39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""Partial read-only identity evidence. Never an admission authority."""
|
||
|
|
import datetime
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
import sys
|
||
|
|
|
||
|
|
|
||
|
|
def evaluate(expected_uid, expected_machine, actual_uid, machine_digest):
|
||
|
|
return {
|
||
|
|
"identity_matches": actual_uid == expected_uid
|
||
|
|
and actual_uid not in (0, 1000)
|
||
|
|
and len(expected_machine) == 64
|
||
|
|
and expected_machine == machine_digest,
|
||
|
|
"actual_uid": actual_uid,
|
||
|
|
"assignment_admitted": False,
|
||
|
|
"scope": "partial_process_identity_only",
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
try:
|
||
|
|
expected_uid = int(sys.argv[1])
|
||
|
|
expected_machine = sys.argv[2]
|
||
|
|
machine = hashlib.sha256(Path('/etc/machine-id').read_bytes()).hexdigest()
|
||
|
|
result = evaluate(expected_uid, expected_machine, os.geteuid(), machine)
|
||
|
|
result['capture_utc'] = datetime.datetime.now(datetime.timezone.utc).isoformat()
|
||
|
|
except Exception:
|
||
|
|
result = {'identity_matches': False, 'assignment_admitted': False,
|
||
|
|
'reason': 'identity_probe_refused'}
|
||
|
|
print(json.dumps(result, sort_keys=True))
|
||
|
|
return 0 if result['identity_matches'] else 1
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
sys.exit(main())
|