From 461e4bca05c91e89dd07187af51899eac9cb8faa Mon Sep 17 00:00:00 2001
From: Tommy <contact@tommytran.io>
Date: Wed, 7 Feb 2024 10:37:36 -0700
Subject: [PATCH] Fix gVisor Updater

Signed-off-by: Tommy <contact@tommytran.io>
---
 Generic.ign |  7 ++++++-
 Generic.yml | 18 ++++++++++++++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/Generic.ign b/Generic.ign
index 1ab7ba3..af4fe25 100644
--- a/Generic.ign
+++ b/Generic.ign
@@ -221,7 +221,12 @@
         "name": "setsebool.service"
       },
       {
-        "contents": "[Unit]\nDescription=gVisor Update\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=gVisor Download\nRequires=network-online.target\nBefore=docker.service\n\n[Service]\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\n\n[Install]\nWantedBy=multi-user.target\n",
+        "enabled": true,
+        "name": "gvisor-download.service"
+      },
+      {
+        "contents": "[Unit]\nDescription=Copy gVisor to the correct location\nAfter=gvisor-download.service\n\n[Service]\nWorkingDirectory=/var/home/unpriv\nType=oneshot\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "gvisor-updater.service"
       },
diff --git a/Generic.yml b/Generic.yml
index caeddcc..05a3526 100644
--- a/Generic.yml
+++ b/Generic.yml
@@ -85,15 +85,16 @@ systemd:
         RemainAfterExit=yes
         [Install]
         WantedBy=multi-user.target
-    - name: gvisor-updater.service
+    - name: gvisor-download.service
       enabled: true
       contents: |
         [Unit]
-        Description=gVisor Update
+        Description=gVisor Download
         Requires=network-online.target
         Before=docker.service
 
         [Service]
+        User=unpriv
         WorkingDirectory=/var/home/unpriv
         Type=oneshot
         ExecStart=/usr/bin/sleep 5
@@ -101,6 +102,19 @@ systemd:
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
+
+        [Install]
+        WantedBy=multi-user.target
+    - name: gvisor-updater.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Copy gVisor to the correct location
+        After=gvisor-download.service
+
+        [Service]
+        WorkingDirectory=/var/home/unpriv
+        Type=oneshot
         ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
         ExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512
         ExecStart=/usr/bin/chown root:root runsc containerd-shim-runsc-v1