32 lines
1.6 KiB
Bash
Executable File
32 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Execute ARM userspace with no host binfmt registration or physical USB access.
|
|
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
|
|
(( $# >= 2 )) || die 'Usage: tools/in-rootfs ROOT [--direct] COMMAND [ARGUMENT...]'
|
|
root=$(realpath -e -- "$1")
|
|
shift
|
|
[[ -x $root/usr/bin/bash ]] || die 'Not an assembled FDS rootfs'
|
|
check_void_pin
|
|
"$FDS_ROOT/tools/verify-elf" "$FDS_VOID/masterdir-x86_64/usr/bin/qemu-aarch64" x86_64 static >/dev/null
|
|
# The target is the actual kernel-visible root. Linux 6.7+ gives this new user
|
|
# namespace its own binfmt registry; host registration is never changed.
|
|
# The native loader and tools are read-only temporary mounts, absent from tar.
|
|
host=/tmp/fds-build-host
|
|
runner=("$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib"
|
|
"$host/usr/bin/bash" /tmp/fds-rootfs-namespace)
|
|
capabilities=(--cap-add CAP_SYS_ADMIN --cap-add CAP_SETPCAP)
|
|
# A single ELF needs no child-exec handler.
|
|
if [[ ${1:-} == --direct ]]; then
|
|
shift
|
|
(( $# > 0 )) || die 'Missing command after --direct'
|
|
runner=("$host/usr/bin/qemu-aarch64")
|
|
capabilities=()
|
|
fi
|
|
exec bwrap --unshare-user --uid 0 --gid 0 --cap-add CAP_SETFCAP "${capabilities[@]}" --unshare-pid \
|
|
--bind "$root" / --dev /dev --proc /proc --tmpfs /tmp --tmpfs /run \
|
|
--ro-bind "$FDS_VOID/masterdir-x86_64" "$host" \
|
|
--ro-bind "$FDS_ROOT/tools/finalize-rootfs" /tmp/fds-finalize \
|
|
--ro-bind "$FDS_ROOT/tools/rootfs-namespace" /tmp/fds-rootfs-namespace \
|
|
--chdir / --clearenv --setenv PATH /usr/bin:/bin \
|
|
--setenv HOME /root \
|
|
--setenv XBPS_ARCH aarch64 --setenv LC_ALL C "${runner[@]}" "$@"
|