82 lines
2.9 KiB
Bash
82 lines
2.9 KiB
Bash
#!/bin/bash
|
|
# Electron Linux post-install script
|
|
# Set SUID bit on chrome-sandbox to enable proper sandboxing
|
|
#
|
|
# Security considerations:
|
|
# - Validates file type to prevent symlink attacks
|
|
# - Only sets SUID on valid ELF executables
|
|
# - Provides clear error messages for troubleshooting
|
|
#
|
|
# Note: This script runs as root during package installation
|
|
|
|
set -e
|
|
|
|
# Possible chrome-sandbox locations based on electron-builder defaults
|
|
# deb installs to /opt/{productName}/
|
|
# rpm installs to /opt/{productName}/ or /usr/lib/{packageName}/
|
|
SANDBOX_PATHS=(
|
|
"/opt/QimingClaw/chrome-sandbox"
|
|
"/opt/QimingClaw/resources/chrome-sandbox"
|
|
"/opt/qimingclaw/chrome-sandbox"
|
|
"/opt/qimingclaw/resources/chrome-sandbox"
|
|
"/usr/lib/qimingclaw/chrome-sandbox"
|
|
"/usr/lib64/qimingclaw/chrome-sandbox"
|
|
)
|
|
|
|
SANDBOX_FOUND=false
|
|
# Check if 'file' command is available (most systems have it, but be safe)
|
|
HAS_FILE_CMD=$(command -v file >/dev/null 2>&1 && echo "yes" || echo "no")
|
|
|
|
for SANDBOX_PATH in "${SANDBOX_PATHS[@]}"; do
|
|
if [ -e "$SANDBOX_PATH" ]; then
|
|
# Security: Skip symlinks to prevent symlink attacks
|
|
if [ -L "$SANDBOX_PATH" ]; then
|
|
echo "Warning: $SANDBOX_PATH is a symlink, skipping for security"
|
|
continue
|
|
fi
|
|
|
|
# Security: Verify it's a regular file
|
|
if [ ! -f "$SANDBOX_PATH" ]; then
|
|
echo "Warning: $SANDBOX_PATH is not a regular file, skipping"
|
|
continue
|
|
fi
|
|
|
|
# Security: Verify file type is ELF executable (if 'file' command is available)
|
|
if [ "$HAS_FILE_CMD" = "yes" ]; then
|
|
if ! file "$SANDBOX_PATH" 2>/dev/null | grep -qE "ELF.*(executable|shared object)"; then
|
|
echo "Warning: $SANDBOX_PATH is not a valid ELF binary, skipping"
|
|
continue
|
|
fi
|
|
else
|
|
# Fallback: Check file magic bytes for ELF header (0x7f ELF)
|
|
ELF_HEADER=$(head -c 4 "$SANDBOX_PATH" 2>/dev/null | od -A n -t x1 | tr -d ' ')
|
|
if [ "$ELF_HEADER" != "7f454c46" ]; then
|
|
echo "Warning: $SANDBOX_PATH does not have valid ELF header, skipping"
|
|
continue
|
|
fi
|
|
fi
|
|
|
|
echo "Found chrome-sandbox at $SANDBOX_PATH"
|
|
|
|
# Set ownership and SUID bit
|
|
if chown root:root "$SANDBOX_PATH" 2>/dev/null; then
|
|
if chmod 4755 "$SANDBOX_PATH" 2>/dev/null; then
|
|
echo "SUID sandbox enabled successfully."
|
|
SANDBOX_FOUND=true
|
|
break
|
|
else
|
|
echo "Warning: Failed to set permissions on $SANDBOX_PATH"
|
|
fi
|
|
else
|
|
echo "Warning: Failed to change ownership of $SANDBOX_PATH"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if [ "$SANDBOX_FOUND" = false ]; then
|
|
echo "Warning: chrome-sandbox not found or validation failed."
|
|
echo "The application may need to run with ELECTRON_DISABLE_SANDBOX=1"
|
|
fi
|
|
|
|
exit 0
|