世界
111 lines
2.7 KiB
Go
111 lines
2.7 KiB
Go
//go:build with_gvisor && !windows
|
|
|
|
package tailssh
|
|
|
|
import (
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
"strconv"
|
|
"syscall"
|
|
|
|
gliderssh "github.com/sagernet/gliderssh"
|
|
"github.com/sagernet/sing-box/adapter"
|
|
)
|
|
|
|
func isPrivilegedUser() bool {
|
|
return os.Getuid() == 0
|
|
}
|
|
|
|
func requestedUserMatchesProcess(localUser *adapter.PlatformUser) (bool, error) {
|
|
return localUser.Uid == os.Getuid() && localUser.Gid == os.Getgid(), nil
|
|
}
|
|
|
|
// verifyShellIdentity is a no-op on Unix: spawned shells and sftp-server drop to the
|
|
// requested user via setCredential, so the child already runs as that user.
|
|
func verifyShellIdentity(_ adapter.PlatformInterface, _ *adapter.PlatformUser) error {
|
|
return nil
|
|
}
|
|
|
|
func systemHostKeyPath() string {
|
|
return "/etc/ssh/ssh_host_ed25519_key"
|
|
}
|
|
|
|
func defaultPathEnv(_ adapter.PlatformInterface) string {
|
|
return "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
|
}
|
|
|
|
func userSocketDirectories(localUser *adapter.PlatformUser) []string {
|
|
return gliderssh.UserSocketDirectories(localUser.HomeDir, strconv.Itoa(localUser.Uid))
|
|
}
|
|
|
|
func newAgentListener(localUser *adapter.PlatformUser) (net.Listener, error) {
|
|
listener, err := gliderssh.NewAgentListener()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
socketPath := listener.Addr().String()
|
|
if localUser.Uid < 0 || localUser.Uid == os.Getuid() {
|
|
return listener, nil
|
|
}
|
|
err = os.Chown(socketPath, localUser.Uid, localUser.Gid)
|
|
if err != nil {
|
|
listener.Close()
|
|
return nil, err
|
|
}
|
|
err = os.Chmod(socketPath, 0o600)
|
|
if err != nil {
|
|
listener.Close()
|
|
return nil, err
|
|
}
|
|
// Make the MkdirTemp parent traversable so the dropped-privilege child can
|
|
// reach the socket.
|
|
err = os.Chmod(filepath.Dir(socketPath), 0o755)
|
|
if err != nil {
|
|
listener.Close()
|
|
return nil, err
|
|
}
|
|
return listener, nil
|
|
}
|
|
|
|
func platformEnvironment(_ *adapter.PlatformUser) []string {
|
|
return nil
|
|
}
|
|
|
|
func sftpCommand(sftpPath, _ string) string {
|
|
return sftpPath + " 2>/dev/null"
|
|
}
|
|
|
|
func sshSignalToSyscall(sig gliderssh.Signal) int {
|
|
switch sig {
|
|
case gliderssh.SIGABRT:
|
|
return int(syscall.SIGABRT)
|
|
case gliderssh.SIGALRM:
|
|
return int(syscall.SIGALRM)
|
|
case gliderssh.SIGFPE:
|
|
return int(syscall.SIGFPE)
|
|
case gliderssh.SIGHUP:
|
|
return int(syscall.SIGHUP)
|
|
case gliderssh.SIGILL:
|
|
return int(syscall.SIGILL)
|
|
case gliderssh.SIGINT:
|
|
return int(syscall.SIGINT)
|
|
case gliderssh.SIGKILL:
|
|
return int(syscall.SIGKILL)
|
|
case gliderssh.SIGPIPE:
|
|
return int(syscall.SIGPIPE)
|
|
case gliderssh.SIGQUIT:
|
|
return int(syscall.SIGQUIT)
|
|
case gliderssh.SIGSEGV:
|
|
return int(syscall.SIGSEGV)
|
|
case gliderssh.SIGTERM:
|
|
return int(syscall.SIGTERM)
|
|
case gliderssh.SIGUSR1:
|
|
return int(syscall.SIGUSR1)
|
|
case gliderssh.SIGUSR2:
|
|
return int(syscall.SIGUSR2)
|
|
default:
|
|
return 0
|
|
}
|
|
}
|