}/etc/systemd/system/getty.target.wants
        for i in 1 2 3 4 ; do ln -sf ../getty\@.service getty@tty${i}.service; done )
}

### BEGIN Bootstrap Environment Code...  Michael H. Warfield /\/\|=mhw=|\/\/

# Ok...  Heads up.  If you're reading these comments, you're either a
# template owner or someone wondering how the hell I did this (or, worse,
# someone in the future trying to maintain it).  This code is slightly
# "evil coding bastard" code with one significant hack / dirty trick
# that you would probably miss just reading the code below.  I'll mark
# it out with comments.
#
# Because of what this code does, it deserves a lot of comments so people
# can understand WHY I did it this way...
#
# Ultimate Objective - Build a Fedora container on a host system which does
# not have a (complete compatible) version of rpm and/or yum.  That basically
# means damn near any distro other than Fedora and Ubuntu (which has rpm and
# yum available).  Only requirements for this function are rsync and
# squashfs available to the kernel.  If you don't have those, why are you
# even attempting to build containers?
#
# Challenge for this function - Bootstrap a Fedora install bootstrap
# run time environment which has all the pieces to run rpm and yum and
# from which we can build targets containers even where the host system
# has no support for rpm, yum, or fedora.
#
# Steps:
#       Stage 0 - Download a Fedora LiveOS squashfs core (netinst core).
#       Stage 1 - Extract filesystem from Stage 0 and update to full rpm & yum
#       Stage 2 - Use Stage 1 to build a rootfs with python, rpm, and yum.
#
#       Stage 2 becomes our bootstrap file system which can be cached
#       and then used to build other arbitrary vesions of Fedora of a
#       given architecture.  Note that this only has to run once for
#       Fedora on a given architecture since rpm and yum can build other
#       versions.  We'll arbitrarily pick Fedora 20 to build this.  This
#       will need to change as time goes on.

# Programmers Note...  A future fall back may be to download the netinst
#       iso image instead of the LiveOS squasfs image and work from that.
#       That may be more general but will introduce another substep
#       (mounting the iso) to the stage0 setup.

# This system is designed to be as autonomous as possible so all whitelists
# and controls are self-contained.

# Initial testing - Whitelist nobody.  Build for everybody...
# Initial deployment - Whitelist Fedora.
# Long term - Whitelist Fedora, Debian, Ubuntu, CentOs, Scientific, and NST.

# List of distros which do not (should not) need a bootstrap (but we will test
# for rpm and yum none the less...  OS SHOULD be taken from CPE values but
# Debian / Ubuntu doesn't support CPE yet.

# BOOTSTRAP_WHITE_LIST=""
BOOTSTRAP_WHITE_LIST="fedora"
# BOOTSTRAP_WHITE_LIST="fedora debian ubuntu centos scientific sl nst"

BOOTSTRAP=0
BOOTSTRAP_DIR=
BOOTSTRAP_CHROOT=

fedora_get_bootstrap()
{
    echo "Bootstrap Environment testing..."

    WHITE_LISTED=1

    # We need rpm.  No rpm - not possible to white list...
    if ! which rpm > /dev/null 2>&1
    then
        WHITE_LISTED=0
    fi

    # We need yum  No yum - not possible to white list...
    if ! which yum > /dev/null 2>&1
    then
        WHITE_LISTED=0
    fi

    if [[ ${WHITE_LISTED} != 0 ]]
    then
        for OS in ${BOOTSTRAP_WHITE_LIST}
        do
            if [[ ${ID} = ${OS} ]]
            then
                echo "
OS ${ID} is whitelisted.  Installation Bootstrap Environment not required.
"
                return 0;
            fi
        done
    fi

    echo "
Fedora Installation Bootstrap Build..."

    if ! which rsync > /dev/null 2>&1
    then
        echo "
Unable to locate rsync.  Cravely bailing out before even attempting to build
an Installation Bootstrap  Please install rsync and then rerun this process.
"

        return 255
    fi

    [[ -d ${cache_base} ]] || mkdir -p ${cache_base}

    cd ${cache_base}

    # We know we don't have a cache directory of this version or we
    # would have never reached this code to begin with.  But we may
    # have another Fedora cache directory from which we could run...
    # We'll give a preference for close matches preferring higher over
    # lower - which makes for really ugly code...

