#!/bin/sh -e

if [ -z "$1" ] || [ "$1" = "help" ] || [ "$1" = "--help" ] || [ "$1" = "-h" ]; then
  availsubcommands="$(find /usr/lib/s6-policy-common/bin/ -name "svctl-*" -not -name "*.unlocked" -printf '%f\n' | sort | sed 's/svctl-//')"
  printf "svctl: usage: svctl subcommand subargs. Valid subcommands:" 1>&2
  printf "%s\n" "$availsubcommands" | tr '\n' ',' | sed 's/,$/\n/' | sed 's/,/, /g' 1>&2
  exit 100
fi

# umask 022 (1.2.7): everything svctl creates -- the compiled database, the
# live copy made by s6-rc-update, links, contents.d entries, masks -- has
# readers that are not root: s6-fdholderd runs as sysfdh and reads data/rules
# on every connection, aep-zabbix-checks reads as zabbix. The permissions must
# not depend on the session that calls svctl. Measured on 23.09.2026 on
# srv-mgmt-tick1-1: a Puppet run from a session with umask 077 compiled a
# database with modes 700/600, the fdholder then answered "Connection reset",
# every log pipe was missing, zabbix-agent and kubelet died without a log line.
umask 022

subcommand="$1"

if [ ! -x /usr/lib/s6-policy-common/bin/svctl-"$subcommand" ]; then
  echo "unknown subcommand: $subcommand"
  exit 100
fi

shift
exec /usr/lib/s6-policy-common/bin/svctl-"$subcommand" "$@"
