FDS/OS 1.0

tools/rootfs-namespace

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Internal entry point, mounted inside an already-created bubblewrap user namespace.
+set -euo pipefail
+host=/tmp/fds-build-host
+native() {
+    "$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" "$host/usr/bin/$1" "${@:2}"
+}
+native mkdir /tmp/fds-binfmt
+native mount -t binfmt_misc binfmt_misc /tmp/fds-binfmt
+# Match ELF64 little-endian AArch64 EXEC/DYN. This registry belongs only to the
+# new user namespace. F opens the static interpreter while it is mounted here.
+printf '%s\n' ':fds-aarch64:M::\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff:/tmp/fds-build-host/usr/bin/qemu-aarch64:F' >/tmp/fds-binfmt/register
+export PATH=/usr/bin:/bin HOME=/root LANG=C LC_ALL=C XBPS_ARCH=aarch64
+# Package hooks need no mount privilege after the private handler is installed.
+exec "$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" \
+    "$host/usr/bin/setpriv" --bounding-set=-sys_admin,-setpcap \
+    --inh-caps=-sys_admin,-setpcap --ambient-caps=-sys_admin,-setpcap "$@"