18 lines
1.1 KiB
Bash
18 lines
1.1 KiB
Bash
#!/bin/bash
|
|
# Internal entry point, mounted inside an already-created bubblewrap user namespace.
|
|
set -euo pipefail
|
|
host=/tmp/fds-build-host
|
|
native() {
|
|
"$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" "$host/usr/bin/$1" "${@:2}"
|
|
}
|
|
native mkdir /tmp/fds-binfmt
|
|
native mount -t binfmt_misc binfmt_misc /tmp/fds-binfmt
|
|
# Match ELF64 little-endian AArch64 EXEC/DYN. This registry belongs only to the
|
|
# new user namespace. F opens the static interpreter while it is mounted here.
|
|
printf '%s\n' ':fds-aarch64:M::\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff:/tmp/fds-build-host/usr/bin/qemu-aarch64:F' >/tmp/fds-binfmt/register
|
|
export PATH=/usr/bin:/bin HOME=/root LANG=C LC_ALL=C XBPS_ARCH=aarch64
|
|
# Package hooks need no mount privilege after the private handler is installed.
|
|
exec "$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" \
|
|
"$host/usr/bin/setpriv" --bounding-set=-sys_admin,-setpcap \
|
|
--inh-caps=-sys_admin,-setpcap --ambient-caps=-sys_admin,-setpcap "$@"
|