chages in systemd

tests/linux-path-access.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/source"
+printf '#!/bin/sh\nexit 0\n' > "$WORK/rust-proxy"
+chmod 0755 "$WORK/rust-proxy"
+
+export BUILDER_ROOT="$ROOT" PACKAGE_NAME=rustproxy BINARY_NAME=rust-proxy
+export VERSION=1.0.0 PACKAGE_RELEASE=1 DESCRIPTION=RustProxy LICENSE=UNKNOWN
+export MAINTAINER=test@example.invalid HOMEPAGE=https://example.invalid
+export GPG_PRIVATE_KEY_FILE=/nonexistent/test.gpg
+
+check_unit() {
+    local unit=$1
+    # A read-only home does not conceal /home, unlike ProtectHome=true/tmpfs.
+    [[ $(grep -c '^ProtectHome=read-only$' "$unit") -eq 1 ]]
+    ! grep -Eq '^ProtectHome=(true|yes|tmpfs|false|no)$' "$unit"
+    grep -Fxq 'ProtectSystem=strict' "$unit"
+    grep -Fxq 'User=rustproxy' "$unit"
+    grep -Fxq 'Group=rustproxy' "$unit"
+    grep -Fxq 'NoNewPrivileges=true' "$unit"
+    grep -Fxq 'CapabilityBoundingSet=CAP_NET_BIND_SERVICE' "$unit"
+    grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$unit"
+    grep -Fxq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$unit"
+}
+
+# Current RustProxy archive has no debian unit; both nFPM targets use fallback.
+"$ROOT/scripts/prepare-package.sh" "$WORK/source" "$WORK/fallback" "$WORK/rust-proxy"
+check_unit "$WORK/fallback/payload/usr/lib/systemd/system/rustproxy.service"
+for platform in deb rpm; do
+    grep -Fq '/usr/lib/systemd/system/rustproxy.service' "$WORK/fallback/nfpm-$platform.yaml"
+    grep -Fq '/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md' "$WORK/fallback/nfpm-$platform.yaml"
+done
+cmp "$ROOT/packaging/rustproxy-filesystem-access.md" \
+    "$WORK/fallback/payload/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md"
+
+# Some source releases ship their own unit. Normalize its outdated home policy
+# rather than letting it override the new package default.
+mkdir -p "$WORK/source/debian"
+cat > "$WORK/source/debian/rustproxy.service" <<'UNIT'
+[Unit]
+Description=RustProxy unit supplied with a source release
+
+[Service]
+User=rustproxy
+Group=rustproxy
+ExecStart=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy serve
+ProtectSystem=strict
+ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
+ProtectHome=true
+NoNewPrivileges=true
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
+check_unit "$WORK/source/debian/rustproxy.service"
+
+# A custom unit without ProtectHome must also get the new safe policy.
+sed -i '/^ProtectHome=/d' "$WORK/source/debian/rustproxy.service"
+python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
+check_unit "$WORK/source/debian/rustproxy.service"
+
+echo 'Linux DEB/RPM external path access policy: OK'

tests/log-rotation.sh

@@ -65,6 +65,8 @@ cmp "$ROOT/packaging/rustproxy.logrotate" "$WORK/linux/payload/etc/logrotate.d/r
 UNIT="$WORK/linux/payload/usr/lib/systemd/system/rustproxy.service"
 grep -Fq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$UNIT"
 grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$UNIT"
+grep -Fxq 'ProtectHome=read-only' "$UNIT"
+grep -Fxq 'ProtectSystem=strict' "$UNIT"
 for metadata in nfpm-deb.yaml nfpm-rpm.yaml; do
     grep -Fq '/etc/logrotate.d/rustproxy' "$WORK/linux/$metadata"
     grep -Fq 'config|noreplace' "$WORK/linux/$metadata"

tests/static.sh

@@ -22,7 +22,7 @@ grep -q 'FREEBSD_NATIVE_PACKAGING_REVISION=1' "$ROOT/scripts/lib.sh"
 grep -Fq 'FREEBSD_NATIVE_ENABLED: "${FREEBSD_NATIVE_ENABLED:-0}"' "$ROOT/docker-compose.yml"
 grep -Fq 'location /freebsd/' "$ROOT/http/nginx.conf"
 grep -Fq 'FREEBSD_NATIVE_ENABLED=0' "$ROOT/.env.example"
-grep -Fq 'ExecReload=/usr/bin/' "$ROOT/scripts/prepare-package.sh"
+grep -Fq 'ExecReload=/usr/bin/' "$ROOT/scripts/normalize-systemd-unit.py"
 grep -q 'OPNsense branch will still run' "$ROOT/scripts/build-release.sh"
 
 # Linux tests gate Linux packaging only.
@@ -33,12 +33,13 @@ grep -Fq 'AGENT_DEB_FILE=' "$ROOT/scripts/build-linux-release.sh"
 grep -Fq 'AGENT_RPM_FILE=' "$ROOT/scripts/build-linux-release.sh"
 grep -Fq 'rustproxy-docker-agent' "$ROOT/scripts/generate-index.sh"
 grep -Fq 'COPY --from=go-toolchain' "$ROOT/Dockerfile"
-grep -q 'PACKAGING_REVISION=4' "$ROOT/scripts/lib.sh"
+grep -q 'PACKAGING_REVISION=5' "$ROOT/scripts/lib.sh"
 grep -Fq 'ensure-rust-toolchain.sh' "$ROOT/scripts/build-linux-release.sh"
 grep -Fq 'ensure-rust-toolchain.sh' "$ROOT/scripts/build-opnsense.sh"
 grep -Fq 'nfpm package' "$ROOT/scripts/build-linux-release.sh"
 grep -q 'aptly .*publish' "$ROOT/scripts/build-linux-release.sh"
 grep -q 'createrepo_c' "$ROOT/scripts/build-linux-release.sh"
+[[ -x "$ROOT/tests/linux-path-access.sh" ]]
 ! grep -q 'cargo test' "$ROOT/scripts/build-opnsense-release.sh"
 ! grep -q 'cargo test' "$ROOT/scripts/build-opnsense.sh"