validation/friidump-linux-rawio-capability.sh

   1 #!/usr/bin/env bash
   2 set -Eeuo pipefail
   3
   4 action="${1:-status}"
   5 source_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
   6 default_binary="$source_root/build/src/friidump"
   7 binary="${2:-$default_binary}"
   8 expected_version="0.5.3.16-pf1"
   9
  10 fail() {
  11     printf 'ERROR: %s\n' "$*" >&2
  12     exit 1
  13 }
  14
  15 require_command() {
  16     local name="$1"
  17     local package="$2"
  18
  19     command -v "$name" >/dev/null 2>&1 || {
  20         printf 'Missing required command: %s\n' "$name" >&2
  21         printf 'Ubuntu package hint: sudo apt-get install -y %s\n' "$package" >&2
  22         exit 1
  23     }
  24 }
  25
  26 resolve_binary() {
  27     local resolved help_output help_status
  28
  29     [[ -f "$binary" ]] || fail "FriiDump executable does not exist: $binary"
  30     [[ -x "$binary" ]] || fail "FriiDump executable is not executable: $binary"
  31     [[ ! -L "$binary" ]] || fail "Refusing a symbolic-link executable: $binary"
  32
  33     resolved="$(readlink -f -- "$binary")"
  34     [[ -n "$resolved" && -f "$resolved" ]] || fail "Unable to resolve executable: $binary"
  35
  36     set +e
  37     help_output="$("$resolved" --help 2>&1)"
  38     help_status=$?
  39     set -e
  40
  41     [[ "$help_status" -eq 1 ]] || fail "Unexpected --help exit status from $resolved: $help_status"
  42     grep -Fq "FriiDump $expected_version" <<<"$help_output" ||
  43         fail "Executable version mismatch: $resolved"
  44
  45     printf '%s\n' "$resolved"
  46 }
  47
  48 capability_text() {
  49     getcap -n -- "$1" 2>/dev/null || true
  50 }
  51
  52 capability_present() {
  53     local text
  54     text="$(capability_text "$1")"
  55     [[ "$text" =~ cap_sys_rawio(\+|=)(ep|eip|p|ip) ]] ||
  56         [[ "$text" == *"cap_sys_rawio=ep"* ]]
  57 }
  58
  59 print_identity() {
  60     local resolved="$1"
  61     printf 'Executable: %s\n' "$resolved"
  62     printf 'SHA-256:   %s\n' "$(sha256sum "$resolved" | awk '{print $1}')"
  63     printf 'File mode: '
  64     stat -c '%A (%a) owner=%U:%G' "$resolved"
  65     printf 'Capability: %s\n' "$(capability_text "$resolved")"
  66 }
  67
  68 install_capability() {
  69     local resolved="$1"
  70     local before_hash after_hash
  71
  72     before_hash="$(sha256sum "$resolved" | awk '{print $1}')"
  73
  74     printf '\nInstalling the minimum Linux authority required for vendor SCSI commands.\n'
  75     printf 'Only the exact executable receives CAP_SYS_RAWIO; FriiDump remains a normal-user process.\n'
  76     printf 'Do not run FriiDump itself with sudo.\n\n'
  77
  78     sudo setcap cap_sys_rawio=ep "$resolved"
  79
  80     after_hash="$(sha256sum "$resolved" | awk '{print $1}')"
  81     [[ "$after_hash" == "$before_hash" ]] ||
  82         fail "Executable bytes changed while applying the file capability."
  83
  84     capability_present "$resolved" || {
  85         print_identity "$resolved"
  86         fail "CAP_SYS_RAWIO verification failed."
  87     }
  88
  89     print_identity "$resolved"
  90     printf '\nFRIIDUMP LINUX RAW-I/O CAPABILITY INSTALL: PASS\n'
  91     printf 'WARNING: rebuilding, replacing, copying, or re-extracting this executable clears the capability.\n'
  92 }
  93
  94 remove_capability() {
  95     local resolved="$1"
  96
  97     if ! capability_present "$resolved"; then
  98         print_identity "$resolved"
  99         printf '\nFRIIDUMP LINUX RAW-I/O CAPABILITY REMOVE: NOT PRESENT\n'
 100         return 0
 101     fi
 102
 103     sudo setcap -r "$resolved"
 104
 105     if capability_present "$resolved"; then
 106         print_identity "$resolved"
 107         fail "CAP_SYS_RAWIO remains present after removal."
 108     fi
 109
 110     print_identity "$resolved"
 111     printf '\nFRIIDUMP LINUX RAW-I/O CAPABILITY REMOVE: PASS\n'
 112 }
 113
 114 require_command getcap libcap2-bin
 115 require_command sha256sum coreutils
 116 require_command readlink coreutils
 117 require_command stat coreutils
 118
 119 resolved_binary="$(resolve_binary)"
 120
 121 case "$action" in
 122     status)
 123         print_identity "$resolved_binary"
 124         if capability_present "$resolved_binary"; then
 125             printf '\nFRIIDUMP LINUX RAW-I/O CAPABILITY STATUS: PRESENT\n'
 126         else
 127             printf '\nFRIIDUMP LINUX RAW-I/O CAPABILITY STATUS: MISSING\n'
 128             printf 'Vendor-command operations will be refused before seed retrieval or unlock.\n'
 129             printf 'Install with:\n  bash %q install %q\n' "$0" "$resolved_binary"
 130             exit 1
 131         fi
 132         ;;
 133     install)
 134         require_command setcap libcap2-bin
 135         require_command sudo sudo
 136         install_capability "$resolved_binary"
 137         ;;
 138     remove)
 139         require_command setcap libcap2-bin
 140         require_command sudo sudo
 141         remove_capability "$resolved_binary"
 142         ;;
 143     *)
 144         printf 'Usage: %s {status|install|remove} [friidump-executable]\n' "$0" >&2
 145         exit 2
 146         ;;
 147 esac