release: public alpha 0.6.0 baseline

2026-10-15 03:58:31 +08:00
commit d4242ae07c
238 changed files with 37724 additions and 0 deletions
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+
+import unittest
+from pathlib import Path
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+SERVICE = (
+    PROJECT_ROOT
+    / "deploy"
+    / "systemd"
+    / "system"
+    / "jwebot-extension-host@.service"
+)
+SOCKET = (
+    PROJECT_ROOT
+    / "deploy"
+    / "systemd"
+    / "system"
+    / "jwebot-extension-host@.socket"
+)
+
+
+class ExtensionSandboxUnitTests(unittest.TestCase):
+    def test_service_has_required_isolation_controls(self):
+        text = SERVICE.read_text(encoding="utf-8")
+        for setting in (
+            "User=jwebot-ext",
+            "NoNewPrivileges=true",
+            "CapabilityBoundingSet=",
+            "PrivateNetwork=true",
+            "ProtectSystem=strict",
+            "ProtectHome=true",
+            "MemoryDenyWriteExecute=true",
+            "RestrictAddressFamilies=AF_UNIX",
+            "RuntimeMaxSec=12s",
+            "MemoryMax=128M",
+            "TasksMax=16",
+            "LimitCORE=0",
+        ):
+            with self.subTest(setting=setting):
+                self.assertIn(setting, text)
+
+    def test_socket_is_private_to_the_edge_user(self):
+        text = SOCKET.read_text(encoding="utf-8")
+        self.assertIn("SocketUser=jwebot", text)
+        self.assertIn("SocketMode=0600", text)
+        self.assertIn("RemoveOnStop=true", text)
+
+    def test_service_has_no_write_allowlist(self):
+        text = SERVICE.read_text(encoding="utf-8")
+        self.assertNotIn("ReadWritePaths=", text)
+        self.assertIn("ReadOnlyPaths=/var/lib/jwebot-extensions/%i", text)
+
+
+if __name__ == "__main__":
+    unittest.main()
+