Add capabilities at build

2026-03-09 18:46:36 +01:00
parent 47c3c979e5
commit da001da48f
14 changed files with 881 additions and 105 deletions
--- a/146
+++ b/146
@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+helper_dir=${SLOPTRAP_HELPER_DIR:-/run/sloptrap-helper}
+queue_dir="$helper_dir/queue"
+caps=${SLOPTRAP_ACTIVE_CAPABILITIES:-}
+audit_log=${SLOPTRAP_AUDIT_LOG:-/codex/state/capabilities.log}
+mkdir -p "$queue_dir" "$(dirname "$audit_log")"
+
+has_capability() {
+  local needle=$1
+  local token
+  for token in $caps; do
+    if [[ $token == "$needle" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+log_action() {
+  local op=$1
+  local details=$2
+  local status=$3
+  printf '%s op=%s status=%s %s\n' "$(date -u +%FT%TZ)" "$op" "$status" "$details" >>"$audit_log"
+}
+
+write_status() {
+  local request_dir=$1
+  local status=$2
+  printf '%s\n' "$status" >"$request_dir/status"
+}
+
+run_apt_install() {
+  local request_dir=$1
+  has_capability "apt-install" || {
+    printf 'capability apt-install is not active\n' >"$request_dir/stderr"
+    write_status "$request_dir" 126
+    log_action "apt-install" "packages=denied" 126
+    return
+  }
+  local packages_file="$request_dir/packages"
+  if [[ ! -f $packages_file ]]; then
+    printf 'missing package list\n' >"$request_dir/stderr"
+    write_status "$request_dir" 2
+    log_action "apt-install" "packages=missing" 2
+    return
+  fi
+  mapfile -t packages <"$packages_file"
+  if [[ ${#packages[@]} -eq 0 ]]; then
+    printf 'package list is empty\n' >"$request_dir/stderr"
+    write_status "$request_dir" 2
+    log_action "apt-install" "packages=empty" 2
+    return
+  fi
+  if apt-get update >"$request_dir/stdout" 2>"$request_dir/stderr" \
+    && apt-get install -y --no-install-recommends "${packages[@]}" >>"$request_dir/stdout" 2>>"$request_dir/stderr"; then
+    write_status "$request_dir" 0
+    log_action "apt-install" "packages=${packages[*]}" 0
+    return
+  fi
+  write_status "$request_dir" 1
+  log_action "apt-install" "packages=${packages[*]}" 1
+}
+
+run_packet_capture() {
+  local request_dir=$1
+  has_capability "packet-capture" || {
+    printf 'capability packet-capture is not active\n' >"$request_dir/stderr"
+    write_status "$request_dir" 126
+    log_action "packet-capture" "interface=denied" 126
+    return
+  }
+  local iface_file="$request_dir/interface"
+  [[ -f $iface_file ]] || {
+    printf 'missing interface\n' >"$request_dir/stderr"
+    write_status "$request_dir" 2
+    log_action "packet-capture" "interface=missing" 2
+    return
+  }
+  local iface filter_file output_file stdout_mode
+  iface=$(<"$iface_file")
+  filter_file="$request_dir/filter"
+  output_file="$request_dir/output"
+  stdout_mode=0
+  [[ -f "$request_dir/stdout_mode" ]] && stdout_mode=$(<"$request_dir/stdout_mode")
+  local -a cmd=(tcpdump -i "$iface")
+  if [[ -s $filter_file ]]; then
+    local filter
+    filter=$(<"$filter_file")
+    local -a filter_tokens=()
+    read -r -a filter_tokens <<< "$filter"
+    cmd+=("${filter_tokens[@]}")
+  fi
+  if [[ -s $output_file ]]; then
+    local capture_path
+    capture_path=$(<"$output_file")
+    mkdir -p "$(dirname "$capture_path")"
+    cmd+=(-w "$capture_path")
+  fi
+  if [[ $stdout_mode == "1" ]]; then
+    "${cmd[@]}" >"$request_dir/stdout" 2>"$request_dir/stderr" || {
+      write_status "$request_dir" 1
+      log_action "packet-capture" "interface=$iface stdout=1" 1
+      return
+    }
+  else
+    "${cmd[@]}" >"$request_dir/stdout" 2>"$request_dir/stderr" || {
+      write_status "$request_dir" 1
+      log_action "packet-capture" "interface=$iface stdout=0" 1
+      return
+    }
+  fi
+  write_status "$request_dir" 0
+  log_action "packet-capture" "interface=$iface stdout=$stdout_mode" 0
+}
+
+while true; do
+  shopt -s nullglob
+  request_dirs=("$queue_dir"/*.req)
+  shopt -u nullglob
+  if [[ ${#request_dirs[@]} -eq 0 ]]; then
+    sleep 1
+    continue
+  fi
+  for request_dir in "${request_dirs[@]}"; do
+    [[ -d $request_dir ]] || continue
+    [[ ! -f "$request_dir/status" ]] || continue
+    op=$(<"$request_dir/op")
+    : >"$request_dir/stdout"
+    : >"$request_dir/stderr"
+    case "$op" in
+      apt-install)
+        run_apt_install "$request_dir"
+        ;;
+      packet-capture)
+        run_packet_capture "$request_dir"
+        ;;
+      *)
+        printf 'unknown operation %s\n' "$op" >"$request_dir/stderr"
+        write_status "$request_dir" 2
+        log_action "$op" "unknown=1" 2
+        ;;
+    esac
+  done
+done