    # Is this a "bashism" that will need cleaning up????
    BOOTSTRAP_LIST="$(( $release + 1 ))/rootfs $(( $release - 1 ))/rootfs \
$(( $release + 2 ))/rootfs $(( $release - 2 ))/rootfs \
$(( $release + 3 ))/rootfs $(( $release - 3 ))/rootfs \
bootstrap"

    for bootstrap in ${BOOTSTRAP_LIST}
    do
        if [[ -d ${bootstrap} ]]
        then
            echo "
Existing Bootstrap found.  Testing..."

            mount -o bind /dev ${bootstrap}/dev
            mount -t proc proc ${bootstrap}/proc
            # Always make sure /etc/resolv.conf is up to date in the target!
            cp /etc/resolv.conf ${bootstrap}/etc/
            rm -f ${bootstrap}/var/lib/rpm/__db*
            chroot ${bootstrap} rpm --rebuilddb
            chroot ${bootstrap} yum -y update
            RC=$?
            umount ${bootstrap}/proc
            umount ${bootstrap}/dev

            if [[ 0 == ${RC} ]]
            then
                BOOTSTRAP=1
                BOOTSTRAP_DIR="${cache_base}/${bootstrap}"
                BOOTSTRAP_CHROOT="chroot ${BOOTSTRAP_DIR} "
                BOOTSTRAP_INSTALL_ROOT=/run/install

            echo "
Functional Installation Bootstrap exists and appears to be completed.
Will use existing Bootstrap:  ${BOOTSTRAP_DIR}
"
            return 0
        fi
        echo "
Installation Bootstrap in ${BOOTSTRAP_DIR} exists
but appears to be non-functional.  Skipping...  It should be removed.
"
    fi
    done

    TMP_BOOTSTRAP_DIR=$( mktemp -d --tmpdir=${cache_base} bootstrap_XXXXXX )

    cd ${TMP_BOOTSTRAP_DIR}

    mkdir squashfs stage0 stage1 bootstrap

### Stage 0 setup.
#       Download the LiveOS squashfs image
#       mount image to "squashfs"
#       mount contained LiveOS to stage0

# We're going to use the archives.fedoraproject.org mirror for the initial stages...
#       1 - It's generally up to date and complete
#       2 - It's has high bandwidth access
#       3 - It supports rsync and wildcarding (and we need both)
#       4 - Not all the mirrors carry the LiveOS images

    if [[ ! -f ../LiveOS/squashfs.img ]]
    then
        echo "
Downloading stage 0 LiveOS squashfs file system from archives.fedoraproject.org...
Have a beer or a cup of coffee.  This will take a bit (~300MB).
"
        sleep 3 # let him read it...

        # Right now, we are using Fedora 20 for the inial bootstrap.
        # We could make this the "current" Fedora rev (F > 15).

        rsync -av ${mirrorurl}/fedora/linux/releases/20/Fedora/$basearch/os/LiveOS .

        if [[ 0 == $? ]]
        then
            echo "Download of squashfs image complete."
            mv LiveOS ..
        else
            echo "
Download of squashfs image failed.
"
            return 255
        fi
    else
        echo "Using cached stage 0 LiveOS squashfs file system."
    fi

    mount -o loop ../LiveOS/squashfs.img squashfs

    if [[ $? != 0 ]]
    then
        echo "
Mount of LiveOS squashfs image failed!  You mush have squashfs support
available to mount image.  Unable to continue.  Correct and retry
process later!  LiveOS image not removed.  Process may be rerun
without penalty of downloading LiveOS again.  If LiveOS is corrupt,
remove ${cache_base}/LiveOS before rerunning to redownload.
"
        return 255
    fi

    mount -o loop squashfs/LiveOS/rootfs.img stage0

    if [[ $? != 0 ]]
    then
        echo "
Mount of LiveOS stage0 rootfs image failed!  LiveOS download may be corrupt.
Remove ${cache_base}/LiveOS to force a new download or
troubleshoot cached image and then rerun process.
"
        return 255
    fi


### Stage 1 setup.
#       Copy stage0 (which is ro) to stage1 area (rw) for modification.
#       Unmount stage0 mounts - we're done with stage 0 at this point.
#       Download our rpm and yum rpm packages.
#       Force install of rpm and yum into stage1 image (dirty hack!)

    echo "Stage 0 complete, building Stage 1 image...
This will take a couple of minutes.  Patience..."

    echo "Creating Stage 1 r/w copy of r/o Stage 0 squashfs image from LiveOS."

    rsync -aAHS stage0/. stage1/

    umount stage0
    umount squashfs

    cd stage1

    # Setup stage1 image with pieces to run installs...


    mount -o bind /dev dev
    mount -t proc proc proc
    # Always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf etc/

    mkdir run/install

    echo "Updating Stage 1 image with full rpm and yum packages"

    # Retrieve our 2 rpm packages we need to force down the throat
    # of this LiveOS image we're camped out on.  This is the beginning
    # of the butt ugly hack.  Look close or you may missing it...

    rsync -av ${mirrorurl}/fedora/linux/releases/20/Fedora/$basearch/os/Packages/r/rpm-[0-9]* \
        ${mirrorurl}/fedora/linux/releases/20/Fedora/$basearch/os/Packages/y/yum-[0-9]* .

