intel / ccc-linux-guest-hardening

Linux Security Hardening for Confidential Compute
https://intel.github.io/ccc-linux-guest-hardening-docs
MIT License
65 stars 13 forks source link

Makefile: add make env rule #18

Closed il-steffen closed 2 years ago

il-steffen commented 2 years ago

Not actually sourcing in the sub-shell here. But seems to work fine, more readable and allows to customize the prompt..

Wenzel commented 2 years ago

Thanks for the PR. This will invoke a new bash shell with the correct env.

However, the deactivate virtualenv command is not available for some reason.

I've just reworked my solution based on bash's process substitution:

# --init-file executes commands from a custom file instead of ~/.bashrc
# we want to keep the user's bashrc customization, so include it at the beginning
env: SHELL:=bash
env: .env
    $(SHELL) --init-file <(echo 'source ~/.bashrc && source .env && source $$KAFL_ROOT/.venv/bin/activate')

⬆️ This solution fully relies on the virtualenv to customize the PS1 prompt and the deactivate command is available, which is fits more users expectations.

il-steffen commented 2 years ago

$(SHELL) --init-file <(echo 'source ~/.bashrc && source .env && source $$KAFL_ROOT/.venv/bin/activate')

Saw this as well but didn't like overriding the init/rc files semantics. If you look at bash invocation, this will normally also source the global bashrc first, unless you are running this in non-interactive mode. Also the deactivate command assumes that you only sourced the environment. It deactivates the venv in your case, but you actually stay in the sub-shell and still have to do ctrl-D or exit like in my version.

We could silence the make command and just print "Entering venv, type Ctrl-D to exit."

Another option may be to turn .env into a visible env.sh that should be sourced by the user. This is an understood convention and we just have to rename and add source kafl/bin/activate/ to the end.

The .env convention is something I have only seen in pipenv. The normal virtualenv seems to have no option to source an additional shell environment.

il-steffen commented 2 years ago

Advantage of a source-able env.sh is that it would be more scriptable again and could be called from the Makefile (with some care)

il-steffen commented 2 years ago

abandon in favor of #25