68 lines
2.8 KiB
Bash
Executable File
68 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
|
|
WORK=$(mktemp -d)
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
mkdir -p "$WORK/source"
|
|
printf '#!/bin/sh\nexit 0\n' > "$WORK/rust-proxy"
|
|
chmod 0755 "$WORK/rust-proxy"
|
|
|
|
export BUILDER_ROOT="$ROOT" PACKAGE_NAME=rustproxy BINARY_NAME=rust-proxy
|
|
export VERSION=1.0.0 PACKAGE_RELEASE=1 DESCRIPTION=RustProxy LICENSE=UNKNOWN
|
|
export MAINTAINER=test@example.invalid HOMEPAGE=https://example.invalid
|
|
export GPG_PRIVATE_KEY_FILE=/nonexistent/test.gpg
|
|
|
|
check_unit() {
|
|
local unit=$1
|
|
# A read-only home does not conceal /home, unlike ProtectHome=true/tmpfs.
|
|
[[ $(grep -c '^ProtectHome=read-only$' "$unit") -eq 1 ]]
|
|
! grep -Eq '^ProtectHome=(true|yes|tmpfs|false|no)$' "$unit"
|
|
grep -Fxq 'ProtectSystem=strict' "$unit"
|
|
grep -Fxq 'User=rustproxy' "$unit"
|
|
grep -Fxq 'Group=rustproxy' "$unit"
|
|
grep -Fxq 'NoNewPrivileges=true' "$unit"
|
|
grep -Fxq 'CapabilityBoundingSet=CAP_NET_BIND_SERVICE' "$unit"
|
|
grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$unit"
|
|
grep -Fxq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$unit"
|
|
}
|
|
|
|
# Current RustProxy archive has no debian unit; both nFPM targets use fallback.
|
|
"$ROOT/scripts/prepare-package.sh" "$WORK/source" "$WORK/fallback" "$WORK/rust-proxy"
|
|
check_unit "$WORK/fallback/payload/usr/lib/systemd/system/rustproxy.service"
|
|
for platform in deb rpm; do
|
|
grep -Fq '/usr/lib/systemd/system/rustproxy.service' "$WORK/fallback/nfpm-$platform.yaml"
|
|
grep -Fq '/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md' "$WORK/fallback/nfpm-$platform.yaml"
|
|
done
|
|
cmp "$ROOT/packaging/rustproxy-filesystem-access.md" \
|
|
"$WORK/fallback/payload/usr/share/doc/rustproxy/FILESYSTEM_ACCESS.md"
|
|
|
|
# Some source releases ship their own unit. Normalize its outdated home policy
|
|
# rather than letting it override the new package default.
|
|
mkdir -p "$WORK/source/debian"
|
|
cat > "$WORK/source/debian/rustproxy.service" <<'UNIT'
|
|
[Unit]
|
|
Description=RustProxy unit supplied with a source release
|
|
|
|
[Service]
|
|
User=rustproxy
|
|
Group=rustproxy
|
|
ExecStart=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy serve
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
|
|
ProtectHome=true
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
|
|
check_unit "$WORK/source/debian/rustproxy.service"
|
|
|
|
# A custom unit without ProtectHome must also get the new safe policy.
|
|
sed -i '/^ProtectHome=/d' "$WORK/source/debian/rustproxy.service"
|
|
python3 "$ROOT/scripts/normalize-systemd-unit.py" "$WORK/source/debian/rustproxy.service" rust-proxy
|
|
check_unit "$WORK/source/debian/rustproxy.service"
|
|
|
|
echo 'Linux DEB/RPM external path access policy: OK'
|