Ophestra
b852402f67
All checks were successful
Test / Create distribution (push) Successful in 1m2s
Test / Sandbox (push) Successful in 2m36s
Test / Hakurei (push) Successful in 3m42s
Test / ShareFS (push) Successful in 3m43s
Test / Sandbox (race detector) (push) Successful in 5m3s
Test / Hakurei (race detector) (push) Successful in 6m11s
Test / Flake checks (push) Successful in 1m30s
These are generally useful, and none of them are container-specific. Syscalls subtle to use and requiring container-specific setup remains in container. Signed-off-by: Ophestra <cat@gensokyo.uk>
61 lines
1.3 KiB
Go
61 lines
1.3 KiB
Go
package main
|
|
|
|
// this works around go:embed '..' limitation
|
|
//go:generate cp ../../LICENSE .
|
|
|
|
import (
|
|
"context"
|
|
_ "embed"
|
|
"errors"
|
|
"log"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
|
|
"hakurei.app/container"
|
|
"hakurei.app/ext"
|
|
"hakurei.app/message"
|
|
)
|
|
|
|
var (
|
|
errSuccess = errors.New("success")
|
|
|
|
//go:embed LICENSE
|
|
license string
|
|
)
|
|
|
|
// earlyHardeningErrs are errors collected while setting up early hardening feature.
|
|
type earlyHardeningErrs struct{ yamaLSM, dumpable error }
|
|
|
|
func main() {
|
|
// early init path, skips root check and duplicate PR_SET_DUMPABLE
|
|
container.TryArgv0(nil)
|
|
|
|
log.SetPrefix("hakurei: ")
|
|
log.SetFlags(0)
|
|
msg := message.New(log.Default())
|
|
|
|
early := earlyHardeningErrs{
|
|
yamaLSM: ext.SetPtracer(0),
|
|
dumpable: ext.SetDumpable(ext.SUID_DUMP_DISABLE),
|
|
}
|
|
|
|
if os.Geteuid() == 0 {
|
|
log.Fatal("this program must not run as root")
|
|
}
|
|
|
|
ctx, stop := signal.NotifyContext(context.Background(),
|
|
syscall.SIGINT, syscall.SIGTERM)
|
|
defer stop() // unreachable
|
|
|
|
buildCommand(ctx, msg, &early, os.Stderr).MustParse(os.Args[1:], func(err error) {
|
|
msg.Verbosef("command returned %v", err)
|
|
if errors.Is(err, errSuccess) {
|
|
msg.BeforeExit()
|
|
os.Exit(0)
|
|
}
|
|
// this catches faulty command handlers that fail to return before this point
|
|
})
|
|
log.Fatal("unreachable")
|
|
}
|