refact: check config

Author: simonwalz

system/cuos/api.sh

@@ -51,6 +51,11 @@ EOF
   "update")
     report_info "cuos:update:start" "Update process was triggered"
     CONFIG="$(echo "${INPUT}" | jq -c '.config // {}')"
+    if ! echo "${CONFIG}" | check_config; then
+      report_err "cuos:update:err_invalid_config" "Update: Invalid configuration provided."
+      echo "Invalid configuration provided."
+      exit 0
+    fi
 
     # update and swap configuration (config -> new)
     NEW_CONFIG="$(echo "${CONFIG}" | jq -s '.[0] * .[1]' "${CONFIG_PATH}" -)" || exit 0
@@ -81,6 +86,11 @@ EOF
   "patch")
     report_info "cuos:patch" "Patching the system"
     CONFIG="$(echo "${INPUT}" | jq -c '.config // empty')"
+    if ! echo "${CONFIG}" | check_config; then
+      report_err "cuos:update:err_invalid_config" "Update: Invalid configuration provided."
+      echo "Invalid configuration provided."
+      exit 0
+    fi
     # save current config for rollback:
     cat "${CONFIG_PATH}" >"${NEXT_CONFIG_PATH}"
 

system/cuos/app.sh

@@ -131,18 +131,18 @@ if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}\$"; then
     DOCKER_ARGS="$(docker inspect --format '{{ index .Config.Labels "dev.cuos.app_command" }}' "${INITIAL_IMAGE}")"
     if [[ -z "${DOCKER_ARGS}" ]]; then
       DOCKER_ARGS="\
-		--device /dev/tty1 \
+        --device /dev/tty1 \
         --network=host \
-		--volume /var/run/docker.sock:/var/run/docker.sock  \
+        --volume /var/run/docker.sock:/var/run/docker.sock  \
         --volume /root/.docker/config.json:/root/.docker/config.json:ro  \
         --volume /system.json:/system.json:ro  \
         --volume /etc/partition_mode:/etc/partition_mode:ro  \
         --volume /var/run/cuos.sock:/var/run/cuos.sock  \
         --volume /usr/local/share/ca-certificates/custom:/usr/local/share/ca-certificates/custom:ro"
-	fi
+    fi
 
     touch "${HOME}/.docker/config.json"
-	# shellcheck disable=SC2086
+    # shellcheck disable=SC2086
     docker run \
       --detach \
       --pull=never \

system/cuos/dialog-maintenance.sh

@@ -252,6 +252,8 @@ expert() {
   term_all sudo -u nobody rvim /tmp/edit-system.json
   if ! jq . /tmp/edit-system.json >/dev/null 2>&1; then
     term msg "Invalid JSON"
+  elif ! cat /tmp/edit-system.json | check_config; then
+    term msg "Invalid Configuration"
   else
     cat /tmp/edit-system.json >/system.json
     api_stream "Applying system.json" cuos patch

system/cuos/init.sh

@@ -71,7 +71,6 @@ ensure_system_config() {
 }
 
 check_schema_system_json() {
-  # TODO: Check system.json against JSON schema for security
   jv "${SCRIPT_DIR}/system-schema.json" "/system.json"
 }
 
@@ -102,11 +101,15 @@ set_hostname() {
         --arg hn "${SYSTEM_HOSTNAME}" \
         '.hostname = $hn' \
         "${CONFIG_PATH}"
-  fi
-  if [[ -n "${SYSTEM_HOSTNAME}" ]]; then
+  elif [[ -n "${SYSTEM_HOSTNAME}" ]]; then
     echo "Setting hostname to $SYSTEM_HOSTNAME"
     echo "$SYSTEM_HOSTNAME" > "/etc/hostname"
     hostname "$SYSTEM_HOSTNAME"
+  elif [[ -n "${OLD_HOSTNAME}" ]]; then
+      jq_replace \
+        --arg hn "${OLD_HOSTNAME}" \
+        '.hostname = $hn' \
+        "${CONFIG_PATH}"
   fi
   if [[ -n "${REINIT:-}" && "${OLD_HOSTNAME}" != "${SYSTEM_HOSTNAME}" ]]; then
     systemctl restart networking

system/cuos/utils.sh

@@ -117,3 +117,7 @@ state() {
     "${state_file}")" || return "$?"
   echo "${new_state}" >"${state_file}"
 }
+
+check_config() {
+  jv "${SCRIPT_DIR}/system-schema.json" "/dev/stdin"
+}