From: Thomas Walker Lynch Date: Mon, 22 Sep 2025 09:59:36 +0000 (+0000) Subject: released perm tool X-Git-Url: https://git.reasoningtechnology.com/usr/lib/python2.7/opcode.py?a=commitdiff_plain;h=4f5bfaafa50506be7bd49f7b245bc20a6143e0d5;p=Man-In-Grey released perm tool --- diff --git a/release/shell/Man_In_Grey b/release/shell/Man_In_Grey index 2ad1606..f73f61d 100755 --- a/release/shell/Man_In_Grey +++ b/release/shell/Man_In_Grey @@ -1,62 +1,110 @@ #!/usr/bin/env bash -# man_in_grey — canonical entrypoint for Man_In_Grey -# - Resolves repo → release dirs -# - Requires the privileged gasket (single code path) -# - Always invokes the Python orchestrator with --apply-cmd +# Diagnose Man_In_Grey privilege flow: user → gasket (setuid) → python inner set -euo pipefail -# --- resolve this script’s absolute path (portable) --- -_this="${BASH_SOURCE[0]:-$0}" +# --- locate repo root (best effort) --- +script_afp="$(realpath "${BASH_SOURCE[0]}")" +REPO_HOME="$(cd "$(dirname "$script_afp")/.." && pwd -P 2>/dev/null || pwd -P)" -if command -v realpath >/dev/null 2>&1; then - _this_abs="$(realpath -- "$_this")" +# --- arch normalizer (same mapping we use elsewhere) --- +_arch_raw=$(uname -m | tr '[:upper:]' '[:lower:]') +case "$_arch_raw" in + amd64|x64) _arch="x86_64" ;; + x86_64) _arch="x86_64" ;; + i386|i486|i586|i686) _arch="i686" ;; + arm64|aarch64) _arch="aarch64" ;; + armv7l) _arch="armv7l" ;; + armv6l) _arch="armv6l" ;; + riscv64) _arch="riscv64" ;; + ppc64le|powerpc64le) _arch="ppc64le" ;; + s390x) _arch="s390x" ;; + *) _arch="$_arch_raw" ;; +esac + +# Allow overriding via env/args +REL_BASE="${REPO_HOME}/tool_shared/third_party/Man_In_Grey/release" +REL_BASE="${REL_BASE:-${REPO_HOME}/release}" +GASKET="${1:-${REL_BASE}/${_arch}/man_in_grey_apply}" +WRAP="${2:-${REL_BASE}/shell/Man_In_Grey}" + +echo "== who/where ==" +echo "user: $(id -un) (uid=$(id -u)) groups: $(id -nG)" +echo "pwd : $(pwd)" +echo + +echo "== paths ==" +echo "wrapper: $WRAP" +echo "gasket : $GASKET" +echo + +echo "== wrapper sanity ==" +if [[ -x "$WRAP" ]]; then + head -n 1 "$WRAP" | sed 's/^/shebang: /' + echo "exec path: $(command -v "$WRAP" || echo '(not in PATH)')" else - if _tmp="$(readlink -f -- "$_this" 2>/dev/null)"; then - _this_abs="${_tmp}" - else - _dir="$(cd "$(dirname -- "$_this")" && pwd -P)" - _base="$(basename -- "$_this")" - _this_abs="${_dir}/${_base}" - fi + echo "!! wrapper missing/non-exec" fi +echo -_shell_dir="$(cd "$(dirname -- "$_this_abs")" && pwd -P)" # .../release/shell -_release_dir="$(cd "${_shell_dir}/.." && pwd -P)" # .../release -_repo_root="$(cd "${_release_dir}/.." && pwd -P)" # repo root - -# --- orchestrator path (prefer released copy) --- -_py_release="${_release_dir}/python3/Man_In_Grey.py" -_py_dev="${_repo_root}/developer/source/Man_In_Grey.py" -if [[ -f "$_py_release" ]]; then - _py_entry="$_py_release" -elif [[ -f "$_py_dev" ]]; then - _py_entry="$_py_dev" +echo "== gasket file sanity ==" +if [[ -e "$GASKET" ]]; then + ls -l "$GASKET" + # setuid bit present? + if [[ -u "$GASKET" ]]; then echo "setuid: YES"; else echo "setuid: NO"; fi + # mount options + mp="$(dirname "$(readlink -f "$GASKET")")" + echo "mount: $(findmnt -no TARGET,FSTYPE,OPTIONS "$mp" 2>/dev/null || echo 'findmnt not available')" else - echo "error: Man_In_Grey.py not found in release/python3/ or developer/source/" >&2 - exit 2 + echo "!! gasket not found" fi +echo -# --- arch normalize (uname -m → release/) --- -_arch_raw="$(uname -m | tr '[:upper:]' '[:lower:]')" -case "$_arch_raw" in - amd64|x64) _arch="x86_64" ;; - x86_64) _arch="x86_64" ;; - i386|i486|i586|i686) _arch="i686" ;; - arm64|aarch64) _arch="aarch64";; - armv7l) _arch="armv7l" ;; - armv6l) _arch="armv6l" ;; - riscv64) _arch="riscv64";; - ppc64le|powerpc64le) _arch="ppc64le";; - s390x) _arch="s390x" ;; - *) _arch="$_arch_raw" ;; -esac +echo "== gasket self-report (--print-flags) ==" +if [[ -x "$GASKET" ]]; then + "$GASKET" --print-flags || true +else + echo "skip (no gasket)" +fi +echo -_gasket="${_release_dir}/${_arch}/man_in_grey_apply" -if [[ ! -x "$_gasket" ]]; then - echo "error: gasket missing: ${_gasket}" >&2 - echo "hint: from \$REPO_HOME/developer: run compile then release" >&2 - exit 2 +echo "== python inner EUID test ==" +PYTEST="/tmp/mig_ids_$$.py" +cat >"$PYTEST"<<'PY' +import os, sys, grp, pwd +u = os.getuid(); e = os.geteuid() +name = pwd.getpwuid(u).pw_name if u>=0 else "?" +print(f"py.real_uid={u} ({name})") +print(f"py.effective_uid={e}") +print("py.groups=", os.getgroups()) +sys.exit(0) +PY +chmod 0644 "$PYTEST" + +if [[ -x "$GASKET" ]]; then + echo "running: $GASKET --inner $PYTEST" + "$GASKET" --inner "$PYTEST" || true +else + echo "skip (no gasket)" +fi +rm -f "$PYTEST" +echo + +echo "== wrapper execution trace (dry) ==" +if [[ -x "$WRAP" ]]; then + echo "+ bash -x \"$WRAP\" --phase-2-sanity2-then-stop --stage dummy (trace only)" + set +e + bash -x "$WRAP" --phase-2-sanity2-then-stop --stage dummy 1>/dev/null 2>&1 | sed 's/^/TRACE: /' || true + set -e +else + echo "skip (no wrapper)" fi -# --- run orchestrator (single code path via gasket) --- -exec "${PYTHON:-python3}" "$_py_entry" --apply-cmd "$_gasket" "$@" +echo +echo "== verdict (rules of thumb) ==" +cat <<'EOT' +- If --print-flags shows "flag.this_process_privileged=0": the setuid bit is not taking effect (check mount nosuid, file perms, or wrong gasket path). +- If --print-flags is 1 but python euid is 0: privileges are flowing OK; problems are likely in the shell wrapper bypassing the gasket. +- If --print-flags is 1 but python euid is NOT 0: something is stripping EUID across exec (rare: no_new_privs or an LSM). Check `grep NoNewPrivs /proc/$$/status` from the caller shell and try running outside wrappers. +- If wrapper trace never execs the gasket: fix the wrapper to always call the gasket. +- If you are root and see a 'not in sudo' refusal: update gasket policy to allow root (special-case UID 0). +EOT