Publish Vulpes Preview 15 sources for desktop, Android and Tundra

Share Gaia assets and adapters, keep private profiles and development documents local, and update both public READMEs.

tundra/runtime/lxc-guard.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MPL-2.0
+"""Restrict the legacy HAL to character devices before creating its container.
+
+Sargo's 4.9 kernel rejects LXC's cgroup2 device BPF program. A separate v1
+devices controller is required; LXC's usual rules alone do not enforce it.
+"""
+import errno
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+
+def main():
+    if 'tundra.rescue=1' not in Path('/proc/cmdline').read_text():
+        raise RuntimeError('Temporary boot flag missing')
+    controller=Path('/run/tundra-device-controller')
+    controller.mkdir(exist_ok=True)
+    if not (controller/'devices.deny').exists():
+        subprocess.run(['mount','-t','cgroup','-o','devices','devices',str(controller)],check=True)
+    group=controller/'hal'
+    group.mkdir(exist_ok=True)
+    (group/'devices.deny').write_text('b *:* rwm')
+    (group/'cgroup.procs').write_text(str(os.getpid()))
+    # Test the actual open, not devices.list: this kernel lists a default allow
+    # rule even when the blacklist is active. No bytes are written or read.
+    try:
+        descriptor=os.open('/dev/mmcblk0',os.O_RDONLY)
+    except OSError as error:
+        if error.errno!=errno.EPERM:raise
+    else:
+        os.close(descriptor)
+        raise RuntimeError('Block device restriction was not enforced')
+    with open('/dev/null','wb'):pass
+    os.execv('/usr/bin/lxc-start',['lxc-start']+sys.argv[1:])
+
+
+if __name__=='__main__':main()