release: public alpha 0.6.0 baseline

tools/check-extension-sandbox.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+service=deploy/systemd/system/jwebot-extension-host@.service
+socket=deploy/systemd/system/jwebot-extension-host@.socket
+
+test -f "$service"
+test -f "$socket"
+
+for setting in \
+  'User=jwebot-ext' \
+  'Group=jwebot-ext' \
+  'Environment=PYTHONDONTWRITEBYTECODE=1' \
+  'ConditionPathExists=/etc/jwebot-extension-host/allowed_signers' \
+  'ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers' \
+  'StandardInput=socket' \
+  'StandardOutput=socket' \
+  'NoNewPrivileges=true' \
+  'CapabilityBoundingSet=' \
+  'PrivateNetwork=true' \
+  'ProtectSystem=strict' \
+  'ProtectHome=true' \
+  'MemoryDenyWriteExecute=true' \
+  'RestrictAddressFamilies=AF_UNIX' \
+  'RuntimeMaxSec=12s' \
+  'MemoryMax=128M' \
+  'TasksMax=16' \
+  'LimitCORE=0'
+do
+  grep -Fxq "$setting" "$service"
+done
+
+for setting in \
+  'SocketUser=jwebot' \
+  'SocketGroup=jwebot' \
+  'SocketMode=0600' \
+  'RemoveOnStop=true'
+do
+  grep -Fxq "$setting" "$socket"
+done
+
+if [ "${JWEBOT_VERIFY_SYSTEMD:-0}" = 1 ] &&
+   command -v systemd-analyze >/dev/null 2>&1
+then
+  systemd-analyze verify "$service" "$socket"
+fi