    # And here it is...
    # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
    chroot . rpm -ivh --nodeps rpm-* yum-*
    # Did you catch it?

    # The LiveOS image contains rpm (but not rpmdb) and yum (but not
    # yummain.py - What the hell good does yum do with no
    # yummain.py?!?! - Sigh...).  It contains all the supporting
    # pieces but the rpm database has not be initialized and it
    # doesn't know all the dependences (seem to) have been met.
    # So we do a "--nodeps" rpm install in the chrooted environment
    # to force the installation of the full rpm and yum packages.
    #
    # For the purists - Yes, I know the rpm database is wildly out
    # of whack now.  That's why this is a butt ugly hack / dirty trick.
    # But, this is just the stage1 image that we are going to discard as
    # soon as the stage2 image is built, so we don't care.  All we care
    # is that the stage2 image ends up with all the pieces it need to
    # run yum and rpm and that the stage2 rpm database is coherent.
    #
    # NOW we can really go to work!

### Stage 2 setup.
#       Download our Fedora Release rpm packages.
#       Install fedora-release into bootstrap to initialize fs and databases.
#       Install rpm, and yum into bootstrap image using yum

    echo "Stage 1 creation complete.  Building stage 2 Installation Bootstrap"

    mount -o bind ../bootstrap run/install
    rsync -av ${mirrorurl}/fedora/linux/releases/20/Fedora/$basearch/os/Packages/f/fedora-release-20* .

    # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
    chroot . rpm --root /run/install --nodeps -ivh fedora-release-*

    # yum will take $basearch from host, so force the arch we want
    sed -i "s|\$basearch|$basearch|" ./run/install/etc/yum.repos.d/*

    chroot . yum -y --nogpgcheck --installroot /run/install install python rpm yum

    umount run/install
    umount proc
    umount dev

#       That's it!  We should now have a viable installation BOOTSTRAP in
#       bootstrap  We'll do a yum update in that to verify and then
#       move it to the cache location before cleaning up.

    cd ../bootstrap
    mount -o bind /dev dev
    mount -t proc proc proc
    # Always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf etc/

    # yum will take $basearch from host, so force the arch we want
    sed -i "s|\$basearch|$basearch|" ./etc/yum.repos.d/*

    chroot . yum -y update

    RC=$?

    umount proc
    umount dev

    cd ..

    if [[ ${RC} != 0 ]]
    then
        echo "
Build of Installation Bootstrap failed.  Temp directory
not removed so it can be investigated.
"
        return 255
    fi

    # We know have a working run time environment in rootfs...
    mv bootstrap ..
    cd ..
    rm -rf ${TMP_BOOTSTRAP_DIR}

    echo "
Build of Installation Bootstrap complete!  We now return you to your
normally scheduled template creation.
"

    BOOTSTRAP=1
    BOOTSTRAP_DIR="${cache_base}/bootstrap"
    BOOTSTRAP_CHROOT="chroot ${BOOTSTRAP_DIR} "
    BOOTSTRAP_INSTALL_ROOT=/run/install

    return 0
}


fedora_bootstrap_mounts()
{
    if [[ ${BOOTSTRAP} -ne 1 ]]
    then
        return 0
    fi

    BOOTSTRAP_CHROOT="chroot ${BOOTSTRAP_DIR} "

    echo "Mounting Bootstrap mount points"

    [[ -d ${BOOTSTRAP_DIR}/run/install ]] || mkdir -p ${BOOTSTRAP_DIR}/run/install

    mount -o bind ${INSTALL_ROOT} ${BOOTSTRAP_DIR}/run/install
    mount -o bind /dev ${BOOTSTRAP_DIR}/dev
    mount -t proc proc ${BOOTSTRAP_DIR}/proc
    # Always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf ${BOOTSTRAP_DIR}/etc/
}

fedora_bootstrap_umounts()
{
    if [[ ${BOOTSTRAP} -ne 1 ]]
    then
        return 0
    fi

    umount ${BOOTSTRAP_DIR}/proc
    umount ${BOOTSTRAP_DIR}/dev
    umount ${BOOTSTRAP_DIR}/run/install
}


