96 lines
5.0 KiB
Bash
96 lines
5.0 KiB
Bash
#!/bin/bash
|
|
|
|
# Real Bolt policy/approval/setup calls. Only systemd is bridged to the private
|
|
# daemon processes owned by bolt-integration.py; never contact host systemd.
|
|
set -euo pipefail
|
|
source "$ROOT/install/helpers/thunderbolt-policy.sh"
|
|
source "$ROOT/install/helpers/thunderbolt-setup.sh"
|
|
TB_STATE="$TB_TEST_DIR/policy.json" TB_CONFIG="$TB_TEST_STORE/boltd.conf"
|
|
TB_MARKER="$TB_TEST_DIR/enabled" TB_PENDING="$TB_TEST_DIR/pending"
|
|
TB_RUNTIME="$TB_TEST_DIR/runtime" TB_LOCK="$TB_TEST_DIR/root.lock"
|
|
mkdir -p "$TB_RUNTIME"
|
|
|
|
service_request() {
|
|
printf '%s\n' "$*" > "$TB_TEST_DIR/control.tmp"
|
|
mv "$TB_TEST_DIR/control.tmp" "$TB_TEST_DIR/control"
|
|
for (( attempt=0; attempt<300; attempt++ )); do
|
|
[[ -f $TB_TEST_DIR/control ]] || return 0
|
|
sleep 0.05
|
|
done
|
|
echo "Private service operation timed out: $*" >&2
|
|
return 1
|
|
}
|
|
systemctl() {
|
|
local action=$1 unit
|
|
shift
|
|
printf '%s\n' "$action $*" >> "$TB_TEST_DIR/services.log"
|
|
case "$action" in
|
|
show)
|
|
unit=${!#}
|
|
if [[ -f $TB_TEST_DIR/$unit.active ]]; then echo ActiveState=active; else echo ActiveState=inactive; fi
|
|
if [[ -f $TB_TEST_DIR/$unit.enabled ]]; then echo UnitFileState=enabled; else echo UnitFileState=disabled; fi ;;
|
|
start|stop)
|
|
for unit in "$@"; do service_request "$action" "$unit" || return 1; done ;;
|
|
enable)
|
|
unit=${!#}
|
|
touch "$TB_TEST_DIR/$unit.enabled"
|
|
if [[ $1 == "--now" ]]; then service_request start "$unit"; fi ;;
|
|
disable)
|
|
if [[ -f $TB_TEST_DIR/fail-disable ]]; then rm "$TB_TEST_DIR/fail-disable"; return 1; fi
|
|
rm -f -- "$TB_TEST_DIR/$1.enabled" ;;
|
|
daemon-reload) ;;
|
|
*) echo "Unexpected systemctl action: $action $*" >&2; return 1 ;;
|
|
esac
|
|
}
|
|
check_inventory() { tb_inventory | jq -e --arg uid "$TB_TEST_UID" --arg other "$TB_TEST_OTHER" "$1" >/dev/null; }
|
|
case "$1" in
|
|
approve)
|
|
jq -cn '{version:1,enabled:true,trusted:{},original_authmode:"enabled"}' > "$TB_STATE"
|
|
echo removal-test > "$TB_RUNTIME/generation"
|
|
touch "$TB_MARKER"
|
|
identity=$(tb_snapshot | jq -c --arg uid "$TB_TEST_UID" '.devices[]|select(.identity.Uid==$uid)|.identity')
