@wlfi-agent/cli 1.4.13 → 1.4.15

package/scripts/launchd/run-wlfi-agent-daemon.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+require_var() {
+  local name="$1"
+  if [[ -z "${!name:-}" ]]; then
+    echo "missing required environment variable: $name" >&2
+    exit 1
+  fi
+}
+
+require_var "WLFI_DAEMON_BIN"
+require_var "WLFI_STATE_FILE"
+require_var "WLFI_DAEMON_SOCKET"
+require_var "WLFI_KEYCHAIN_SERVICE"
+require_var "WLFI_KEYCHAIN_ACCOUNT"
+require_var "WLFI_KEYCHAIN_HELPER"
+
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "run-wlfi-agent-daemon.sh must run as root" >&2
+  exit 1
+fi
+
+if [[ ! -x "$WLFI_DAEMON_BIN" ]]; then
+  echo "daemon binary is not executable: $WLFI_DAEMON_BIN" >&2
+  exit 1
+fi
+if [[ ! -x "$WLFI_KEYCHAIN_HELPER" ]]; then
+  echo "keychain helper is not executable: $WLFI_KEYCHAIN_HELPER" >&2
+  exit 1
+fi
+
+umask 077
+mkdir -p "$(dirname "$WLFI_STATE_FILE")"
+mkdir -p "$(dirname "$WLFI_DAEMON_SOCKET")"
+chmod 700 "$(dirname "$WLFI_STATE_FILE")"
+chmod 755 "$(dirname "$WLFI_DAEMON_SOCKET")"
+chown root:wheel "$(dirname "$WLFI_STATE_FILE")" "$(dirname "$WLFI_DAEMON_SOCKET")"
+
+if ! vault_password="$("$WLFI_KEYCHAIN_HELPER" read-generic-password --keychain /Library/Keychains/System.keychain --service "$WLFI_KEYCHAIN_SERVICE" --account "$WLFI_KEYCHAIN_ACCOUNT" 2>/dev/null)"; then
+  cat >&2 <<EOF2
+failed to read daemon password from System.keychain.
+expected generic password item:
+  service: $WLFI_KEYCHAIN_SERVICE
+  account: $WLFI_KEYCHAIN_ACCOUNT
+  helper: $WLFI_KEYCHAIN_HELPER
+EOF2
+  exit 1
+fi
+
+trap 'unset vault_password' EXIT
+
+admin_uid="${WLFI_ALLOW_ADMIN_EUID:?missing WLFI_ALLOW_ADMIN_EUID}"
+agent_uid="${WLFI_ALLOW_AGENT_EUID:?missing WLFI_ALLOW_AGENT_EUID}"
+signer_backend="${WLFI_SIGNER_BACKEND:-software}"
+
+args=(
+  --non-interactive
+  --vault-password-stdin
+  --state-file "$WLFI_STATE_FILE"
+  --daemon-socket "$WLFI_DAEMON_SOCKET"
+  --signer-backend "$signer_backend"
+  --allow-admin-euid "$admin_uid"
+  --allow-agent-euid "$agent_uid"
+)
+if [[ -n "${WLFI_SECURE_ENCLAVE_LABEL_PREFIX:-}" ]]; then
+  args+=(--secure-enclave-label-prefix "$WLFI_SECURE_ENCLAVE_LABEL_PREFIX")
+fi
+if [[ -n "${WLFI_ALLOW_CLIENT_EUID:-}" ]]; then
+  args+=(--allow-client-euid "$WLFI_ALLOW_CLIENT_EUID")
+fi
+
+exec "$WLFI_DAEMON_BIN" "${args[@]}" <<<"$vault_password"

package/scripts/launchd/uninstall-user-daemon.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Uninstall WLFI Agent root LaunchDaemon.
+
+Usage:
+  uninstall-user-daemon.sh [options]
+
+Options:
+  --label <label>                LaunchDaemon label (default: com.wlfi.agent.daemon)
+  --keychain-service <name>      Keychain service (default: wlfi-agent-daemon-password)
+  --keychain-account <name>      Keychain account (default: current username)
+  --delete-keychain-password     Remove stored Keychain password item
+  --help                         Show this help
+EOF
+}
+
+require_non_empty_value() {
+  local flag="$1"
+  local value="${2:-}"
+  if [[ -z "$value" ]]; then
+    echo "missing value for $flag" >&2
+    exit 1
+  fi
+}
+
+validate_label() {
+  local value="$1"
+  if [[ ! "$value" =~ ^[A-Za-z0-9._-]+$ ]]; then
+    echo "invalid --label '$value': allowed characters are [A-Za-z0-9._-]" >&2
+    exit 1
+  fi
+}
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "uninstall-user-daemon.sh must be run as root" >&2
+  exit 1
+fi
+
+label="com.wlfi.agent.daemon"
+keychain_service="wlfi-agent-daemon-password"
+keychain_account="$(id -un)"
+delete_keychain_password=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --label)
+      require_non_empty_value "$1" "${2:-}"
+      label="$2"
+      shift 2
+      ;;
+    --keychain-service)
+      require_non_empty_value "$1" "${2:-}"
+      keychain_service="$2"
+      shift 2
+      ;;
+    --keychain-account)
+      require_non_empty_value "$1" "${2:-}"
+      keychain_account="$2"
+      shift 2
+      ;;
+    --delete-keychain-password)
+      delete_keychain_password=true
+      shift
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+validate_label "$label"
+
+plist_path="/Library/LaunchDaemons/${label}.plist"
+
+launchctl bootout "system/${label}" >/dev/null 2>&1 || true
+launchctl disable "system/${label}" >/dev/null 2>&1 || true
+
+if [[ -f "$plist_path" ]]; then
+  rm -f "$plist_path"
+fi
+
+if [[ "$delete_keychain_password" == true ]]; then
+  security delete-generic-password \
+    -s "$keychain_service" \
+    -a "$keychain_account" \
+    /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+fi
+
+cat <<EOF
+uninstalled launch daemon:
+  label: ${label}
+  plist removed: ${plist_path}
+  keychain password removed: ${delete_keychain_password}
+EOF