"""Empty-directory kernel probe for the exact authority systemd sandbox."""
import json,os,subprocess
from pathlib import Path
assert os.geteuid()==0 and Path('/run/.containerenv').exists()
root=Path('/var/lib/c01-view-probe');root.mkdir(mode=0o700)
subprocess.run(['mount','-t','tmpfs','-o','size=4m,mode=0700','c01-view-probe',str(root)],check=True)
private=root/'private-authority';private.mkdir(mode=0o700)
for name in ('authority','epoch','runtime'):
    path=private/name;path.mkdir(mode=0o700);os.chown(path,1000,1000)
config=Path('/etc/archipelago-c01');config.mkdir(exist_ok=True)
(config/'launch.json').write_text(json.dumps({'authority_backing':str(private/'authority'),'runtime_uid':1000,'runtime_gid':1000}))
(config/'epoch.json').write_text(json.dumps({'backing':str(private/'epoch')}))
subprocess.run(['ip','netns','add','archipelago-managed'],check=True)
p=subprocess.run(['systemd-run','--wait','--pipe','--unit=c01-role-view-probe',
    '-p','Delegate=yes','-p','DelegateSubgroup=supervisor',
    '-p','User=root','-p','Group=root','-p','SupplementaryGroups=',
    '-p','AmbientCapabilities=CAP_SETUID',
    '-p','UMask=0077',
    '-p','NoNewPrivileges=yes','-p','PrivateTmp=yes','-p','PrivateDevices=yes',
    '-p','ProtectHome=yes','-p','ProtectSystem=strict','-p','ReadWritePaths=/sys/fs/cgroup '+str(private),
    '-p','NetworkNamespacePath=/run/netns/archipelago-managed','/usr/bin/python3','-B',
    '/opt/c01-fixture/tests/regression/c01-role-views.py'],capture_output=True,text=True,timeout=45)
print(p.stdout,p.stderr,flush=True)
raise SystemExit(p.returncode)