Document and harden dos-shell automation

scripts/dos-shell

@@ -137,6 +137,138 @@ apply_templates() {
 
 detect_dosemu_args
 
+FORCE_CPU_EMULATION=0
+detect_kvm_support() {
+  if [ ! -c /dev/kvm ]; then
+    return 1
+  fi
+
+  if [ "$(id -u)" -eq 0 ]; then
+    if command -v runuser >/dev/null 2>&1; then
+      runuser -u "${DOS_USER}" -- test -r /dev/kvm 2>/dev/null || return 1
+      return 0
+    fi
+    return 0
+  fi
+
+  [ -r /dev/kvm ]
+}
+
+if ! detect_kvm_support; then
+  echo "dos-shell: disabling KVM acceleration (no usable /dev/kvm)" >&2
+  FORCE_CPU_EMULATION=1
+fi
+
+should_disable_audio=0
+audio_mode="${DOS_AUDIO_MODE:-auto}"
+case "${audio_mode,,}" in
+  mute|off|disabled)
+    should_disable_audio=1
+    ;;
+  force|on|enabled)
+    should_disable_audio=0
+    ;;
+  auto)
+    if [ -n "${SSH_CONNECTION:-}" ]; then
+      if [ -z "${PULSE_SERVER:-}" ] && [ -z "${PIPEWIRE_REMOTE:-}" ]; then
+        should_disable_audio=1
+      fi
+    fi
+    ;;
+  *)
+    echo "Unknown DOS_AUDIO_MODE '${audio_mode}', defaulting to auto." >&2
+    if [ -n "${SSH_CONNECTION:-}" ] && [ -z "${PULSE_SERVER:-}" ] && [ -z "${PIPEWIRE_REMOTE:-}" ]; then
+      should_disable_audio=1
+    fi
+    ;;
+esac
+
+if [ "${should_disable_audio}" -eq 1 ]; then
+  echo "dos-shell: muting DOS audio for this session" >&2
+  export AO_DRIVER="${AO_DRIVER:-null}"
+fi
+
+detect_landlock_support() {
+  local header
+  for header in /usr/include/linux/landlock.h \
+                /usr/include/uapi/linux/landlock.h \
+                /usr/lib*/gcc/*/*/include/uapi/linux/landlock.h; do
+    if [ -f "$header" ] && grep -q 'LANDLOCK_ACCESS_FS_REFER' "$header" 2>/dev/null; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+landlock_mode="${DOS_LANDLOCK_MODE:-auto}"
+case "${landlock_mode,,}" in
+  auto)
+    if detect_landlock_support; then
+      :
+    else
+      echo "dos-shell: disabling Landlock sandbox (ABI mismatch detected)" >&2
+      DOSEMU_ARGS+=(-p)
+    fi
+    ;;
+  off|disable|disabled)
+    echo "dos-shell: Landlock sandbox disabled by DOS_LANDLOCK_MODE" >&2
+    DOSEMU_ARGS+=(-p)
+    ;;
+  force|on|enabled)
+    ;;
+  *)
+    echo "Unknown DOS_LANDLOCK_MODE '${landlock_mode}', defaulting to auto." >&2
+    if detect_landlock_support; then
+      :
+    else
+      echo "dos-shell: disabling Landlock sandbox (ABI mismatch detected)" >&2
+      DOSEMU_ARGS+=(-p)
+    fi
+    ;;
+esac
+
+write_autoconfig() {
+  local need_config=0
+  local conf_path="${DOSEMU_DIR}/dosemurc"
+  local legacy_conf="${DOS_HOME}/.dosemurc"
+  local managed_marker="# Managed by dos-shell for compatibility"
+
+  if [ "${FORCE_CPU_EMULATION}" -eq 1 ] || [ "${should_disable_audio}" -eq 1 ]; then
+    need_config=1
+  fi
+
+  if [ "${need_config}" -eq 1 ]; then
+    if [ -f "${legacy_conf}" ] && grep -qF "${managed_marker}" "${legacy_conf}" 2>/dev/null; then
+      rm -f "${legacy_conf}"
+    fi
+    local tmp_conf="${conf_path}.tmp"
+    {
+      echo "${managed_marker}"
+      echo "define parser_version_3"
+      if [ "${FORCE_CPU_EMULATION}" -eq 1 ]; then
+        echo '$_cpu_vm = "emulated"'
+        echo '$_cpu_vm_dpmi = "emulated"'
+      fi
+      if [ "${should_disable_audio}" -eq 1 ]; then
+        echo '$_sound = (off)'
+        echo '$_pcm_hpf = (off)'
+      fi
+    } > "${tmp_conf}"
+    mv "${tmp_conf}" "${conf_path}"
+    if [ "$(id -u)" -eq 0 ]; then
+      chown "${DOS_USER}:${DOS_USER}" "${conf_path}"
+    fi
+    echo "dos-shell: wrote ${conf_path} overrides" >&2
+  else
+    for candidate in "${conf_path}" "${legacy_conf}"; do
+      if [ -f "${candidate}" ] && grep -qF "${managed_marker}" "${candidate}" 2>/dev/null; then
+        rm -f "${candidate}"
+        echo "dos-shell: removed autogenerated ${candidate}" >&2
+      fi
+    done
+  fi
+}
+
 if [ "${DOS_FORCE_INSTALL:-0}" = "1" ] || [ ! -f "${INSTALL_SENTINEL_PATH}" ]; then
   reset_drive_c
   touch "${INSTALL_SENTINEL_PATH}"
@@ -149,6 +281,7 @@ fi
 
 sync_allowed_content
 apply_templates
+write_autoconfig
 
 if [ "$(id -u)" -eq 0 ]; then
   chown -R "${DOS_USER}:${DOS_USER}" "${DOSEMU_DIR}"