#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <grp.h>

int main(int argc, char **argv) {
    if (argc < 1) {
        fprintf(stderr, "Usage: launcher <command> [args...]\n");
        return 1;
    }

    // 1. Capture host identities BEFORE unsharing
    uid_t current_uid = getuid();
    gid_t current_gid = getgid();

    // 2. Combined Unshare for User, Mount, and Network namespaces
    // We unshare Mount namespace (CLONE_NEWNS) to allow private /etc/resolv.conf setup
    // without contaminating the host filesystem.
    if (unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWNET) == -1) {
        perror("unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWNET)");
        return 1;
    }

    char map[64];

    // 3. Write UID map
    snprintf(map, sizeof(map), "0 %u 1\n", current_uid);
    int fd = open("/proc/self/uid_map", O_WRONLY);
    if (fd == -1) {
        perror("open uid_map");
        return 1;
    }
    if (write(fd, map, strlen(map)) == -1) {
        perror("write uid_map");
        close(fd);
        return 1;
    }
    close(fd);

    // 4. Disable setgroups
    fd = open("/proc/self/setgroups", O_WRONLY);
    if (fd != -1) {
        write(fd, "deny", 4);
        close(fd);
    }

    // 5. Write GID map
    snprintf(map, sizeof(map), "0 %u 1\n", current_gid);
    fd = open("/proc/self/gid_map", O_WRONLY);
    if (fd == -1) {
        perror("open gid_map");
        return 1;
    }
    if (write(fd, map, strlen(map)) == -1) {
        perror("write gid_map");
        close(fd);
        return 1;
    }
    close(fd);

    // 6. Execute the target command
    // In this architecture, the Go Bootstrap code passes the target binary 
    // as the first element of the argv array.
    // Therefore, argv[0] is the path to the binary we want to execute.
    if (argv[0] == NULL) {
        fprintf(stderr, "No target binary provided in argv[0]\\n");
        return 1;
    }

    // Prepare a new argv for the target command.
    // We want the target binary to see itself as argv[0].
    // The current argv is [target_binary, arg1, arg2, ...].
    // execv expects argv[0] to be the filename, and the rest as arguments.
    // This is already the case here, but let's be explicit.
    if (execv(argv[0], argv) == -1) {
        perror("execv failed");
        return 1;
    }
    
    return 0;
}