# This is the code to create the initial roofs for Fedora.  It may
# require a run time environment by calling the routines above...

download_fedora()
{

    # check the mini fedora was not already downloaded
    INSTALL_ROOT=$cache/partial
    mkdir -p $INSTALL_ROOT
    if [ $? -ne 0 ]; then
        echo "Failed to create '$INSTALL_ROOT' directory"
        return 1
    fi

    # download a mini fedora into a cache
    echo "Downloading fedora minimal ..."

    # These will get changed if it's decided that we need a
    # boostrap environment (can not build natively).  These
    # are the defaults for the non-boostrap (native) mode.

    BOOTSTRAP_INSTALL_ROOT=${INSTALL_ROOT}
    BOOTSTRAP_CHROOT=
    BOOTSTRAP_DIR=

    PKG_LIST="yum initscripts passwd rsyslog vim-minimal openssh-server openssh-clients dhclient chkconfig rootfiles policycoreutils fedora-release"
    MIRRORLIST_URL="http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-$release&arch=$basearch"

    if [[ ${release} -lt 17 ]]
    then
        # The reflects the move of db_dump and db_load from db4_utils to
        # libdb_utils in Fedora 17 and above and it's inclusion as a dep...
        # Prior to Fedora 11, we need to explicitly include it!
        PKG_LIST="${PKG_LIST} db4-utils"
    fi

    if [[ ${release} -ge 21 ]]
    then
        # Since Fedora 21, a separate fedora-repos package is needed.
        # Before, the information was conained in fedora-release.
        PKG_LIST="${PKG_LIST} fedora-repos"
    fi

    DOWNLOAD_OK=no

    # We're splitting the old loop into two loops plus a directory retrival.
    # First loop...  Try and retrive a mirror list with retries and a slight
    # delay between attempts...
    for trynumber in 1 2 3 4; do
        [ $trynumber != 1 ] && echo "Trying again..."
        # This code is mildly "brittle" in that it assumes a certain
        # page format and parsing HTML.  I've done worse.  :-P
        MIRROR_URLS=$(curl -s -S -f "$MIRRORLIST_URL" | sed -e '/^http:/!d' -e '2,6!d')
        if [ $? -eq 0 ] && [ -n "$MIRROR_URLS" ]
        then
            break
        fi

        echo "Failed to get a mirror on try $trynumber"
        sleep 3
     done

     # This will fall through if we didn't get any URLS above
     for MIRROR_URL in ${MIRROR_URLS}
     do
        if [ "$release" -gt "16" ]; then
            RELEASE_URL="$MIRROR_URL/Packages/f"
        else
            RELEASE_URL="$MIRROR_URL/Packages/"
        fi

        echo "Fetching release rpm name from $RELEASE_URL..."
        # This code is mildly "brittle" in that it assumes a certain directory
        # page format and parsing HTML.  I've done worse.  :-P
        RELEASE_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-release-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
        if [ $? -ne 0  -o "${RELEASE_RPM}" = "" ]; then
            echo "Failed to identify fedora release rpm."
            continue
        fi

        echo "Fetching fedora release rpm from ${RELEASE_URL}/${RELEASE_RPM}......"
        curl -L -f "${RELEASE_URL}/${RELEASE_RPM}" > ${INSTALL_ROOT}/${RELEASE_RPM}
        if [ $? -ne 0 ]; then
            echo "Failed to download fedora release rpm ${RELEASE_RPM}."
            continue
        fi

        # F21 and newer need fedora-repos in addition to fedora-release.
        if [ "$release" -ge "21" ]; then
          echo "Fetching repos rpm name from $RELEASE_URL..."
          REPOS_RPM=$(curl -L -f "$RELEASE_URL" | sed -e "/fedora-repos-${release}-/!d" -e 's/.*<a href=\"//' -e 's/\">.*//' )
          if [ $? -ne 0  -o "${REPOS_RPM}" = "" ]; then
              echo "Failed to identify fedora repos rpm."
              continue
          fi

          echo "Fetching fedora repos rpm from ${RELEASE_URL}/${REPOS_RPM}..."
          curl -L -f "${RELEASE_URL}/${REPOS_RPM}" > ${INSTALL_ROOT}/${REPOS_RPM}
          if [ $? -ne 0 ]; then
              echo "Failed to download fedora repos rpm ${RELEASE_RPM}."
              continue
          fi
        fi


