Add lab-02-security-as-a-system

lab-02-security-as-a-system/scenario/init_state.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+source "$SCRIPT_DIR/config.sh"
+
+if [[ "$EUID" -ne 0 ]]; then
+    printf 'ERROR: init_state.sh must run as root.\n' >&2
+    exit 1
+fi
+
+#
+# Persistent environment identity
+#
+
+mkdir -p "$LAB_STATE_DIR"
+chmod 700 "$LAB_STATE_DIR"
+
+if [[ ! -f "$LAB_IDENTITY_FILE" ]]; then
+    web_value="$(openssl rand -hex 3)"
+    api_value="$(openssl rand -hex 3)"
+    admin_value="$(openssl rand -hex 3)"
+
+    web_token="$(
+        python3 "$SCRIPT_DIR/identity.py" pack "$web_value"
+    )"
+
+    api_token="$(
+        python3 "$SCRIPT_DIR/identity.py" pack "$api_value"
+    )"
+
+    admin_token="$(
+        python3 "$SCRIPT_DIR/identity.py" pack "$admin_value"
+    )"
+
+    cat > "$LAB_IDENTITY_FILE" <<STATE
+LAB_WEB_SERVICE_TOKEN="web-$web_token"
+LAB_API_SERVICE_TOKEN="api-$api_token"
+LAB_ADMIN_SERVICE_TOKEN="adm-$admin_token"
+STATE
+
+    chown root:root "$LAB_IDENTITY_FILE"
+    chmod 600 "$LAB_IDENTITY_FILE"
+fi
+
+#
+# Investigation evidence
+#
+
+mkdir -p "$LAB_EVIDENCE_DIR"
+
+if [[ ! -f "$LAB_EVIDENCE_LOG" ]]; then
+    touch "$LAB_EVIDENCE_LOG"
+fi
+
+# Keep the evidence readable by the Codio user and secure grader.
+chown codio:codio "$LAB_EVIDENCE_DIR"
+chown codio:codio "$LAB_EVIDENCE_LOG"
+
+chmod 700 "$LAB_EVIDENCE_DIR"
+chmod 600 "$LAB_EVIDENCE_LOG"