|
|
tb_approve "$identity" true true >/dev/null
|
|
# An existing manual record, even explicitly trusted through Omarchy,
|
|
# must keep the policy its administrator chose before enrollment.
|
|
inventory=$(tb_inventory)
|
|
owner=$(jq -r .owner <<< "$inventory")
|
|
path=$(jq -r --arg uid "$TB_TEST_OTHER" '.devices[]|select(.Uid==$uid)|.path' <<< "$inventory")
|
|
tb_bus call "$owner" "$path" "$TB_DEVICE" Authorize s '' >/dev/null
|
|
tb_bus call "$owner" "$TB_PATH" "$TB_MANAGER" EnrollDevice sss "$TB_TEST_OTHER" manual '' >/dev/null
|
|
identity=$(tb_snapshot | jq -c --arg uid "$TB_TEST_OTHER" '.devices[]|select(.identity.Uid==$uid)|.identity')
|
|
tb_approve "$identity" true true >/dev/null
|
|
jq -e --arg uid "$TB_TEST_UID" --arg other "$TB_TEST_OTHER" \
|
|
'.enrolled[$uid].StoreTime>0 and .enrolled[$other]==null and .trusted[$other]!=null' "$TB_STATE" >/dev/null
|
|
if [[ $TB_TEST_SECURITY == "secure" ]]; then
|
|
sha256sum "$TB_TEST_STORE/keys/$TB_TEST_UID" > "$TB_TEST_DIR/key-checksum"
|
|
fi ;;
|
|
boot-enable) tb_admin boot-enable ;;
|
|
rollback)
|
|
cp "$TB_STATE" "$TB_TEST_DIR/old-policy.json"
|
|
tb_inventory | tb_boot_saved > "$TB_TEST_DIR/old-firmware.json"
|
|
touch "$TB_TEST_DIR/fail-disable"
|
|
if tb_admin disable; then echo 'Failed removal unexpectedly succeeded' >&2; exit 1; fi
|
|
cmp "$TB_STATE" "$TB_TEST_DIR/old-policy.json"
|
|
cmp <(tb_inventory | tb_boot_saved | jq -cS .) <(jq -cS . "$TB_TEST_DIR/old-firmware.json")
|
|
[[ -f $TB_MARKER && -f $TB_TEST_DIR/$TB_SERVICE.active && -f $TB_TEST_DIR/$TB_SERVICE.enabled && ! -f $TB_TEST_DIR/setup-recovery.json ]]
|
|
check_inventory '.manager.AuthMode=="disabled"'
|
|
echo 'Removal failure restored policy, firmware ACLs and approval service' ;;
|
|
disable)
|
|
tb_admin disable
|
|
[[ ! -f $TB_MARKER && ! -f $TB_TEST_DIR/$TB_SERVICE.active && ! -f $TB_TEST_DIR/$TB_SERVICE.enabled ]]
|
|
jq -e '.enabled==false and .enrolled==null' "$TB_STATE" >/dev/null
|
|
check_inventory '.manager.AuthMode=="enabled" and any(.stored[]; .Uid==$uid and .Policy=="auto") and any(.stored[]; .Uid==$other and .Policy=="manual")'
|
|
if [[ $TB_TEST_SECURITY == "secure" ]]; then sha256sum --status -c "$TB_TEST_DIR/key-checksum"; fi
|
|
echo 'Removal handed our record back to Bolt and preserved existing manual policy' ;;
|
|
disconnected)
|
|
check_inventory 'any(.stored[]; .Uid==$uid and .Status=="disconnected") and any(.stored[]; .Uid==$other and .Status=="disconnected")' ;;
|
|
reconnected)
|
|
check_inventory 'any(.devices[]; .Uid==$uid and .Policy=="auto" and (.Status|startswith("authorized"))) and any(.devices[]; .Uid==$other and .Policy=="manual" and .Status=="connected")'
|
|
if [[ $TB_TEST_SECURITY == "secure" ]]; then
|
|
check_inventory 'any(.devices[]; .Uid==$uid and .Key=="have" and (.AuthFlags|contains("secure")))'
|
|
sha256sum --status -c "$TB_TEST_DIR/key-checksum"
|
|
fi
|
|
echo "Automatic reconnect succeeded in $TB_TEST_SECURITY mode; pre-existing manual device stayed blocked" ;;
|
|
*) exit 64 ;;
|
|
esac
|