Emir Beganovic
dd05114e95
The check read /proc/$$/cmdline. arch-chroot runs its command in a new PID namespace beneath the outer /proc, where $$ names no process or someone else's, so every bash -p entrypoint was rejected there with status 126. The installer met this as soon as one was called at install time: install/config/thunderbolt-authorization.sh runs omarchy-thunderbolt-authorization-admin, and the edge ISO stopped in "Configuring system" with "/proc/219/cmdline: No such file or directory". The check runs in a child of the caller, so read the parent from that child's /proc/self/stat, which is given in the numbering of the /proc it is read through. Outside a PID namespace that is $$, as before.
42 lines
1.7 KiB
Bash
Executable File
42 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
|
|
|
test_tmp=$(mktemp -d)
|
|
trap 'rm -rf "$test_tmp"' EXIT
|
|
|
|
cat >"$test_tmp/entrypoint" <<SH
|
|
#!/bin/bash -p
|
|
source "$ROOT/bin/omarchy-security-functions"
|
|
omarchy_security_require_privileged_bash_startup
|
|
SH
|
|
chmod +x "$test_tmp/entrypoint"
|
|
|
|
"$test_tmp/entrypoint" || fail "a script started as bash -p passes the startup check"
|
|
( "$test_tmp/entrypoint" ) || fail "the startup check passes from a subshell"
|
|
pass "a script started as bash -p passes the startup check"
|
|
|
|
if /usr/bin/bash -c "set -p; source '$ROOT/bin/omarchy-security-functions'; omarchy_security_require_privileged_bash_startup"; then
|
|
fail "bash that only turned -p on later is rejected"
|
|
fi
|
|
if /usr/bin/bash "$test_tmp/entrypoint"; then
|
|
fail "a script not started with -p is rejected"
|
|
fi
|
|
pass "bash not started with -p is rejected"
|
|
|
|
# arch-chroot runs the installer in a new PID namespace under the outer /proc,
|
|
# so the caller's own PID is not the number /proc knows it by.
|
|
in_new_pid_namespace=(unshare --user --map-root-user --fork --pid)
|
|
if "${in_new_pid_namespace[@]}" /usr/bin/true 2>/dev/null; then
|
|
"${in_new_pid_namespace[@]}" /usr/bin/bash -c "for i in {1..50}; do /usr/bin/true; done; '$test_tmp/entrypoint'; exit" </dev/null ||
|
|
fail "the startup check passes in a new PID namespace under the outer /proc"
|
|
if "${in_new_pid_namespace[@]}" /usr/bin/bash -c "/usr/bin/bash '$test_tmp/entrypoint'; exit" </dev/null; then
|
|
fail "a script not started with -p is rejected in a new PID namespace"
|
|
fi
|
|
pass "the startup check sees its caller in a new PID namespace, as under arch-chroot"
|
|
else
|
|
skip "a new PID namespace needs unprivileged user namespaces"
|
|
fi
|