chages in systemd

2026-10-21 10:50:35 +02:00
1 parent a1389a6a61
commit 3b317a4f0c
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/source"
+printf '#!/bin/sh\nexit 0\n' > "$WORK/rust-proxy"
+chmod 0755 "$WORK/rust-proxy"
+
+export BUILDER_ROOT="$ROOT" PACKAGE_NAME=rustproxy BINARY_NAME=rust-proxy
+export VERSION=1.0.0 PACKAGE_RELEASE=1 DESCRIPTION=RustProxy LICENSE=UNKNOWN
+export MAINTAINER=test@example.invalid HOMEPAGE=https://example.invalid
+export GPG_PRIVATE_KEY_FILE=/nonexistent/test.gpg
+
+check_unit() {
+    local unit=$1
+    # A read-only home does not conceal /home, unlike ProtectHome=true/tmpfs.
+    [[ $(grep -c '^ProtectHome=read-only$' "$unit") -eq 1 ]]
+    ! grep -Eq '^ProtectHome=(true|yes|tmpfs|false|no)$' "$unit"
+    grep -Fxq 'ProtectSystem=strict' "$unit"
+    grep -Fxq 'User=rustproxy' "$unit"
+    grep -Fxq 'Group=rustproxy' "$unit"
+    grep -Fxq 'NoNewPrivileges=true' "$unit"
+    grep -Fxq 'CapabilityBoundingSet=CAP_NET_BIND_SERVICE' "$unit"
+    grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$unit"
+    grep -Fxq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$unit"
+}
+
+# Current RustProxy archive has no debian unit; both nFPM targets use fallback.
+"$ROOT/scripts/prepare-package.sh" "$WORK/source" "$WORK/fallback" "$WORK/rust-proxy"
+check_unit "$WORK/fallback/payload/usr/lib/systemd/system/rustproxy.service"
+for platform in deb rpm; do
+    grep -Fq '/usr/lib/systemd/system/rustproxy.service' "$WORK/fallback/nfpm-$platform.yaml"
+    grep -Fq '/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md' "$WORK/fallback/nfpm-$platform.yaml"
+done
+cmp "$ROOT/packaging/rustproxy-filesystem-access.md" \
+    "$WORK/fallback/payload/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md"
+
+# Some source releases ship their own unit. Normalize its outdated home policy
+# rather than letting it override the new package default.
+mkdir -p "$WORK/source/debian"
+cat > "$WORK/source/debian/rustproxy.service" <<'UNIT'
+[Unit]
+Description=RustProxy unit supplied with a source release
+
+[Service]
+User=rustproxy
+Group=rustproxy
+ExecStart=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy serve
+ProtectSystem=strict
+ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
+ProtectHome=true
+NoNewPrivileges=true
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
+check_unit "$WORK/source/debian/rustproxy.service"
+
+# A custom unit without ProtectHome must also get the new safe policy.
+sed -i '/^ProtectHome=/d' "$WORK/source/debian/rustproxy.service"
+python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
+check_unit "$WORK/source/debian/rustproxy.service"
+
+echo 'Linux DEB/RPM external path access policy: OK'