77 lines
2.6 KiB
Shell
Executable file
77 lines
2.6 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
[[ $# -eq 5 ]] || {
|
|
echo "usage: install-jd-final-resident-relay.sh <peer-script> <recovery-token-file> <allowed-native-source> <request-file> <receipt-file>" >&2
|
|
exit 64
|
|
}
|
|
[[ ${EUID} -eq 0 ]] || exit 77
|
|
|
|
peer_script=$(readlink -f "$1")
|
|
token_file=$(readlink -f "$2")
|
|
allowed_source=$3
|
|
request_file=$(readlink -m "$4")
|
|
receipt_file=$(readlink -m "$5")
|
|
|
|
token_hex=$(tr -d '\r\n ' <"${token_file}")
|
|
[[ ${token_hex} =~ ^[0-9a-fA-F]{32}$ ]] || exit 65
|
|
[[ ${allowed_source} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 65
|
|
[[ ${request_file} == /run/guanghu-jd-native-final-recovery.request ]] || exit 65
|
|
[[ ${receipt_file} == /var/lib/guanghu-os/jd-final-resident-relay.hldp ]] || exit 65
|
|
|
|
install -D -m 0755 "${peer_script}" \
|
|
/usr/local/libexec/guanghu-os/physical-native-icmp-peer.py
|
|
install -D -m 0600 "${token_file}" \
|
|
/etc/guanghu-os/jd-final-resident-recovery-token.hex
|
|
install -d -m 0700 /var/lib/guanghu-os
|
|
rm -f "${request_file}"
|
|
|
|
install -m 0644 /dev/stdin \
|
|
/etc/systemd/system/guanghu-jd-native-final-resident-relay.service <<EOF
|
|
[Unit]
|
|
Description=Protected relay for JD Guanghu OS final native residency
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/python3 /usr/local/libexec/guanghu-os/physical-native-icmp-peer.py --raw-socket --final-resident-relay --allowed-source ${allowed_source} --recovery-token-file /etc/guanghu-os/jd-final-resident-recovery-token.hex --recovery-request-file ${request_file} --receipt ${receipt_file} --timeout 604800
|
|
Restart=always
|
|
RestartSec=2
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/lib/guanghu-os /run
|
|
RestrictAddressFamilies=AF_INET
|
|
AmbientCapabilities=CAP_NET_RAW
|
|
CapabilityBoundingSet=CAP_NET_RAW
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
install -D -m 0755 /dev/stdin \
|
|
/usr/local/sbin/guanghu-request-jd-final-native-recovery <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
[[ ${EUID} -eq 0 ]] || exit 77
|
|
receipt=/var/lib/guanghu-os/jd-final-resident-relay.hldp
|
|
request=/run/guanghu-jd-native-final-recovery.request
|
|
grep -q '^status: READY_NATIVE_RESIDENT$' "${receipt}"
|
|
install -m 0600 /dev/null "${request}"
|
|
echo "authorized recovery request armed"
|
|
EOF
|
|
|
|
install -D -m 0755 /dev/stdin \
|
|
/usr/local/sbin/guanghu-clear-jd-final-native-recovery-request <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
[[ ${EUID} -eq 0 ]] || exit 77
|
|
rm -f /run/guanghu-jd-native-final-recovery.request
|
|
echo "recovery request cleared"
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable guanghu-jd-native-final-resident-relay.service >/dev/null
|
|
echo "installed but not started"
|