        DOWNLOAD_OK=yes
        break
    done

    if [ $DOWNLOAD_OK != yes ]; then
        echo "Aborting"
        return 1
    fi

    mkdir -p ${INSTALL_ROOT}/var/lib/rpm

    if ! fedora_get_bootstrap
    then
        echo "Fedora Bootstrap setup failed"
        return 1
    fi

    fedora_bootstrap_mounts

    ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --initdb

    # The --nodeps is STUPID but F15 had a bogus dependency on RawHide?!?!
    ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} --nodeps -ivh ${BOOTSTRAP_INSTALL_ROOT}/${RELEASE_RPM}

    # F21 and newer need fedora-repos in addition to fedora-release...
    # Note that fedora-release and fedora-system have a mutual dependency.
    # So installing the reops package after the release package we can
    # spare one --nodeps.
    if [ "$release" -ge "21" ]; then
      ${BOOTSTRAP_CHROOT}rpm --root ${BOOTSTRAP_INSTALL_ROOT} -ivh ${BOOTSTRAP_INSTALL_ROOT}/${REPOS_RPM}
    fi

    # yum will take $basearch from host, so force the arch we want
    sed -i "s|\$basearch|$basearch|" ${BOOTSTRAP_DIR}/${BOOTSTRAP_INSTALL_ROOT}/etc/yum.repos.d/*

    ${BOOTSTRAP_CHROOT}yum --installroot ${BOOTSTRAP_INSTALL_ROOT} -y --nogpgcheck install ${PKG_LIST}

    RC=$?

    if [[ ${BOOTSTRAP} -eq 1 ]]
    then
    # Here we have a bit of a sticky problem.  We MIGHT have just installed
    # this template cache using versions of yum and rpm in the bootstrap
    # chroot that use a different database version than the target version.
    # That can be a very big problem.  Solution is to rebuild the rpmdatabase
    # with the target database now that we are done building the cache.  In the
    # vast majority of cases, this is a do-not-care with no harm done if we
    # didn't do it.  But it catches several corner cases with older unsupported
    # releases and it really doesn't cost us a lot of time for a one shot
    # install that will never be done again for this rev.
    #
    # Thanks and appreciation to Dwight Engen and the Oracle template for the
    # database rewrite hint!

        echo "Fixing up rpm databases"

        # Change to our target install directory (if we're not already
        # there) just to simplify some of the logic to follow...
        cd ${INSTALL_ROOT}

        rm -f var/lib/rpm/__db*
        # Programmers Note (warning):
        #
        # Pay careful attention to the following commands!  It
        # crosses TWO chroot boundaries linked by a bind mount!
        # In the bootstrap case, that's the bind mount of ${INSTALL_ROOT}
        # to the ${BOOTSTRAP_CHROOT}/run/install directory!  This is
        # a deliberate hack across that bind mount to do a database
        # translation between two environments, neither of which may
        # be the host environment!  It's ugly and hard to follow but,
        # if you don't understand it, don't mess with it!  The pipe
        # is in host space between the two chrooted environments!
        # This is also why we cd'ed into the INSTALL_ROOT directory
        # in advance of this loop, so everything is relative to the
        # current working directory and congruent with the same working
        # space in both chrooted environments.  The output into the new
        # db is also done in INSTALL_ROOT space but works in either host
        # space or INSTALL_ROOT space for the mv, so we don't care.  It's
        # just not obvious what's happening in the db_dump and db_load
        # commands...
        #
        for db in var/lib/rpm/* ; do
            ${BOOTSTRAP_CHROOT} db_dump ${BOOTSTRAP_INSTALL_ROOT}/$db | chroot . db_load $db.new
            mv $db.new $db
        done
        # finish up by rebuilding the database...
        # This should be redundant but we do it for completeness and
        # any corner cases I may have missed...
        mount -t proc proc proc
        mount -o bind /dev dev
        chroot . rpm --rebuilddb
        umount dev
        umount proc
    fi

    fedora_bootstrap_umounts

    if [ ${RC} -ne 0 ]; then
        echo "Failed to download the rootfs, aborting."
        return 1
    fi

    mv "$INSTALL_ROOT" "$cache/rootfs"
    echo "Download complete."

