scripts/hosts/guard/pacman-hooks/hosts-guard-common.sh

#!/usr/bin/env bash
# Shared functions for hosts-guard pacman hooks
# This file is sourced by pacman-pre-unlock-hosts.sh and pacman-post-relock-hosts.sh

TARGET=/etc/hosts
LOGTAG=hosts-guard-hook

# Check if target has a read-only mount
is_ro_mount() {
	findmnt -no OPTIONS -T "$TARGET" 2>/dev/null | grep -qw ro
}

# Count mount layers for the target
mount_layers_count() {
	awk '$5=="/etc/hosts"{c++} END{print c+0}' /proc/self/mountinfo 2>/dev/null || echo 0
}

# Collapse all bind mount layers
collapse_mounts() {
	local i=0
	if command -v mountpoint >/dev/null 2>&1; then
		while mountpoint -q "$TARGET"; do
			umount -l "$TARGET" >/dev/null 2>&1 || break
			i=$((i + 1))
			((i > 20)) && break
		done
	else
		local cnt
		cnt=$(mount_layers_count)
		while ((cnt > 1)); do
			umount -l "$TARGET" >/dev/null 2>&1 || break
			i=$((i + 1))
			((i > 20)) && break
			cnt=$(mount_layers_count)
		done
	fi
}

# Stop systemd units related to hosts guard
stop_units_if_present() {
	local units=(hosts-bind-mount.service hosts-guard.path)
	for u in "${units[@]}"; do
		if command -v systemctl >/dev/null 2>&1; then
			if systemctl list-unit-files 2>/dev/null | grep -q "^$u"; then
				systemctl stop "$u" >/dev/null 2>&1 || true
			fi
		fi
	done
}

# Remove immutable/append-only attributes
remove_host_attrs() {
	if command -v lsattr >/dev/null 2>&1; then
		local attrs
		attrs=$(lsattr -d "$TARGET" 2>/dev/null || true)
		if echo "$attrs" | grep -q " i "; then
			chattr -i "$TARGET" >/dev/null 2>&1 || true
		fi
		if echo "$attrs" | grep -q " a "; then
			chattr -a "$TARGET" >/dev/null 2>&1 || true
		fi
	fi
}

# Apply immutable attribute
apply_immutable() {
	if command -v chattr >/dev/null 2>&1; then
		chattr +i "$TARGET" >/dev/null 2>&1 || true
	fi
}

# Apply a single read-only bind mount layer
apply_ro_bind_mount() {
	mount --bind "$TARGET" "$TARGET" >/dev/null 2>&1 || true
	mount -o remount,ro,bind "$TARGET" >/dev/null 2>&1 || true
}

# Start the path watcher service
start_path_watcher() {
	if command -v systemctl >/dev/null 2>&1; then
		systemctl start hosts-guard.path >/dev/null 2>&1 || true
	fi
}

# Log to system logger and run log file
log_hook() {
	local phase="$1"
	local state="$2"
	logger -t "$LOGTAG" "$phase: $state"
	echo "$(date -Is) $phase-$state" >>/run/hosts-guard-hook.log 2>/dev/null || true
}