mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 16:31:00 +00:00
67 lines
2.5 KiB
Bash
67 lines
2.5 KiB
Bash
#!/bin/sh
|
|
|
|
chown nobody -R /execute/
|
|
|
|
# Whether this is the first boot of this container, told to the backend. A container's
|
|
# environment is fixed when it is created, and Docker starting it again by itself — after
|
|
# a reboot, a restart of the daemon, a crash under `restart: unless-stopped` — brings back
|
|
# that environment, which may be older than what `run.py config` has said since. The
|
|
# marker lives in the container's own layer: it survives a restart and is gone from a
|
|
# container `run.py` creates anew.
|
|
if [ ! -e /execute/.firegex-booted ]; then
|
|
touch /execute/.firegex-booted
|
|
export FIREGEX_FRESH_BOOT=1
|
|
fi
|
|
|
|
# Create socket directory if SOCKET_DIR is set
|
|
if [ -n "$SOCKET_DIR" ]; then
|
|
mkdir -p "$SOCKET_DIR"
|
|
chown nobody:nobody "$SOCKET_DIR"
|
|
chmod 755 "$SOCKET_DIR"
|
|
fi
|
|
|
|
# Set host sysctls while running as root.
|
|
if [ -d "/sys_host" ]; then
|
|
echo "[*] Setting host sysctls..."
|
|
echo 1 > /sys_host/net.ipv4.conf.all.forwarding 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv6.conf.all.forwarding 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv4.conf.all.route_localnet 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv4.ip_forward 2>/dev/null || true
|
|
fi
|
|
|
|
echo "[*] Attempting to start with capabilities..."
|
|
|
|
# Two sets, tried in order, because they are not equally important.
|
|
#
|
|
# `cap_net_raw` is what lets the proxy engine open the packet socket it writes decrypted
|
|
# traffic to, for an operator capturing `firegex0`. It is a capture aid: a host that will
|
|
# not grant it should lose the capture, not the firewall. So the set without it is tried
|
|
# next, and only if *that* fails does anything run as root.
|
|
try_caps() {
|
|
caps="$1"
|
|
ambient="$2"
|
|
capsh --caps="$caps" --keep=1 --user=nobody --addamb="$ambient" -- -c "exit 0" 2>/dev/null
|
|
}
|
|
|
|
run_caps() {
|
|
exec capsh --caps="$1" --keep=1 --user=nobody --addamb="$2" \
|
|
--shell=/usr/bin/python3 -- /execute/app.py DOCKER
|
|
}
|
|
|
|
FULL="cap_net_admin,cap_net_raw,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip"
|
|
FULL_AMB="cap_net_admin,cap_net_raw,cap_sys_nice"
|
|
BASE="cap_net_admin,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip"
|
|
BASE_AMB="cap_net_admin,cap_sys_nice"
|
|
|
|
if try_caps "$FULL" "$FULL_AMB"; then
|
|
run_caps "$FULL" "$FULL_AMB"
|
|
elif try_caps "$BASE" "$BASE_AMB"; then
|
|
echo "[!] no cap_net_raw: TLS services will run, but their decrypted traffic"
|
|
echo " cannot be written to the capture interface"
|
|
run_caps "$BASE" "$BASE_AMB"
|
|
else
|
|
echo "[!] capsh failed, running with root user"
|
|
exec python3 /execute/app.py DOCKER
|
|
fi
|
|
|