    return 0
}

copy_fedora()
{

    # make a local copy of the minifedora
    echo -n "Copying rootfs to $rootfs_path ..."
    #cp -a $cache/rootfs-$basearch $rootfs_path || return 1
    # i prefer rsync (no reason really)
    mkdir -p $rootfs_path
    rsync -Ha $cache/rootfs/ $rootfs_path/
    echo
    return 0
}

update_fedora()
{
    mount -o bind /dev ${cache}/rootfs/dev
    mount -t proc proc ${cache}/rootfs/proc
    # Always make sure /etc/resolv.conf is up to date in the target!
    cp /etc/resolv.conf ${cache}/rootfs/etc/
    chroot ${cache}/rootfs yum -y update
    umount ${cache}/rootfs/proc
    umount  ${cache}/rootfs/dev
}

install_fedora()
{
    mkdir -p /var/lock/subsys/
    (
        flock -x 9
        if [ $? -ne 0 ]; then
            echo "Cache repository is busy."
            return 1
        fi

        echo "Checking cache download in $cache/rootfs ... "
        if [ ! -e "$cache/rootfs" ]; then
            download_fedora
            if [ $? -ne 0 ]; then
                echo "Failed to download 'fedora base'"
                return 1
            fi
        else
            echo "Cache found. Updating..."
            update_fedora
            if [ $? -ne 0 ]; then
                echo "Failed to update 'fedora base', continuing with last known good cache"
            else
                echo "Update finished"
            fi
        fi

        echo "Copy $cache/rootfs to $rootfs_path ... "
        copy_fedora
        if [ $? -ne 0 ]; then
            echo "Failed to copy rootfs"
            return 1
        fi

        return 0
    ) 9>/var/lock/subsys/lxc-fedora

    return $?
}

# Generate a random hardware (MAC) address composed of FE followed by
# 5 random bytes...
create_hwaddr()
{
    openssl rand -hex 5 | sed -e 's/\(..\)/:\1/g; s/^/fe/'
}

copy_configuration()
{
    mkdir -p $config_path

    grep -q "^lxc.rootfs" $config_path/config 2>/dev/null || echo "
lxc.rootfs = $rootfs_path
" >> $config_path/config

    # The following code is to create static MAC addresses for each
    # interface in the container.  This code will work for multiple
    # interfaces in the default config.  It will also strip any
    # hwaddr stanzas out of the default config since we can not share
    # MAC addresses between containers.
    mv $config_path/config $config_path/config.def
    while read LINE
    do
        # This should catch variable expansions from the default config...
        if expr "${LINE}" : '.*\$' > /dev/null 2>&1
        then
                LINE=$(eval "echo \"${LINE}\"")
        fi

        # There is a tab and a space in the regex bracket below!
        # Seems that \s doesn't work in brackets.
        KEY=$(expr "${LINE}" : '\s*\([^	 ]*\)\s*=')

        if [[ "${KEY}" != "lxc.network.hwaddr" ]]
        then
            echo "${LINE}" >> $config_path/config

            if [[ "${KEY}" == "lxc.network.link" ]]
            then
                echo "lxc.network.hwaddr = $(create_hwaddr)" >> $config_path/config
            fi
        fi
    done < $config_path/config.def

    rm -f $config_path/config.def

    if [ -e "/usr/share/lxc/config/fedora.common.conf" ]; then
        echo "
# Include common configuration
lxc.include = /usr/share/lxc/config/fedora.common.conf
" >> $config_path/config
    fi

    # Append things which require expansion here...
    cat <<EOF >> $config_path/config
lxc.arch = $arch
lxc.utsname = $utsname

# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined

# example simple networking setup, uncomment to enable
#lxc.network.type = $lxc_network_type
#lxc.network.flags = up
#lxc.network.link = $lxc_network_link
#lxc.network.name = eth0
# Additional example for veth network type
#    static MAC address,
#lxc.network.hwaddr = 00:16:3e:77:52:20
#    persistent veth device name on host side
#        Note: This may potentially collide with other containers of same name!
#lxc.network.veth.pair = v-$name-e0

EOF

    if [ $? -ne 0 ]; then
        echo "Failed to add configuration"
        return 1
    fi

    return 0
}

clean()
{

    if [ ! -e $cache ]; then
        exit 0
    fi

    # lock, so we won't purge while someone is creating a repository
    (
        flock -x 9
        if [ $? != 0 ]; then
            echo "Cache repository is busy."
            exit 1
        fi

        echo -n "Purging the download cache for Fedora-$release..."
        rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
        exit 0
    ) 9>/var/lock/subsys/lxc-fedora
}

