59 lines
1.5 KiB
Python
59 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[1]
|
|
SERVICE = (
|
|
PROJECT_ROOT
|
|
/ "deploy"
|
|
/ "systemd"
|
|
/ "system"
|
|
/ "jwebot-extension-host@.service"
|
|
)
|
|
SOCKET = (
|
|
PROJECT_ROOT
|
|
/ "deploy"
|
|
/ "systemd"
|
|
/ "system"
|
|
/ "jwebot-extension-host@.socket"
|
|
)
|
|
|
|
|
|
class ExtensionSandboxUnitTests(unittest.TestCase):
|
|
def test_service_has_required_isolation_controls(self):
|
|
text = SERVICE.read_text(encoding="utf-8")
|
|
for setting in (
|
|
"User=jwebot-ext",
|
|
"NoNewPrivileges=true",
|
|
"CapabilityBoundingSet=",
|
|
"PrivateNetwork=true",
|
|
"ProtectSystem=strict",
|
|
"ProtectHome=true",
|
|
"MemoryDenyWriteExecute=true",
|
|
"RestrictAddressFamilies=AF_UNIX",
|
|
"RuntimeMaxSec=12s",
|
|
"MemoryMax=128M",
|
|
"TasksMax=16",
|
|
"LimitCORE=0",
|
|
):
|
|
with self.subTest(setting=setting):
|
|
self.assertIn(setting, text)
|
|
|
|
def test_socket_is_private_to_the_edge_user(self):
|
|
text = SOCKET.read_text(encoding="utf-8")
|
|
self.assertIn("SocketUser=jwebot", text)
|
|
self.assertIn("SocketMode=0600", text)
|
|
self.assertIn("RemoveOnStop=true", text)
|
|
|
|
def test_service_has_no_write_allowlist(self):
|
|
text = SERVICE.read_text(encoding="utf-8")
|
|
self.assertNotIn("ReadWritePaths=", text)
|
|
self.assertIn("ReadOnlyPaths=/var/lib/jwebot-extensions/%i", text)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|
|
|