From a741c57c6053b6a8f3c87499df0ff5c71b3c0fd9 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Thu, 17 Feb 2022 17:19:46 +0100 Subject: vidhar: ... --- hosts/vidhar/borg/copy.py | 32 +++++++------------------------- 1 file changed, 7 insertions(+), 25 deletions(-) (limited to 'hosts/vidhar/borg/copy.py') diff --git a/hosts/vidhar/borg/copy.py b/hosts/vidhar/borg/copy.py index 96426682..6adaa817 100755 --- a/hosts/vidhar/borg/copy.py +++ b/hosts/vidhar/borg/copy.py @@ -21,7 +21,6 @@ from xdg import xdg_runtime_dir import pathlib import unshare -import pyprctl import signal from time import sleep @@ -94,38 +93,21 @@ def copy_archive(src_repo_path, dst_repo_path, entry): child = os.fork() if child == 0: # print('unshare/chroot', file=stderr) - uid, gid = os.geteuid(), os.getegid() - unshare.unshare(unshare.CLONE_NEWNS | unshare.CLONE_NEWUSER) - ps_effective = set() # {pyprctl.Cap.SETUID, pyprctl.Cap.SETGID} - ps_ambient = {pyprctl.Cap.SYS_ADMIN} - pyprctl.cap_permitted.add(*(ps_effective | ps_ambient)) - pyprctl.cap_effective.add(*(ps_effective | ps_ambient)) - pyprctl.cap_inheritable.add(*ps_ambient) - pyprctl.cap_ambient.add(*ps_ambient) - with open('/proc/self/setgroups', 'w') as setgroups: - setgroups.write('deny') - with open('/proc/self/uid_map', 'w') as uid_map: - uid_map.write(f'0 {uid} 1') - with open('/proc/self/gid_map', 'w') as gid_map: - gid_map.write(f'0 {gid} 1') + unshare.unshare(unshare.CLONE_NEWNS) subprocess.run(['mount', '--make-rprivate', '/'], check=True) chroot = pathlib.Path(tmpdir) / 'chroot' - chroot.mkdir() - # upper = pathlib.Path(tmpdir) / 'upper' - # work = pathlib.Path(tmpdir) / 'work' - # for path in [chroot,upper,work]: - # path.mkdir() - # print(f'euid={os.getuid()}', file=stderr) - # subprocess.run(['stat', '/', upper, work, chroot], check=True) - # subprocess.run(['mount', '-t', 'overlay', 'overlay', '-o', f'lowerdir=/,upperdir={upper},workdir={work}', chroot], check=True) - bindMounts = ['etc', 'nix', 'run', 'proc', 'dev', 'sys', pathlib.Path(os.path.expanduser('~')).relative_to('/')] + upper = pathlib.Path(tmpdir) / 'upper' + work = pathlib.Path(tmpdir) / 'work' + for path in [chroot,upper,work]: + path.mkdir() + subprocess.run(['mount', '-t', 'overlay', 'overlay', '-o', f'lowerdir=/,upperdir={upper},workdir={work}', chroot], check=True) + bindMounts = ['nix', 'run', 'proc', 'dev', 'sys', pathlib.Path(os.path.expanduser('~')).relative_to('/')] if not ":" in src_repo_path: bindMounts.append(pathlib.Path(src_repo_path).relative_to('/')) if 'SSH_AUTH_SOCK' in os.environ: bindMounts.append(pathlib.Path(os.environ['SSH_AUTH_SOCK']).parent.relative_to('/')) for bindMount in bindMounts: (chroot / bindMount).mkdir(parents=True,exist_ok=True) - print(*['mount', '--bind', pathlib.Path('/') / bindMount, chroot / bindMount], file=stderr) subprocess.run(['mount', '--bind', pathlib.Path('/') / bindMount, chroot / bindMount], check=True) os.chroot(chroot) os.chdir('/') -- cgit v1.2.3