usage()
{
    cat <<EOF
usage:
    $1 -n|--name=<container_name>
        [-p|--path=<path>] [-c|--clean] [-R|--release=<Fedora_release>]
        [--fqdn=<network name of container>] [-a|--arch=<arch of the container>]
        [--mask-tmp]
        [-h|--help]
Mandatory args:
  -n,--name         container name, used to as an identifier for that container
Optional args:
  -p,--path         path to where the container will be created,
                    defaults to /var/lib/lxc.
  --rootfs          path for actual rootfs.
  -c,--clean        clean the cache
  -R,--release      Fedora release for the new container.
                    Defaults to host's release if the host is Fedora.
     --fqdn         fully qualified domain name (FQDN) for DNS and system naming
  -a,--arch         Define what arch the container will be [i686,x86_64]
  --mask-tmp        Prevent systemd from over-mounting /tmp with tmpfs.
  -h,--help         print this help
EOF
    return 0
}

options=$(getopt -o a:hp:n:cR: -l help,path:,rootfs:,name:,clean,release:,arch:,fqdn:,mask-tmp -- "$@")
if [ $? -ne 0 ]; then
    usage $(basename $0)
    exit 1
fi

arch=$(uname -m)
masktmp=0

eval set -- "$options"
while true
do
    case "$1" in
        -h|--help)      usage $0 && exit 0;;
        -p|--path)      path=$2; shift 2;;
        --rootfs)       rootfs_path=$2; shift 2;;
        -n|--name)      name=$2; shift 2;;
        -c|--clean)     clean=1; shift 1;;
        -R|--release)   release=$2; shift 2;;
        -a|--arch)      newarch=$2; shift 2;;
        --fqdn)         utsname=$2; shift 2;;
        --mask-tmp)     masktmp=1; shift 1;;
        --)             shift 1; break ;;
        *)              break ;;
    esac
done

if [ ! -z "$clean" -a -z "$path" ]; then
    clean || exit 1
    exit 0
fi

basearch=${arch}
# Map a few architectures to their generic Fedora repository archs.
# The two ARM archs are a bit of a guesstimate for the v5 and v6
# archs.  V6 should have hardware floating point (Rasberry Pi).
# The "arm" arch is safer (no hardware floating point).  So
# there may be cases where we "get it wrong" for some v6 other
# than RPi.
case "$arch" in
i686) basearch=i386 ;;
armv3l|armv4l|armv5l) basearch=arm ;;
armv6l|armv7l|armv8l) basearch=armhfp ;;
*) ;;
esac

mirrorurl="archives.fedoraproject.org::fedora-archive"
case "$basearch" in
ppc64|s390x) mirrorurl="archives.fedoraproject.org::fedora-secondary" ;;
*) ;;
esac

# Somebody wants to specify an arch.  This is very limited case.
#       i386/i586/i686 on i386/x86_64
#           - or -
#       x86_64 on x86_64
if [ "${newarch}" != "" -a "${newarch}" != "${arch}" ]
then
    case "${newarch}" in
        i386|i586|i686)
            if [ "${basearch}" = "i386" -o "${basearch}" = "x86_64" ]
            then
                # Make the arch a generic x86 32 bit...
            arch=${newarch}
                basearch=i386
            else
                basearch=bad
            fi
            ;;
        *)
            basearch=bad
            ;;
    esac

    if [ "${basearch}" = "bad" ]
    then
        echo "You cannot build a ${newarch} Fedora container on a ${arch} host.  Sorry!"
        exit 1
    fi
fi

# Allow the cache base to be set by environment variable
cache_base=${LXC_CACHE_PATH:-"/var/cache/lxc"}/fedora/$basearch

# Let's do something better for the initial root password.
# It's not perfect but it will defeat common scanning brute force
# attacks in the case where ssh is exposed.  It will also be set to
# expired, forcing the user to change it at first login.
if [ "${root_password}" = "" ]
then
    root_password=Root-${name}-${RANDOM}
else
    # If it's got a ding in it, try and expand it!
    if [ $(expr "${root_password}" : '.*$.') != 0 ]
    then
        root_password=$(eval echo "${root_password}")
    fi

