coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require an absolute owner command after attended OpenBao login.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
A relative scripts path can fail to spawn after a successful contained
OIDC session, which Warden then revokes. The wrapper now resolves the
command first; T03 records that this attempt did not write the role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 02:16:42 +02:00
parent bb1aa85aea
commit 7496d9fab5
5 changed files with 81 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

34
scripts/openbao-attended-exec.py
View file

@ -6,14 +6,32 @@ import shutil
import sys
def reviewed_command(args):
if args and args[0] == '--':
args = args[1:]
if not args:
raise SystemExit('A reviewed silent owner command is required')
command = Path(args[0]).expanduser()
if not command.is_absolute():
command = Path.cwd() / command
try:
command = command.resolve(strict=True)
except OSError:
raise SystemExit('Reviewed owner command is missing')
if not os.access(command, os.X_OK):
raise SystemExit('Reviewed owner command is not executable')
return [str(command), *args[1:]]
def main():
args=sys.argv[1:]
if args and args[0]=='--': args=args[1:]
if not args: raise SystemExit('A reviewed silent owner command is required')
env=os.environ.copy()
if not any(shutil.which(x) for x in ('xdg-open','x-www-browser','www-browser')):
args = reviewed_command(sys.argv[1:])
env = os.environ.copy()
if not any(shutil.which(x) for x in ('xdg-open', 'x-www-browser', 'www-browser')):
if not Path('/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe').is_file():
raise SystemExit('No supported attended browser launcher is available')
env['PATH']=str(Path(__file__).resolve().parent/'operator-browser')+os.pathsep+env.get('PATH','')
os.execvpe('warden',['warden','access','openbao-platform-admin-login','--exec','--',*args],env)
if __name__=='__main__': main()
env['PATH'] = str(Path(__file__).resolve().parent / 'operator-browser') + os.pathsep + env.get('PATH', '')
os.execvpe('warden', ['warden', 'access', 'openbao-platform-admin-login', '--exec', '--', *args], env)
if __name__ == '__main__':
main()