b38dea0597
Share Gaia assets and adapters, keep private profiles and development documents local, and update both public READMEs.
39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: MPL-2.0
|
|
"""Restrict the legacy HAL to character devices before creating its container.
|
|
|
|
Sargo's 4.9 kernel rejects LXC's cgroup2 device BPF program. A separate v1
|
|
devices controller is required; LXC's usual rules alone do not enforce it.
|
|
"""
|
|
import errno
|
|
import os
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
def main():
|
|
if 'tundra.rescue=1' not in Path('/proc/cmdline').read_text():
|
|
raise RuntimeError('Temporary boot flag missing')
|
|
controller=Path('/run/tundra-device-controller')
|
|
controller.mkdir(exist_ok=True)
|
|
if not (controller/'devices.deny').exists():
|
|
subprocess.run(['mount','-t','cgroup','-o','devices','devices',str(controller)],check=True)
|
|
group=controller/'hal'
|
|
group.mkdir(exist_ok=True)
|
|
(group/'devices.deny').write_text('b *:* rwm')
|
|
(group/'cgroup.procs').write_text(str(os.getpid()))
|
|
# Test the actual open, not devices.list: this kernel lists a default allow
|
|
# rule even when the blacklist is active. No bytes are written or read.
|
|
try:
|
|
descriptor=os.open('/dev/mmcblk0',os.O_RDONLY)
|
|
except OSError as error:
|
|
if error.errno!=errno.EPERM:raise
|
|
else:
|
|
os.close(descriptor)
|
|
raise RuntimeError('Block device restriction was not enforced')
|
|
with open('/dev/null','wb'):pass
|
|
os.execv('/usr/bin/lxc-start',['lxc-start']+sys.argv[1:])
|
|
|
|
|
|
if __name__=='__main__':main()
|