1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
package main
import (
"fmt"
"os"
"os/signal"
"strings"
"syscall"
"time"
"unsafe"
)
const (
kvmGetAPIVersion = 0xAE00
kvmCreateVM = 0xAE01
tunSetIff = 0x400454ca
tunSetPersist = 0x400454cb
iffTap = 0x0002
iffNoPi = 0x1000
)
func line(k, v string) { fmt.Printf("%s=%s\n", k, strings.TrimSpace(v)) }
func file(k, p string) {
b, err := os.ReadFile(p)
if err != nil {
line(k, "ERR "+err.Error())
return
}
line(k, strings.Join(strings.Fields(string(b)), " "))
}
func status() {
b, _ := os.ReadFile("/proc/self/status")
for _, l := range strings.Split(string(b), "\n") {
for _, p := range []string{"Uid:", "Gid:", "Groups:", "CapEff:"} {
if strings.HasPrefix(l, p) {
line(strings.ToLower(strings.TrimSuffix(p, ":")), strings.Join(strings.Fields(l[len(p):]), " "))
}
}
}
}
func kvm() {
fd, err := syscall.Open("/dev/kvm", syscall.O_RDWR|syscall.O_CLOEXEC, 0)
if err != nil {
line("kvm_open", "ERR "+err.Error())
return
}
v, _, e := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), kvmGetAPIVersion, 0)
line("kvm_open", fmt.Sprintf("OK api=%d err=%v", v, e))
vm, _, e := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), kvmCreateVM, 0)
if e != 0 {
line("kvm_create_vm", "ERR "+e.Error())
return
}
line("kvm_create_vm", fmt.Sprintf("OK fd=%d", vm))
}
func tap(name string) {
fd, err := syscall.Open("/dev/net/tun", syscall.O_RDWR|syscall.O_CLOEXEC, 0)
if err != nil {
line("tap", "ERR open "+err.Error())
return
}
var req [40]byte
copy(req[:16], name)
*(*uint16)(unsafe.Pointer(&req[16])) = iffTap | iffNoPi
if _, _, e := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), tunSetIff, uintptr(unsafe.Pointer(&req[0]))); e != 0 {
line("tap", "ERR TUNSETIFF "+e.Error())
return
}
if _, _, e := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), tunSetPersist, 1); e != 0 {
line("tap", "ERR TUNSETPERSIST "+e.Error())
return
}
line("tap", "OK "+name+" persistent")
}
func probe(paths []string) {
for _, p := range paths {
f, err := os.Open(p)
if err != nil {
line("probe "+p, "DENIED "+err.Error())
continue
}
f.Close()
line("probe "+p, "READABLE")
}
}
func main() {
signal.Ignore(syscall.SIGTERM)
if out, err := os.OpenFile(os.Args[1], os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644); err == nil {
os.Stdout = out
}
line("pid", fmt.Sprint(os.Getpid()))
line("ppid", fmt.Sprint(os.Getppid()))
status()
file("uid_map", "/proc/self/uid_map")
file("gid_map", "/proc/self/gid_map")
file("setgroups", "/proc/self/setgroups")
file("selinux", "/proc/self/attr/current")
tap("fctap0")
kvm()
probe(os.Args[2:])
line("ready", time.Now().UTC().Format(time.RFC3339Nano))
for {
time.Sleep(time.Hour)
}
}
