43 lines
1.4 KiB
Python
43 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Partial read-only identity evidence. Never an admission authority."""
|
|
import datetime
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
ORIGIN_UID = 1000
|
|
ORIGIN_MACHINE = '4f615ffa89bf23a138468bad4a51ba074a4523f7b2dabd0322dc1458f092f0f6'
|
|
|
|
|
|
def evaluate(expected_uid, expected_machine, actual_uid, machine_digest):
|
|
return {
|
|
"identity_matches": actual_uid == expected_uid
|
|
and actual_uid != 0
|
|
and (actual_uid, machine_digest) != (ORIGIN_UID, ORIGIN_MACHINE)
|
|
and len(expected_machine) == 64
|
|
and all(c in '0123456789abcdef' for c in expected_machine)
|
|
and expected_machine == machine_digest,
|
|
"actual_uid": actual_uid,
|
|
"assignment_admitted": False,
|
|
"scope": "partial_process_identity_only",
|
|
}
|
|
|
|
|
|
def main():
|
|
try:
|
|
expected_uid = int(sys.argv[1])
|
|
expected_machine = sys.argv[2]
|
|
machine = hashlib.sha256(Path('/etc/machine-id').read_bytes()).hexdigest()
|
|
result = evaluate(expected_uid, expected_machine, os.geteuid(), machine)
|
|
result['capture_utc'] = datetime.datetime.now(datetime.timezone.utc).isoformat()
|
|
except Exception:
|
|
result = {'identity_matches': False, 'assignment_admitted': False,
|
|
'reason': 'identity_probe_refused'}
|
|
print(json.dumps(result, sort_keys=True))
|
|
return 0 if result['identity_matches'] else 1
|
|
|
|
|
|
if __name__ == '__main__':
|
|
sys.exit(main())
|