59 lines
3.4 KiB
Python
59 lines
3.4 KiB
Python
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
class DeploymentContractTest(unittest.TestCase):
|
|
def test_runtime_upgrade_restarts_service(self):
|
|
installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
|
|
self.assertIn("systemctl enable zhulan-remote-cell.service", installer)
|
|
self.assertIn("systemctl restart zhulan-remote-cell.service", installer)
|
|
self.assertIn("systemctl restart zhulan-validation-executor.service", installer)
|
|
self.assertNotIn("systemctl enable --now zhulan-remote-cell.service", installer)
|
|
|
|
def test_bwrap_exception_is_scoped_to_runtime_copy(self):
|
|
env = (ROOT / "deploy" / "zhulan-remote-cell.env.example").read_text(encoding="utf-8")
|
|
profile = (ROOT / "deploy" / "zhulan-bwrap.apparmor").read_text(encoding="utf-8")
|
|
installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
|
|
private_copy = "/opt/guanghu/zhulan-remote-cell/runtime/zhulan-bwrap"
|
|
self.assertIn(f"ZHULAN_BWRAP={private_copy}", env)
|
|
self.assertIn(f"profile zhulan-remote-cell-bwrap {private_copy}", profile)
|
|
self.assertIn(" userns,", profile)
|
|
self.assertIn('install -o root -g zhulan-runtime -m 0750 /usr/bin/bwrap', installer)
|
|
self.assertNotIn("kernel.apparmor_restrict_unprivileged_userns=0", installer)
|
|
self.assertNotIn("chmod 4755", installer)
|
|
|
|
def test_only_executor_allows_bwrap_required_netlink_addition(self):
|
|
service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
|
|
executor = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
|
|
self.assertIn(
|
|
"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
|
|
service,
|
|
)
|
|
self.assertNotIn("AF_NETLINK", service)
|
|
self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor)
|
|
self.assertIn("RestrictNamespaces=user mnt pid net ipc uts", service)
|
|
|
|
def test_public_runtime_keeps_no_new_privileges_and_uses_local_executor(self):
|
|
public_service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
|
|
executor_service = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
|
|
runtime = (ROOT / "runtime" / "zhulan_cell.py").read_text(encoding="utf-8")
|
|
self.assertIn("NoNewPrivileges=true", public_service)
|
|
self.assertIn("ProtectKernelTunables=true", public_service)
|
|
self.assertIn("Requires=zhulan-validation-executor.service", public_service)
|
|
self.assertNotIn("NoNewPrivileges=true", executor_service)
|
|
self.assertNotIn("ProtectKernelTunables=true", executor_service)
|
|
self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor_service)
|
|
self.assertIn("ReadOnlyPaths=/srv/guanghu/zhulan-cell/workspaces", executor_service)
|
|
self.assertIn("PrivateNetwork=true", executor_service)
|
|
self.assertIn("InaccessiblePaths=/etc/guanghu/secrets", executor_service)
|
|
self.assertIn("ReadOnlyPaths=/var/lib/guanghu/zhulan-remote-cell", executor_service)
|
|
self.assertIn("InaccessiblePaths=/srv/guanghu/zhulan-cell/candidates", executor_service)
|
|
self.assertIn("socket.AF_UNIX", runtime)
|
|
self.assertNotIn('argv = [\n str(self.settings.bwrap_path)', runtime)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|