mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
rcourtman
e93ee38084
Rootful evidence must reject non-running systemd states and prove no unrelated container runtime survives. Require exact manager state, mask distro containerd, recheck readiness after scenarios, and remove the complete Podman socket boundary.
43 lines
1.4 KiB
Bash
43 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# This file is sourced by run-secure-runtime-rootful-qualification.sh and kept
|
|
# separately so the fail-closed systemd readiness predicate can be exercised
|
|
# without entering the destructive qualification wrapper.
|
|
|
|
rootful_qualification_systemd_readiness() {
|
|
local container_id="$1"
|
|
local manager_state manager_status=0 target_state failed_units
|
|
|
|
if manager_state="$(docker exec "${container_id}" systemctl is-system-running 2>/dev/null)"; then
|
|
manager_status=0
|
|
else
|
|
manager_status=$?
|
|
fi
|
|
case "${manager_state}" in
|
|
running)
|
|
if (( manager_status != 0 )); then
|
|
printf 'ERROR: systemd reported running with exit status %d\n' "${manager_status}" >&2
|
|
return 2
|
|
fi
|
|
;;
|
|
""|initializing|starting)
|
|
return 1
|
|
;;
|
|
*)
|
|
printf 'ERROR: disposable systemd container entered non-running state %q\n' "${manager_state}" >&2
|
|
return 2
|
|
;;
|
|
esac
|
|
|
|
target_state="$(docker exec "${container_id}" systemctl show \
|
|
--property=ActiveState --value multi-user.target 2>/dev/null)" || return 1
|
|
[[ "${target_state}" == "active" ]] || return 1
|
|
|
|
failed_units="$(docker exec "${container_id}" systemctl list-units \
|
|
--state=failed --no-legend --no-pager --plain 2>/dev/null)" || return 1
|
|
if [[ -n "${failed_units//[[:space:]]/}" ]]; then
|
|
printf 'ERROR: disposable systemd container has failed units:\n%s\n' "${failed_units}" >&2
|
|
return 2
|
|
fi
|
|
}
|