#!/usr/bin/env bash
set -euo pipefail

binary=${1:?usage: direct-root-privilege-drop.sh SYSTEMD_RESOLVED}
runtime_directory=$(mktemp -d /tmp/rustd-resolved-privileges.XXXXXX)
log_file=$(mktemp /tmp/rustd-resolved-privileges.XXXXXX.log)
launcher_pid=
pid=

cleanup() {
    if [[ -n $pid ]]; then
        sudo kill -TERM "$pid" 2>/dev/null || true
        for _ in {1..100}; do
            sudo kill -0 "$pid" 2>/dev/null || break
            sleep 0.05
        done
        sudo kill -KILL "$pid" 2>/dev/null || true
    fi
    if [[ -n $launcher_pid ]]; then
        for _ in {1..100}; do
            kill -0 "$launcher_pid" 2>/dev/null || break
            sleep 0.05
        done
        kill -KILL "$launcher_pid" 2>/dev/null || true
        wait "$launcher_pid" 2>/dev/null || true
    fi
    sudo rm -r -- "$runtime_directory" 2>/dev/null || true
    rm -f -- "$log_file"
}
trap cleanup EXIT HUP INT TERM

account=$(getent passwd systemd-resolve)
expected_uid=$(cut -d: -f3 <<<"$account")
expected_gid=$(cut -d: -f4 <<<"$account")

find_daemon_pid() {
    local candidate
    local command_line
    local status
    local uid

    for status in /proc/[0-9]*/status; do
        [[ -r $status ]] || continue
        candidate=${status#/proc/}
        candidate=${candidate%/status}
        [[ -r /proc/$candidate/cmdline ]] || continue
        command_line=$(tr '\0' '\n' <"/proc/$candidate/cmdline")
        grep -Fx -- "$runtime_directory" <<<"$command_line" >/dev/null || continue
        uid=$(awk '/^Uid:/ { print $2 }' "$status")
        [[ $uid == "$expected_uid" ]] || continue
        printf '%s\n' "$candidate"
        return 0
    done
    return 1
}

# shellcheck disable=SC2024
sudo "$binary" \
    --listen 127.0.0.1:1053 \
    --port 1053 \
    --runtime-directory "$runtime_directory" \
    --upstream 192.0.2.1:53 \
    --no-varlink \
    --no-dbus \
    >"$log_file" 2>&1 &
launcher_pid=$!

for _ in {1..100}; do
    pid=$(find_daemon_pid) && break
    sleep 0.05
done
[[ -r /proc/$pid/status ]] || {
    cat "$log_file" >&2
    exit 1
}

actual_uid=$(awk '/^Uid:/ { print $2 }' "/proc/$pid/status")
actual_gid=$(awk '/^Gid:/ { print $2 }' "/proc/$pid/status")
effective_caps=$(awk '/^CapEff:/ { print $2 }' "/proc/$pid/status")
bounding_caps=$(awk '/^CapBnd:/ { print $2 }' "/proc/$pid/status")
directory_uid=$(stat -c %u "$runtime_directory")
directory_gid=$(stat -c %g "$runtime_directory")

[[ $actual_uid == "$expected_uid" ]]
[[ $actual_gid == "$expected_gid" ]]
[[ $directory_uid == "$expected_uid" ]]
[[ $directory_gid == "$expected_gid" ]]
[[ $((16#$effective_caps)) -eq $((1 << 10 | 1 << 13)) ]]
[[ $((16#$bounding_caps)) -eq $((1 << 10 | 1 << 13)) ]]