    # If it has more than 3 consecutive X's in it, feed it
    # through mktemp as a template.
    if [ $(expr "${root_password}" : '.*XXXX') != 0 ]
    then
        root_password=$(mktemp -u ${root_password})
    fi
fi

if [ -z "${utsname}" ]; then
    utsname=${name}
fi

# This follows a standard "resolver" convention that an FQDN must have
# at least two dots or it is considered a local relative host name.
# If it doesn't, append the dns domain name of the host system.
#
# This changes one significant behavior when running
# "lxc_create -n Container_Name" without using the
# --fqdn option.
#
# Old behavior:
#    utsname and hostname = Container_Name
# New behavior:
#    utsname and hostname = Container_Name.Domain_Name

if [ $(expr "$utsname" : '.*\..*\.') = 0 ]; then
    if [[ "$(dnsdomainname)" != "" && "$(dnsdomainname)" != "localdomain" ]]; then
        utsname=${utsname}.$(dnsdomainname)
    fi
fi

needed_pkgs=""

type curl >/dev/null 2>&1
if [ $? -ne 0 ]; then
    needed_pkgs="curl $needed_pkgs"
fi

if [ -n "$needed_pkgs" ]; then
    echo "Missing commands: $needed_pkgs"
    echo "Please install these using \"sudo yum install $needed_pkgs\""
    exit 1
fi

if [ -z "$path" ]; then
    path=$default_path/$name
fi

if [ -z "$release" ]; then
    if [ "$is_fedora" -a "$fedora_host_ver" ]; then
        release=$fedora_host_ver
    else
        echo "This is not a fedora host and release missing, defaulting to 22 use -R|--release to specify release"
        release=22
    fi
fi

if [ "$(id -u)" != "0" ]; then
    echo "This script should be run as 'root'"
    exit 1
fi

if [ -z "$rootfs_path" ]; then
    rootfs_path=$path/rootfs
    # check for 'lxc.rootfs' passed in through default config by lxc-create
    if grep -q '^lxc.rootfs' $path/config 2>/dev/null ; then
        rootfs_path=$(sed -e '/^lxc.rootfs\s*=/!d' -e 's/\s*#.*//' \
            -e 's/^lxc.rootfs\s*=\s*//' -e q $path/config)
    fi
fi
config_path=$path
cache=$cache_base/$release

revert()
{
    echo "Interrupted, so cleaning up"
    lxc-destroy -n $name
    # maybe was interrupted before copy config
    rm -rf $path
    echo "exiting..."
    exit 1
}

trap revert SIGHUP SIGINT SIGTERM

copy_configuration
if [ $? -ne 0 ]; then
    echo "failed write configuration file"
    exit 1
fi

install_fedora
if [ $? -ne 0 ]; then
    echo "failed to install fedora"
    exit 1
fi

configure_fedora
if [ $? -ne 0 ]; then
    echo "failed to configure fedora for a container"
    exit 1
fi

# If the systemd configuration directory exists - set it up for what we need.
if [ -d ${rootfs_path}/etc/systemd/system ]
then
    configure_fedora_systemd
fi

# This configuration (rc.sysinit) is not inconsistent with the systemd stuff
# above and may actually coexist on some upgraded systems.  Let's just make
# sure that, if it exists, we update this file, even if it's not used...
if [ -f ${rootfs_path}/etc/rc.sysinit ]
then
    configure_fedora_init
fi

if [ ! -z "$clean" ]; then
    clean || exit 1
    exit 0
fi
echo "
Container rootfs and config have been created.
Edit the config file to check/enable networking setup.
"

if [[ -d ${cache_base}/bootstrap ]]
then
    echo "You have successfully built a Fedora container and cache.  This cache may
be used to create future containers of various revisions.  The directory
${cache_base}/bootstrap contains a bootstrap
which may no longer needed and can be removed.
"
fi

if [[ -e ${cache_base}/LiveOS ]]
then
    echo "A LiveOS directory exists at ${cache_base}/LiveOS.
This is only used in the creation of the bootstrap run-time-environment
and may be removed.
"
fi

if [ ${root_display_password} = "yes" ]
then
    echo "The temporary password for root is: '$root_password'

You may want to note that password down before starting the container.
"
fi

if [ ${root_store_password} = "yes" ]
then
    echo "The temporary root password is stored in:

        '${config_path}/tmp_root_pass'
"
fi

if [ ${root_prompt_password} = "yes" ]
then
    echo "Invoking the passwd command in the container to set the root password.

        chroot ${rootfs_path} passwd
"
    chroot ${rootfs_path} passwd
else
    if [ ${root_expire_password} = "yes" ]
    then
        if ( mountpoint -q -- "${rootfs_path}" )
        then
            echo "To reset the root password, you can do:

        lxc-start -n ${name}
        lxc-attach -n ${name} -- passwd
        lxc-stop -n ${name}
"
        else
           echo "
The root password is set up as "expired" and will require it to be changed
at first login, which you should do as soon as possible.  If you lose the
root password or wish to change it without starting the container, you
can change it from the host by running the following command (which will
also reset the expired flag):

        chroot ${rootfs_path} passwd
"
        fi
    fi
fi