55 lines
2.4 KiB
Bash
55 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Build + install the AVNI control-center, and set up access delegation.
|
|
# - binary -> /usr/local/bin/avni (real file, so granted non-root users can exec it)
|
|
# - firewall helper -> /usr/local/bin/avni-firewall.sh (used by the blacklist/whitelist engine)
|
|
# - 'avni' Unix group = who may use the tool (root always can)
|
|
# - sudoers drop-in lets 'avni' members auto-elevate (the binary re-execs via sudo)
|
|
#
|
|
# Run from anywhere — the script locates its own directory, so the repo can be cloned
|
|
# to any path. Re-run after every code change to redeploy. Usage: sudo bash install.sh
|
|
set -euo pipefail
|
|
|
|
SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
BIN=/usr/local/bin/avni
|
|
FWBIN=/usr/local/bin/avni-firewall.sh
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then echo "!! run as root: sudo bash install.sh"; exit 1; fi
|
|
|
|
# locate cargo (rustup install lives under the invoking user's home even under sudo)
|
|
CARGO="$(command -v cargo || true)"
|
|
[ -z "$CARGO" ] && [ -x "$HOME/.cargo/bin/cargo" ] && CARGO="$HOME/.cargo/bin/cargo"
|
|
[ -z "$CARGO" ] && [ -n "${SUDO_USER:-}" ] && [ -x "/home/$SUDO_USER/.cargo/bin/cargo" ] && CARGO="/home/$SUDO_USER/.cargo/bin/cargo"
|
|
if [ -z "$CARGO" ]; then echo "!! cargo not found — install Rust via https://rustup.rs"; exit 1; fi
|
|
|
|
echo "==> building (release)"
|
|
( cd "$SRC" && "$CARGO" build --release >/dev/null )
|
|
|
|
echo "==> 'avni' access group"
|
|
groupadd -f avni
|
|
|
|
echo "==> sudoers drop-in (auto-elevation for granted users)"
|
|
cat > /etc/sudoers.d/avni <<'EOF'
|
|
# AVNI control-center — members of the 'avni' group may run the tool as root.
|
|
# They are already admins (sudo); granting 'avni' just makes `avni` launch seamlessly.
|
|
%avni ALL=(root) NOPASSWD: /usr/local/bin/avni
|
|
EOF
|
|
chmod 440 /etc/sudoers.d/avni
|
|
if ! visudo -cf /etc/sudoers.d/avni >/dev/null; then
|
|
echo "!! sudoers validation failed — removing drop-in"; rm -f /etc/sudoers.d/avni; exit 1
|
|
fi
|
|
|
|
echo "==> installing firewall helper -> $FWBIN"
|
|
install -o root -g root -m 0755 "$SRC/avni-firewall.sh" "$FWBIN"
|
|
|
|
echo "==> installing binary -> $BIN"
|
|
rm -f "$BIN"
|
|
install -o root -g root -m 0755 "$SRC/target/release/avni" "$BIN"
|
|
|
|
# optional: pure-Python fallback
|
|
if [ -f "$SRC/avni.py" ]; then
|
|
install -o root -g root -m 0755 "$SRC/avni.py" /usr/local/bin/avni-py
|
|
fi
|
|
|
|
echo "OK. root + 'avni' group members can run: avni"
|
|
echo "Current avni-group members: $(getent group avni | cut -d: -f4)"
|