#!/bin/bash

#

# sbox

# Sandbox instance management.

#

# Copyright: 2019 Shawwwn, shawwwn1@gmail.com

# License: MIT

#

# Usage: sbox-mgt ACTION [ARGS...] [OPTION]

#

function help {

local executable=$(basename $0)

echo "usage: $executable stop [-n NAME|-c|-m|-v]"

echo " $executable join [-n NAME|-v]"

echo " $executable list [-n NAME|-a|-v]"

echo " $executable [-h|--help]"

echo "Sandbox instance management."

echo ""

echo " stop:"

echo " Kill the sandbox'ed process."

echo " Specify whether to commit/merge changes with flags -c/-m."

echo ""

echo " join:"

echo " Send process into a running container."

echo ""

echo " list:"

echo " List *running* containers. Use with -v for more details."

echo ""

echo " remove:"

echo " Remove an inactive container."

echo ""

echo " -n, --container-name Name of the target sandbox."

echo " -c, --auto-commit Auto commit file system changes"

echo " to snapshot when exit"

echo " -m, --auto-merge Auto merge snapshot to rootfs"

echo " when exit."

echo " -a, --list-all List all containers, including"

echo " ones that are not running."

echo " -v, --verbose Print more infomation."

echo " -h, --help Display this help and exit."

}

# process command line arguments

VERBOSE=false

AUTO_COMMIT=false

AUTO_MERGE=false

LIST_ALL=false

CONTAINER_NAME="default"

NAME_SET=false

ARGS=$(getopt -q \

-o "n:cmavh" \

-l "container-name:,auto-commit,auto-merge,list-all,verbose,help" \

-n "sbox-mgt" -- "$@")

if [ $? -ne 0 ]; then

echo "Invalid Arguments!"

exit 2

fi

eval set -- "$ARGS"

while true; do

case "$1" in

-n|--container-name)

CONTAINER_NAME="$2"

NAME_SET=true

shift 2 ;;

-c|--auto-commit)

AUTO_COMMIT=true

shift ;;

-m|--auto-merge)

AUTO_MERGE=true

shift ;;

-a|--list-all)

LIST_ALL=true

shift ;;

-v|--verbose)

VERBOSE=true

shift ;;

-h|--help)

help

shift

exit ;;

--)

shift

break ;;

esac

done

# globals

CMD=$(echo "$1" | awk '{print tolower($0)}')

shift

#############################################################

# Get the nth parent pid, start from given pid

#############################################################

get_nth_ppid() {

local pid=$1

local n=$2

local ppid=$(ps --no-headers -o ppid "$pid" | xargs) # trim result from 'ps'

[ -z n ] && n=1

[ $n -eq 0 ] && echo "$pid" && return

if (( $n > 1 )); then

get_nth_ppid "$ppid" $((n-1))

else

echo "$ppid"

fi

}

#############################################################

# Set pid's environment variable

#############################################################

set_pid_env() {

local pid=$1

local var=$2

local val="$3"

if [ -z "$3" ]; then

# unset $var

gdb -n -q -p $pid <<<"""

call (int) unsetenv(\"$var\")

set confirm off

quit

""" >/dev/null

else

# set $var

gdb -n -q -p $pid <<<"""

call (int) setenv(\"$var\", \"$val\")

set confirm off

quit

""" >/dev/null

fi

}

#############################################################

# Trying to terminate a process nicely

#############################################################

kill_proc_nice() {

local pid=$1

if ! ps -p $pid >/dev/null; then return 0; fi

local killed=false

local i=0

kill -SIGINT $pid

for ((i=0; i<20; i++)); do # 2s timeout

if ! ps -p $pid >/dev/null; then

killed=true

break

fi

sleep 0.1

done

if $killed; then return 0; fi

kill -SIGTERM $pid

for ((i=0; i<30; i++)); do # 3s timeout

if ! ps -p $pid >/dev/null; then

killed=true

break

fi

sleep 0.1

done

if $killed; then return 0; fi

kill -SIGKILL $pid

}

#############################################################

# Trying to terminate a process tree nicely

#############################################################

kill_tree_nice() {

local pid=$1

for child in $(ps -o "pid" --no-headers --ppid $pid); do

kill_tree_nice $child

done

kill_proc_nice $pid

}

#############################################################

# Return container pid if running

#############################################################

get_container_pid() {

local name="$1"

local pid=$(cat "/tmp/sbox/$name/container.pid" 2>/dev/null)

if [ ! -z "$pid" ] && (ps -p "$pid" >/dev/null 2>&1); then

echo "$pid"

return 0

fi

return 1;

