sysknife-daemon 0.17.0

Policy-enforced, audit-logged Linux action daemon for SysKnife
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

use super::{ActionMechanism, ActionSpec};
use sysknife_types::RiskLevel;

pub fn specs() -> Vec<ActionSpec> {
    vec![
        list_containers("testuser"),
        create_container(
            "testuser",
            "sysknife-dev",
            "registry.fedoraproject.org/fedora-toolbox:41",
        ),
        start_container("testuser", "sysknife-dev"),
        stop_container("testuser", "sysknife-dev"),
        remove_container("testuser", "sysknife-dev"),
        get_container_info("testuser", "sysknife-dev"),
    ]
}

/// Run fixed Podman argv after dropping to the target user.
///
/// Rootless Podman operates against the user's container storage, not a shared
/// system store. The daemon runs as the `sysknife` system user whose container
/// namespace is empty; we must switch to `username` to reach their containers.
/// The helper sets HOME and XDG_RUNTIME_DIR for the resolved UID, resets
/// supplementary groups, and drops GID/UID before invoking the fixed tool.
/// Rootless Podman still requires the account's configured sub-UID/GID ranges
/// and runtime directory. No login shell or user startup file runs as root.
fn podman_as(username: &str, parameters: &[&str]) -> ActionMechanism {
    let mut args = vec![
        "/usr/lib/sysknife/action-steps".to_string(),
        "podman".to_string(),
        username.to_string(),
    ];
    args.extend(parameters.iter().map(|value| value.to_string()));
    ActionMechanism::Command {
        program: "sudo",
        args,
    }
}

pub fn list_containers(username: &str) -> ActionSpec {
    ActionSpec {
        action_name: "ListContainers",
        mechanism: podman_as(username, &["ps", "--all", "--format", "json"]),
        risk_level: RiskLevel::Low,
        reboot_required: false,
        rollback_available: false,
    }
}

pub fn create_container(username: &str, name: &str, image: &str) -> ActionSpec {
    ActionSpec {
        action_name: "CreateContainer",
        mechanism: podman_as(username, &["create", "--name", name, image]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

pub fn start_container(username: &str, name: &str) -> ActionSpec {
    ActionSpec {
        action_name: "StartContainer",
        mechanism: podman_as(username, &["start", name]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

pub fn stop_container(username: &str, name: &str) -> ActionSpec {
    ActionSpec {
        action_name: "StopContainer",
        mechanism: podman_as(username, &["stop", name]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

pub fn remove_container(username: &str, name: &str) -> ActionSpec {
    ActionSpec {
        action_name: "RemoveContainer",
        mechanism: podman_as(username, &["rm", name]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

pub fn get_container_info(username: &str, name: &str) -> ActionSpec {
    ActionSpec {
        action_name: "GetContainerInfo",
        mechanism: podman_as(username, &["inspect", name]),
        risk_level: RiskLevel::Low,
        reboot_required: false,
        rollback_available: false,
    }
}