#!/usr/bin/python

"""Drop privileges, then exec -- the one errand run.sh cannot do in shell.

Two shapes, and both of them are in run.sh:

    drop_privs.py --keep=kill,setgid,setuid,setpcap -- sh /usr/local/bin/run.sh
    drop_privs.py --user -- pybitmessage -d

The first stays root and shrinks the capability bounding set to what starting
and stopping the daemon takes. Nothing execed below it can hold more than that
for the rest of the container's life. The second keeps nothing and becomes the
daemon's own user: an empty bounding set, no capability in any set, and
no_new_privs, so not even a setuid binary could raise it -- and after the strip
in the Dockerfile the image has none left anyway.

setpriv would have been the obvious tool for this. Ubuntu 18.04 does not have
it: the program exists in util-linux 2.31 upstream, but Debian only began
installing it at 2.32, and this image is built on bionic because PyBitmessage is
Python 2. gosu, which the image used before, only ever changed the user.

The bounding set is walked up to the kernel's own cap_last_cap rather than a
list written down here, so a capability this image has never heard of is dropped
just the same. Everything that fails is fatal: a privilege drop that half worked
would leave a container looking confined and not being it.
"""

import ctypes
import os
import sys

PR_CAPBSET_DROP = 24
PR_SET_NO_NEW_PRIVS = 38

# Only the ones a caller here ever keeps. A number is accepted too, for a
# capability this table does not name.
CAP_NUMBERS = {
    "kill": 5,
    "setgid": 6,
    "setuid": 7,
    "setpcap": 8,
}

USAGE = "usage: drop_privs.py [--user] [--keep=cap,...] -- program [args]"


def die(message):
    sys.stderr.write("drop_privs: %s\n" % message)
    sys.exit(1)


libc = ctypes.CDLL("libc.so.6", use_errno=True)


def prctl(option, arg2):
    ctypes.set_errno(0)
    if libc.prctl(option, arg2, 0, 0, 0) != 0:
        die("prctl(%d, %d): %s"
            % (option, arg2, os.strerror(ctypes.get_errno())))


def cap_last_cap():
    """The highest capability this kernel knows.

    Read rather than guessed, and a failure to read is fatal: a guess that came
    in low would silently leave the capabilities above it in the bounding set.
    """
    try:
        handle = open("/proc/sys/kernel/cap_last_cap")
    except IOError as exc:
        die("cannot open /proc/sys/kernel/cap_last_cap: %s" % exc)
    try:
        try:
            return int(handle.read().strip())
        except ValueError as exc:
            die("cannot read /proc/sys/kernel/cap_last_cap: %s" % exc)
    finally:
        handle.close()


def parse_keep(value):
    keep = set()
    for name in value.split(","):
        name = name.strip()
        if not name:
            continue
        if name in CAP_NUMBERS:
            keep.add(CAP_NUMBERS[name])
        else:
            try:
                keep.add(int(name))
            except ValueError:
                die("unknown capability %r" % name)
    return keep


def main(argv):
    keep = set()
    become_user = False
    args = argv[1:]

    while args:
        if args[0] == "--":
            args = args[1:]
            break
        elif args[0] == "--user":
            become_user = True
            args = args[1:]
        elif args[0].startswith("--keep="):
            keep |= parse_keep(args[0][len("--keep="):])
            args = args[1:]
        else:
            die("unknown option %r\n%s" % (args[0], USAGE))

    if not args:
        die("nothing to execute\n%s" % USAGE)

    # Before anything else, so that everything below inherits it.
    prctl(PR_SET_NO_NEW_PRIVS, 1)

    # Dropping from the bounding set takes CAP_SETPCAP, which is still held
    # here; it does not touch the sets this process is using, so the uid change
    # below still works after every capability has gone out of the set.
    for cap in range(0, cap_last_cap() + 1):
        if cap not in keep:
            prctl(PR_CAPBSET_DROP, cap)

    if become_user:
        uid = int(os.environ.get("USER_UID", "2000"))
        gid = int(os.environ.get("USER_GID", "2000"))
        # Groups first, then gid, then uid: each of the three needs a
        # privilege the next one gives up.
        try:
            os.setgroups([])
            os.setresgid(gid, gid, gid)
            os.setresuid(uid, uid, uid)
        except OSError as exc:
            die("cannot become %d:%d: %s" % (uid, gid, exc))

    try:
        os.execvp(args[0], args)
    except OSError as exc:
        die("cannot execute %r: %s" % (args[0], exc))


if __name__ == "__main__":
    main(sys.argv)