25 lines
1.6 KiB
Python
25 lines
1.6 KiB
Python
"""Empty-directory kernel probe for the exact authority systemd sandbox."""
|
|
import json,os,subprocess
|
|
from pathlib import Path
|
|
assert os.geteuid()==0 and Path('/run/.containerenv').exists()
|
|
root=Path('/var/lib/c01-view-probe');root.mkdir(mode=0o700)
|
|
subprocess.run(['mount','-t','tmpfs','-o','size=4m,mode=0700','c01-view-probe',str(root)],check=True)
|
|
private=root/'private-authority';private.mkdir(mode=0o700)
|
|
for name in ('authority','epoch','runtime'):
|
|
path=private/name;path.mkdir(mode=0o700);os.chown(path,1000,1000)
|
|
config=Path('/etc/archipelago-c01');config.mkdir(exist_ok=True)
|
|
(config/'launch.json').write_text(json.dumps({'authority_backing':str(private/'authority'),'runtime_uid':1000,'runtime_gid':1000}))
|
|
(config/'epoch.json').write_text(json.dumps({'backing':str(private/'epoch')}))
|
|
subprocess.run(['ip','netns','add','archipelago-managed'],check=True)
|
|
p=subprocess.run(['systemd-run','--wait','--pipe','--unit=c01-role-view-probe',
|
|
'-p','Delegate=yes','-p','DelegateSubgroup=supervisor',
|
|
'-p','User=root','-p','Group=root','-p','SupplementaryGroups=',
|
|
'-p','AmbientCapabilities=CAP_SETUID',
|
|
'-p','UMask=0077',
|
|
'-p','NoNewPrivileges=yes','-p','PrivateTmp=yes','-p','PrivateDevices=yes',
|
|
'-p','ProtectHome=yes','-p','ProtectSystem=strict','-p','ReadWritePaths=/sys/fs/cgroup '+str(private),
|
|
'-p','NetworkNamespacePath=/run/netns/archipelago-managed','/usr/bin/python3','-B',
|
|
'/opt/c01-fixture/tests/regression/c01-role-views.py'],capture_output=True,text=True,timeout=45)
|
|
print(p.stdout,p.stderr,flush=True)
|
|
raise SystemExit(p.returncode)
|