container-bin-image (1925B)
1 {% extends "base" %} 2 {% block body -%} 3 #+{{pkg_install_name("busybox")}} 4 #+{{pkg_install_name("busybox-diffutils")}} 5 #+{{pkg_install_name("busybox-login")}} 6 #+{{pkg_install_name("execline")}} 7 #+{{pkg_install_name("s6")}} 8 #+{{pkg_install_name("ccx-utils")}} 9 #+{{pkg_install_name("applyuidgid-caps")}} 10 #+{{pkg_install_name("easyseccomp")}} 11 #+{{pkg_install_name("mlog")}} 12 #+{{pkg_install_name("abduco")}} 13 #+{{pkg_install_name("nawk")}} 14 #@sha256:{{files["default-policy.easyseccomp"]}}:default-policy.easyseccomp 15 16 img="$pthbs_destdir{{versions}}/$pthbs_package/container-bin-image" 17 mkdir -p "$img" 18 easyseccomp -i default-policy.easyseccomp -o "$img/seccomp-default.bpf" 19 easyseccomp -i default-policy.easyseccomp -d ALLOW_PTRACE -o "$img/seccomp-ptrace.bpf" 20 easyseccomp -i default-policy.easyseccomp -d ALLOW_PTRACE -d ALLOW_SECCOMP -d ALLOW_LANDLOCK -o "$img/seccomp-build.bpf" 21 easyseccomp -i default-policy.easyseccomp -d ALLOW_PTRACE -d ALLOW_SETUID_SETGID -o "$img/seccomp-xpra.bpf" 22 easyseccomp -i default-policy.easyseccomp -d ALLOW_SETUID_SETGID -o "$img/seccomp-setuidgid.bpf" 23 cd "$img" 24 25 # first commands without argv0 aliases 26 for cmd in "${PATH%%:*}"/*; do 27 rp=$(realpath "$cmd") 28 base=$(basename "$rp") 29 if test $base = "${cmd##*/}"; then 30 if test -e "./$base"; then 31 printf "fatal: duplicate command file: '%s'\n" "$base" 32 exit 1 33 fi 34 cp -p "$rp" ./ 35 fi 36 done 37 38 # now alias using symlinks 39 for cmd in "${PATH%%:*}"/*; do 40 rp=$(realpath "$cmd") 41 base=$(basename "$rp") 42 if ! test $base = "${cmd##*/}"; then 43 if ! test -f "./$base"; then 44 cp -p "$rp" ./ 45 fi 46 ln -s "./$base" "./${cmd##*/}" 47 fi 48 done 49 50 for cmd in if busybox umount chpst spawn-pty ptsname applyuidgid-caps; do 51 if ! test -x "./$cmd"; then 52 printf "fatal: expected command not found: '%s'\n" "$cmd" 53 exit 1 54 fi 55 done 56 ./true 57 ./seccomp-run ./seccomp-default.bpf ./true 58 59 60 touch "$pthbs_destdir{{versions}}/$pthbs_package/.install-links" 61 {% endblock %}