58 lines
2.4 KiB
Python
58 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Read-only launch preflight; outputs predicates only, never file contents."""
|
|
import configparser
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import pwd
|
|
import sys
|
|
|
|
|
|
def check_snapshot(s):
|
|
checks = {
|
|
'dedicated_guest': s['distro'] == 'custodian-codex',
|
|
'account': s['uid'] == 1001 and s['gid'] == 1001,
|
|
'private_home': s['home_mode'] == 0o700,
|
|
'private_state': s['state_mode'] == 0o700,
|
|
'home_owner': s['home_uid'] == 1001 and s['state_uid'] == 1001,
|
|
'no_admin_groups': s['groups'] == [1001],
|
|
'interop_config_disabled': s['interop'] == 'false',
|
|
'automount_config_disabled': s['automount'] == 'false',
|
|
'fstab_config_disabled': s['mount_fstab'] == 'false',
|
|
'no_windows_mount': not s['windows_mount'],
|
|
'no_operator_home': not s['operator_home'],
|
|
'no_interop_handler': not s['interop_handler'],
|
|
}
|
|
return {'checks': checks, 'partial_preflight_passed': all(checks.values()),
|
|
'assignment_admitted': False}
|
|
|
|
|
|
def main():
|
|
try:
|
|
c = configparser.ConfigParser(); c.read('/etc/wsl.conf')
|
|
p = pwd.getpwnam('custodian-codex')
|
|
home = Path(p.pw_dir).stat(); state = (Path(p.pw_dir)/'.codex').stat()
|
|
result = check_snapshot({
|
|
# systemd services do not necessarily inherit WSL_DISTRO_NAME.
|
|
# Root-owned stage marker is partial local evidence, not host attestation.
|
|
'distro': Path('/etc/cust73/distribution-name').read_text().strip(),
|
|
'uid': p.pw_uid, 'gid': p.pw_gid,
|
|
'home_mode': home.st_mode & 0o777, 'state_mode': state.st_mode & 0o777,
|
|
'home_uid': home.st_uid, 'state_uid': state.st_uid,
|
|
'groups': sorted(os.getgrouplist(p.pw_name, p.pw_gid)),
|
|
'interop': c.get('interop','enabled'),
|
|
'automount': c.get('automount','enabled'),
|
|
'mount_fstab': c.get('automount','mountFsTab'),
|
|
'windows_mount': Path('/mnt/c/Windows').exists(),
|
|
'operator_home': Path('/home/worsch').exists(),
|
|
'interop_handler': Path('/proc/sys/fs/binfmt_misc/WSLInterop').exists(),
|
|
})
|
|
except Exception:
|
|
result = {'partial_preflight_passed': False, 'assignment_admitted': False,
|
|
'reason': 'preflight_refused'}
|
|
print(json.dumps(result, sort_keys=True))
|
|
return 0 if result['partial_preflight_passed'] else 1
|
|
|
|
|
|
if __name__ == '__main__':
|
|
sys.exit(main())
|