fortify/main.go
Ophestra Umiker 315c9b8849
fortify: refuse to run as root
There is no good reason to run fortify as root and desktop environments typically do not like that either. This check prevents confusion for new users who might mistakenly run it as root or set the setuid bit.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-13 20:06:47 +09:00

73 lines
1.5 KiB
Go

package main
import (
"flag"
"fmt"
"os"
"syscall"
"git.ophivana.moe/cat/fortify/internal"
"git.ophivana.moe/cat/fortify/internal/app"
"git.ophivana.moe/cat/fortify/internal/shim"
"git.ophivana.moe/cat/fortify/internal/verbose"
)
var (
flagVerbose bool
)
func init() {
flag.BoolVar(&flagVerbose, "v", false, "Verbose output")
}
func main() {
flag.Parse()
verbose.Set(flagVerbose)
// linux/sched/coredump.h
if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, 0, 0); errno != 0 {
fmt.Printf("fortify: cannot set SUID_DUMP_DISABLE: %s", errno.Error())
} else {
verbose.Println("prctl(PR_SET_DUMPABLE, SUID_DUMP_DISABLE) succeeded")
}
if internal.SdBootedV {
verbose.Println("system booted with systemd as init system")
}
// shim early exit
shim.Try()
// root check
if os.Getuid() == 0 {
fmt.Println("fortify: this program must not run as root")
os.Exit(1)
}
// version/license/template command early exit
tryVersion()
tryLicense()
tryTemplate()
// state query command early exit
tryState()
// invoke app
r := 1
a := app.New()
if err := a.Seal(loadConfig()); err != nil {
logBaseError(err, "fortify: cannot seal app:")
} else if err = a.Start(); err != nil {
logBaseError(err, "fortify: cannot start app:")
} else if r, err = a.Wait(); err != nil {
if r < 1 {
r = 1
}
logWaitError(err)
}
if err := a.WaitErr(); err != nil {
fmt.Println("fortify: inner wait failed:", err)
}
os.Exit(r)
}