7496d9fab5
A relative scripts path can fail to spawn after a successful contained OIDC session, which Warden then revokes. The wrapper now resolves the command first; T03 records that this attempt did not write the role. Assistant: grok Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
37 lines
1.3 KiB
Python
Executable file
37 lines
1.3 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
"""Keep Warden containment; supply a scoped browser launcher when WSL lacks one."""
|
|
import os
|
|
from pathlib import Path
|
|
import shutil
|
|
import sys
|
|
|
|
|
|
def reviewed_command(args):
|
|
if args and args[0] == '--':
|
|
args = args[1:]
|
|
if not args:
|
|
raise SystemExit('A reviewed silent owner command is required')
|
|
command = Path(args[0]).expanduser()
|
|
if not command.is_absolute():
|
|
command = Path.cwd() / command
|
|
try:
|
|
command = command.resolve(strict=True)
|
|
except OSError:
|
|
raise SystemExit('Reviewed owner command is missing')
|
|
if not os.access(command, os.X_OK):
|
|
raise SystemExit('Reviewed owner command is not executable')
|
|
return [str(command), *args[1:]]
|
|
|
|
|
|
def main():
|
|
args = reviewed_command(sys.argv[1:])
|
|
env = os.environ.copy()
|
|
if not any(shutil.which(x) for x in ('xdg-open', 'x-www-browser', 'www-browser')):
|
|
if not Path('/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe').is_file():
|
|
raise SystemExit('No supported attended browser launcher is available')
|
|
env['PATH'] = str(Path(__file__).resolve().parent / 'operator-browser') + os.pathsep + env.get('PATH', '')
|
|
os.execvpe('warden', ['warden', 'access', 'openbao-platform-admin-login', '--exec', '--', *args], env)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|