37 lines
1.6 KiB
Python
37 lines
1.6 KiB
Python
|
"""Installer-only ACL provisioning for this exact SafetyNet installation.
|
||
|
|
|
||
|
|
Run with the installed private Python. No caller-controlled grant roots exist.
|
||
|
|
Normal service startup verifies ACLs without changing them.
|
||
|
|
"""
|
||
|
|
import argparse
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
import sys
|
||
|
|
|
||
|
|
sys.path.insert(0, str(Path(__file__).resolve().parent))
|
||
|
|
sys.dont_write_bytecode=True
|
||
|
|
from windows_appcontainer import AppContainer, SandboxError
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
||
|
|
parser.add_argument('--provision', action='store_true', help='Installer/owner only: establish read/execute ACLs')
|
||
|
|
args = parser.parse_args()
|
||
|
|
source = Path(__file__).absolute().parent
|
||
|
|
development = source.parent.name == 'apps'
|
||
|
|
installation = source.parent.parent if development else source.parent
|
||
|
|
runtime = installation / ('.runtime/windows/python' if development else 'python')
|
||
|
|
semantic = installation / ('.runtime/windows/semantic' if development else 'semantic')
|
||
|
|
if Path(sys.executable).resolve().parent != runtime.resolve():
|
||
|
|
raise SandboxError('Use the private Python belonging to this installation')
|
||
|
|
roots = [source, runtime]
|
||
|
|
if semantic.is_dir(): roots.append(semantic)
|
||
|
|
sandbox = AppContainer(roots, provision=args.provision)
|
||
|
|
print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
try: main()
|
||
|
|
except (SandboxError, OSError):
|
||
|
|
print('Approved installation ACL verification/provisioning failed.', file=sys.stderr)
|
||
|
|
raise SystemExit(1)
|