mirror of
https://github.com/MacRimi/ProxMenux.git
synced 2026-10-01 02:56:41 +00:00
75 lines
3.1 KiB
Python
75 lines
3.1 KiB
Python
 
|
"""Read-only identity checks for directory bind mounts; never manage their data."""
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from pathlib import Path, PurePosixPath
|
||
|
|
import re
|
||
|
|
import stat
|
||
|
|
|
||
|
|
from oci_installation_state import parse_config
|
||
|
|
from oci_ui import translate
|
||
|
|
|
||
|
|
|
||
|
|
def valid_path(value):
|
||
|
|
if (not isinstance(value, str) or not value.startswith('/') or value == '/'
|
||
|
|
or any(c.isspace() or ord(c) < 32 or c == ',' for c in value)
|
||
|
|
or any(p in ('.', '..') for p in value.split('/'))
|
||
|
|
or str(PurePosixPath(value)) != value or value.startswith('//')):
|
||
|
|
raise ValueError(translate('Invalid absolute mount path'))
|
||
|
|
return value
|
||
|
|
|
||
|
|
|
||
|
|
def snapshot(source, allow_missing=False):
|
||
|
|
path = Path(source)
|
||
|
|
resolved = str(path.resolve())
|
||
|
|
try:
|
||
|
|
info = path.stat()
|
||
|
|
except FileNotFoundError:
|
||
|
|
if not allow_missing or path.is_symlink():
|
||
|
|
raise ValueError(f"{translate('The container is not modified because a host directory is not available:')} {source}")
|
||
|
|
return {'resolved_path': resolved, 'exists': False}
|
||
|
|
if not stat.S_ISDIR(info.st_mode):
|
||
|
|
raise ValueError(translate('This profile only supports directory bind mounts'))
|
||
|
|
return {'resolved_path': resolved, 'exists': True, 'device': info.st_dev,
|
||
|
|
'inode': info.st_ino, 'uid': info.st_uid, 'gid': info.st_gid,
|
||
|
|
'mode': stat.S_IMODE(info.st_mode)}
|
||
|
|
|
||
|
|
|
||
|
|
def validate_source(source, allow_missing=False):
|
||
|
|
valid_path(source)
|
||
|
|
value = snapshot(source, allow_missing)
|
||
|
|
protected = ('/etc', '/usr', '/bin', '/sbin', '/lib', '/lib64', '/dev', '/proc', '/sys', '/run')
|
||
|
|
protected += tuple(str(Path(p).resolve()) for p in protected)
|
||
|
|
resolved = value['resolved_path']
|
||
|
|
if resolved == '/' or any(resolved == p or resolved.startswith(p + '/') for p in protected):
|
||
|
|
raise ValueError(translate('The shared directory points to a protected host path'))
|
||
|
|
return value
|
||
|
|
|
||
|
|
|
||
|
|
def same_source(a, b):
|
||
|
|
# Native application init may legitimately change permissions, not identity.
|
||
|
|
return all(a.get(k) == b.get(k) for k in ('resolved_path', 'exists', 'device', 'inode'))
|
||
|
|
|
||
|
|
|
||
|
|
def verify_sources(expected):
|
||
|
|
for source, previous in expected.items():
|
||
|
|
current = validate_source(source, allow_missing=not previous['exists'])
|
||
|
|
if not same_source(previous, current):
|
||
|
|
raise ValueError(f"{translate('The operation was stopped because a shared directory changed its identity:')} {source}")
|
||
|
|
|
||
|
|
|
||
|
|
def verify_observation(expected, observed):
|
||
|
|
actual = observed.get('host_bind_sources', {})
|
||
|
|
if actual.keys() != expected.keys() or any(not same_source(value, actual[source])
|
||
|
|
for source, value in expected.items()):
|
||
|
|
raise ValueError(translate('The mount evidence does not match the verified directories'))
|
||
|
|
|
||
|
|
|
||
|
|
def capture_sources(config):
|
||
|
|
result = {}
|
||
|
|
for key, value in parse_config(config).items():
|
||
|
|
if re.fullmatch(r'mp[0-9]+', key):
|
||
|
|
source = value.split(',', 1)[0]
|
||
|
|
if source.startswith('/'):
|
||
|
|
result[source] = snapshot(source)
|
||
|
|
return result
|