OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	04/29/2025 04:07:53 PM	rwxr-xr-x
📄 handle-writable-paths	5.57 KB	04/29/2025 04:04:25 PM	rwxr-xr-x
📄 rtc-sys-time-init	3.83 KB	04/29/2025 04:04:25 PM	rwxr-xr-x
📄 run-snapd-from-snap	2.77 KB	04/29/2025 04:04:25 PM	rwxr-xr-x

Editing: run-snapd-from-snap

#!/bin/bash
#
# This script will try to find a suiteable snapd snap and start
# snapd and its associated services from it.

set -eux

# run_on_unseeded will run snapd on an unseeded system. The snapd snap
# is expected to have been mounted and current link is expected to
# have been created by the initramfs.
run_on_unseeded() {
    SNAPD_BASE_DIR="/snap/snapd/current"
    if ! mountpoint -q "$SNAPD_BASE_DIR"; then
        # Compatibility with old way where we had a duplicated mount in /run
        # and "current" link was not created by initramfs.
        SNAPD_BASE_DIR="/run/mnt/snapd"
        # We need to initialize /snap/snapd/current symlink so that the
        # dynamic linker
        # /snap/snapd/current/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
        # is available to run snapd.
        mkdir -p /snap/snapd
        ln -sf "${SNAPD_BASE_DIR}" /snap/snapd/current
    fi

# snapd will write all its needed snapd.{service,socket}
    # units and restart once it seeded the snapd snap. We create
    # a systemd socket unit so that systemd owns the socket, otherwise
    # the socket file would be removed by snapd on exit and the snapd.seeded
    # service will fail because it has nothing to talk to anymore.
    socket_args=()
    while IFS= read -r socket; do
        socket_args+=(--socket-property)
        socket_args+=("$socket")
    done < <(grep -E '^ListenStream=.+' /snap/snapd/current/lib/systemd/system/snapd.socket)
    systemd-run --unit=snapd-seeding --service-type=notify \
                "${socket_args[@]}" \
                --property KeyringMode=inherit "$SNAPD_BASE_DIR"/usr/lib/snapd/snapd
    # we need to start the snapd service from above explicitly, systemd-run
    # only enables the socket but does not start the service.
    systemctl start --wait snapd-seeding.service
    # at this point the snapd.socket is available
    systemctl stop snapd-seeding.socket

# At this point snap is available and seeding is at the point where
    # were snapd is installed and restarted successfully. Show progress
    # now. Even without showing progress we *must* wait here until
    # seeding is done to ensure that console-conf is only started
    # after this script has finished.
    # (redirect stdin because that is what snap checks for pty)
    /usr/bin/snap watch --last=seed < /dev/console | tee -a /dev/console
}

# Unseeded systems need to be seeded first, this will start snapd
# and snapd will restart itself after the seeding.
# systemctl status returns exit code 4 for missing services, and 3 for
# non-running services
snapdExists=0
systemctl status snapd.service || snapdExists=$?
if [ ! -e /var/lib/snapd/state.json ] || [ $snapdExists -eq 4 ] ; then
    if ! run_on_unseeded; then
        echo "cannot run snapd from the seed"
        exit 1
    fi
    exit 0
fi