Fix aTrust on podman and other potential errors about aTrust

On docker, `/proc/self/loginuid` is -1 by default, while on podman it is
0 (root), which makes aTrust services refuse to start, because after they
use `getlogin_r`, which is affected by `/proc/self/loginuid`, to get the
username successfully, they give up trying any other way (such as
`loginctl`) to get the non-root user used to start the http server (port
54631), even if the username they got is root.

This commit adds a LD_PRELOAD hook named fake-getlogin, which hooks
`getlogin` and `getlogin_r` to provide the non-root username directly.

This commit also:
- reduces errors when running postinst script of aTrust;
- uses LD_LIBRARY_PATH to make aTrust use its versions of libraries,
  especially those very old and no longer getatable from debian
  packages.

Dockerfile

@@ -26,13 +26,15 @@ RUN groupadd -r socks && useradd -r -g socks socks
 
 COPY ["./build-scripts/install-vpn-gui.sh", "./build-scripts/mk-qemu-wrapper.sh", "/tmp/build-scripts/"]
 
+COPY ./docker-root-preinst /
+
 ARG VPN_URL ELECTRON_URL USE_VPN_ELECTRON VPN_DEB_PATH
 
 RUN /tmp/build-scripts/install-vpn-gui.sh
 
 COPY ./docker-root /
 
-COPY --from=hagb/docker-easyconnect:build /results/fake-hwaddr/ /results/tinyproxy-ws/ /results/novnc/ /
+COPY --from=hagb/docker-easyconnect:build /results/fake-hwaddr/ /results/fake-getlogin/ /results/tinyproxy-ws/ /results/novnc/ /
 
 #ENV TYPE="" PASSWORD="" LOOP=""
 #ENV DISPLAY

Dockerfile.build

@@ -14,12 +14,14 @@ RUN . /tmp/build-scripts/config-apt.sh && \
     apt-get install -y --no-install-recommends --no-install-suggests ca-certificates \
                     busybox libssl-dev automake $go $ecgccpkg build-essential
 
-RUN mkdir results && cd results && mkdir fake-hwaddr tinyproxy-ws novnc
+RUN mkdir results && cd results && mkdir fake-hwaddr tinyproxy-ws novnc fake-getlogin && mkdir /tmp/src -p
 
 COPY fake-hwaddr /tmp/src/fake-hwaddr/
+COPY fake-getlogin /tmp/src/fake-getlogin/
 
 RUN . /tmp/build-scripts/get-echost-names.sh && \
-    cd /tmp/src/fake-hwaddr && CC=${ec_cc} make clean all && install -D fake-hwaddr.so /results/fake-hwaddr/usr/local/lib/fake-hwaddr.so
+    cd /tmp/src/fake-hwaddr && CC=${ec_cc} make clean all && install -D fake-hwaddr.so /results/fake-hwaddr/usr/local/lib/fake-hwaddr.so && \
+    cd /tmp/src/fake-getlogin && CC=${ec_cc} make clean all && install -D fake-getlogin.so /results/fake-getlogin/usr/local/lib/fake-getlogin.so
 
 # https://github.com/tinyproxy/tinyproxy/pull/211#issue-382736027
 ARG TINYPROXY_COMMIT=991e47d8ebd4b12710828b2b486535e4c25ba26c

build-scripts/install-vpn-gui.sh

@@ -14,10 +14,18 @@ package_name=$(echo $(grep -Po '(?<=Package:).*' /DEBIAN/control)) &&
 { /DEBIAN/preinst || true ; } &&
 mkdir /var/lib/dpkg/info/$package_name &&
 for file in /DEBIAN/*; do
-	mv $file /var/lib/dpkg/info/$package_name.$(basename $file)
+	cp "$file" /var/lib/dpkg/info/"$package_name.$(basename $file)" &&
+	# workaround for aTrust scripts
+	cp "$file" /var/lib/dpkg/info/"$(basename $file)"
 done &&
 /var/lib/dpkg/info/$package_name.postinst &&
+for file in /DEBIAN/*; do
+	rm /var/lib/dpkg/info/"$(basename $file)"
+done &&
 rm -r /DEBIAN VPN.deb &&
+if [ -e /home/sangfor/ ]; then
+	chown sangfor:sangfor -R /home/sangfor/
+fi &&
 
 ln -fs /bin/false /usr/sbin/dmidecode &&
 

docker-root/usr/local/bin/vpn-config.sh

@@ -71,6 +71,11 @@ case "$_VPN_TYPE" in
 		FORCE_OPEN_PORTS=54631
 		VPN_PROCS=aTrustAgent
 		vpn_daemon() {
+			# aTrust 用 getlogin_r 或者 loginctl 来获取用于运行 54531 http 服务的非 root 用户：
+			# - 先尝试 getlogin_r，若获取到 root 则失败，服务无法启动（这是 podman 上无法启动服务的原因）；
+			# - 若获取不到则，使用 loginctl 等工具（已经过 hook，可以提供普通用户供 aTrust 使用，此为原本 docker 上的行为）。
+			# 此处使用 LD_PRELOAD 来让 getlogin_r 直接返回该普通用户，从而使 podman 也能够正常启动服务。
+			FAKE_LOGIN=sangfor LD_PRELOAD=/usr/local/lib/fake-getlogin.so LD_LIBRARY_PATH="$VPN_ROOT:$VPN_BIN:${LD_LIBRARY_PATH}" \
 				fake-hwaddr-run $VPN_BIN/aTrustAgent --plugin plugin-daemon --plugin-cmd \| >/dev/null &
 		}
 		vpn_ui() {

fake-getlogin/Makefile

@@ -0,0 +1,9 @@
+.PHONY: all clean
+
+all: fake-getlogin.so
+
+fake-getlogin.so: fake-getlogin.c
+	${CC} --shared -o fake-getlogin.so fake-getlogin.c -ldl -fPIC
+
+clean:
+	-rm fake-getlogin.so

fake-getlogin/fake-getlogin.c

@@ -0,0 +1,22 @@
+#define _GNU_SOURCE
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+
+int getlogin_r(char *buf, size_t bufsize) {
+  const char *login = getenv("FAKE_LOGIN");
+  if (!login)
+    return ENXIO;
+  size_t len = strlen(login);
+  if (len + 1 > bufsize)
+    return ERANGE;
+  strcpy(buf, login);
+  return 0;
+}
+
+const char *getlogin() {
+  const char *login = getenv("FAKE_LOGIN");
+  if (!login)
+    return 0;
+  return login;
+}