}

#############################################################

# Print error message & exit

#############################################################

error_exit() {

echo -e "$1" >&2

exit 1

}

#############################################################

# Return a list of containers under base directory

#############################################################

container_list() {

local base_dir=$(realpath "$1") # /tmp/sbox

pushd "$base_dir" >/dev/null

local name

find * -maxdepth 0 -type d | \

while IFS= read -r name; do

if [ -f "$base_dir/$name/config" ]; then

echo "$name"

fi

done

popd >/dev/null

}

#############################################################

# Return a list of containers under base directory

#############################################################

show_container_info() {

local name="$1"

if get_container_pid "$CONTAINER_NAME" >/dev/null; then

printf "\e[32m$1\e[0m" # active container, print in green

$VERBOSE && echo ": running" || echo ""

else

printf "\e[31m$1\e[0m" # inactive container, print in red

$VERBOSE && echo ": inactive" || echo ""

fi

# source configuration file in a subshell

$VERBOSE && (

source "/tmp/sbox/$CONTAINER_NAME/config";

echo -e "\e[33mlocation\e[0m=$SBOX_LOC";

echo -e "\e[33msnapshot_dir\e[0m=$SBOX_SNAPSHOT_DIR";

echo -e "\e[33mdirty_dir\e[0m=$SBOX_DIRTY_DIR";

echo -e "\e[33mwork_dir\e[0m=$SBOX_WORK_DIR";

echo -e "\e[33mrootfs\e[0m=$SBOX_ROOTFS_DIR";

echo -e "\e[33mmapped_user\e[0m=$SBOX_USER";

echo -e "\e[33mexec\e[0m=$SBOX_EXEC";

echo -e "\e[33mppid\e[0m=$SBOX_PID";

echo -e "\e[33mpid\e[0m=$SBOX_PPID";

echo "";

)

}

#############################################################

# Prompt user to enter Y/N

#############################################################

prompt_yes_no() {

local prompt="$1"

local default="$2" # true|false

[ -z "$default" ] && default=false # default is 'no'

local yn

while true; do

read -p "$prompt" -e yn

case $yn in

[Yy]* ) return 0 ;;

[Nn]* ) return 1 ;;

"" ) if $default; then return 0; else return 1; fi ;;

* ) return 2 ;;

esac

done

return 3

}

#############################################################

# Remove a sandbox's internal directory

#############################################################

remove_dir() {

local tgt_dir="$1" # dir to delete

local root_dir="$2" # sandbox's root dir

local default="$3" # true|false

[ -z "$default" ] && default=false # default is 'no'

# manual remove if internal dir is not under sbox's root dir

if [ -d "$tgt_dir" ] && ! (echo "$tgt_dir" | grep -q "$root_dir"); then

if prompt_yes_no "> delete '$tgt_dir'? [Y/n] " $default; then

$VERBOSE && echo "Removing $tgt_dir";

rm -r "$tgt_dir";

else

$VERBOSE && echo "skip";

fi

fi

}

# main()

spid=$(get_container_pid "$CONTAINER_NAME") # pid of sandbox'ed program

$NAME_SET && $VERBOSE && echo "container name: $CONTAINER_NAME"

if [ "$CMD" = "stop" ]; then

$VERBOSE && echo "container pid: $spid"

[ -z $spid ] && error_exit "Container \"$CONTAINER_NAME\" is not running."

cpid=$(get_nth_ppid $spid 3) # container pid

# set target process' environment variable

set_pid_env $cpid AUTO_COMMIT "$AUTO_COMMIT"

set_pid_env $cpid AUTO_MERGE "$AUTO_MERGE"

# kill target process

kill_tree_nice $spid

elif [ "$CMD" = "join" ]; then

$VERBOSE && echo "container pid: $spid"

[ -z $spid ] && error_exit "Container \"$CONTAINER_NAME\" is not running."

[ -z $1 ] && error_exit "Nothing to run."

# launch process inside namespace

local killed=false

echo "Joining container \"$CONTAINER_NAME\":"

nsenter -a -t $spid --no-fork \

bash -c """$(cat <<-EOF

ppid=\$(cat /proc/self/status | grep ^PPid: | awk '{print \$2}')

cd "/tmp/sbox/$CONTAINER_NAME"

exec chroot rootfs \

sudo -u $USER \

bash -c 'cd ~; exec $@'

EOF

)"""

[ $? == 137 ] && killed=true

# fix shell's strange behavior after sandbox's main process was killed(-9)

# thus bringing down joint process

if $killed; then

echo "sandbox is being torn down, exiting ..."

stty sane

# $killed && kill -9 $$

fi

elif [ "$CMD" = "list" ]; then

if $NAME_SET; then

show_container_info "$CONTAINER_NAME"

else

container_list "/tmp/sbox" | while IFS= read -r CONTAINER_NAME; do

# filter inactive containers if list-all flag is not present

if ! ($LIST_ALL || get_container_pid "$CONTAINER_NAME" >/dev/null); then

continue

fi

show_container_info "$CONTAINER_NAME"

done

fi

elif [ "$CMD" = "remove" ]; then

[ ! -z $spid ] && error_exit "Container \"$CONTAINER_NAME\" is running.\n\nRun 'sbox-mgt stop -n $CONTAINER_NAME' first."

[ ! -f "/tmp/sbox/$CONTAINER_NAME/config" ] && error_exit "Container \"$CONTAINER_NAME\" has already been deleted."

(

source "/tmp/sbox/$CONTAINER_NAME/config";

remove_dir "$SBOX_SNAPSHOT_DIR" "$SBOX_LOC" false

remove_dir "$SBOX_DIRTY_DIR" "$SBOX_LOC" true

remove_dir "$SBOX_WORK_DIR" "$SBOX_LOC" true

$VERBOSE && echo "Removing $SBOX_LOC";

rm -r "$SBOX_LOC";

)

else

help

fi