diff options
author | Anton Luka Šijanec <anton@sijanec.eu> | 2022-04-24 13:24:41 +0200 |
---|---|---|
committer | Anton Luka Šijanec <anton@sijanec.eu> | 2022-04-24 13:24:41 +0200 |
commit | fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6 (patch) | |
tree | 06b2206059672a98ce7797e3e7359f5801e2f0b7 /src/openrc.sh | |
parent | separated css and html, removed php-cli dependency (diff) | |
download | sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar.gz sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar.bz2 sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar.lz sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar.xz sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.tar.zst sear.c-fc50a7f6c9e45b0c4e2bb03fbfc42b70e23b9aa6.zip |
Diffstat (limited to '')
-rwxr-xr-x | src/openrc.sh | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/src/openrc.sh b/src/openrc.sh new file mode 100755 index 0000000..192c03e --- /dev/null +++ b/src/openrc.sh @@ -0,0 +1,46 @@ +#!/sbin/openrc-run +depend() { + need net +} +# poor man's DynamicUser+TemporaryFileSystem+BindReadOnlyPaths implementation in OpenRC +command=sear.c +command_args="" +chroot=/var/run/sear.c +command_background=true +command_user="searc:searc" +pidfile=/var/run/sear.c/pid +# files read by sear.c as observed on 2022-04-17 on i386 debian: see misc/files.txt +mount_chroot() { + [ -d $1 ] && mkdir -p /var/run/sear.c$1 + [ -f $1 ] && mkdir -p /var/run/sear.c`echo $1 | rev | cut -d/ -f 2- | rev` && touch /var/run/sear.c$1 + [ -e $1 ] && mount -o nosuid,ro --bind $1 /var/run/sear.c$1 +} +start_pre() { + [ -f /etc/sear.c ] && . /etc/sear.c + export SC_PORT SC_FALLBACK SC_LOGLEVEL + checkpath --directory-truncate --directory --mode 0755 --owner root:root /var/run/sear.c + pidfile=/pid # logger runs without chroot as searc user in order to show searc instead of root in syslog. + which logger 2>&1 > /dev/null \ + && start_stop_daemon_args="--stderr-logger-before-chroot \"su searc --shell `which logger`\" --stdout-logger-before-chroot \"su searc --shell `which logger`\"" + mount_chroot /lib # a question for anyone reading this: we have now two processes on the system, one chrooted that runs sear.c and one outside of chroot that runs + mount_chroot /lib64 # logger. could the chrooted process somehow get access to the outside of the chroot by somehow communicating with his logger process? note that + mount_chroot /usr/lib # procfs is not mounted. Could it do that if procfs was to be mounted? + mount_chroot /usr/lib64 + mount_chroot /usr/bin/sear.c + mount_chroot /etc/gai.conf + mount_chroot /etc/host.conf + mount_chroot /etc/hosts + mount_chroot /etc/localtime + mount_chroot /etc/nsswitch.conf + mount_chroot /etc/resolv.conf + mount_chroot /etc/ld.so.conf + mount_chroot /etc/ld.so.conf.d + mount_chroot /etc/ld.so.cache +} +stop_post() { + nodelete=0 + for dir in `grep run/sear.c /proc/mounts | cut -d' ' -f2`; do # /var/run is usually symlink to /run, so we only grep for run/sear.c + umount $dir || nodelete=1 + done + [ $nodelete -eq 0 ] && rm -rf /var/run/sear.c +} |