53 lines
2.1 KiB
Python
53 lines
2.1 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
"""Regression checks for the opt-in Go validation service."""
|
|
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
UNIT = ROOT / "systemd" / "enodia-sentinel-go-sidecar.service"
|
|
|
|
|
|
class GoSidecarPackagingTests(unittest.TestCase):
|
|
def test_unit_is_isolated_and_opt_in(self) -> None:
|
|
text = UNIT.read_text(encoding="utf-8")
|
|
self.assertIn("ExecStart=/usr/bin/env enodia-sentinel-go ", text)
|
|
self.assertIn("--state-dir /var/lib/enodia-sentinel-go", text)
|
|
self.assertIn("--event-log /var/lib/enodia-sentinel-go/events.jsonl", text)
|
|
self.assertIn("--event-log-max-bytes 67108864", text)
|
|
self.assertIn("--snapshot-dir /var/lib/enodia-sentinel-go", text)
|
|
self.assertIn("--ebpf-exec --ebpf-syscall", text)
|
|
self.assertIn("StandardOutput=journal", text)
|
|
self.assertIn("InaccessiblePaths=-/var/log/enodia-sentinel", text)
|
|
self.assertNotIn("Alias=enodia-sentinel.service", text)
|
|
|
|
def test_unit_keeps_required_hardening(self) -> None:
|
|
text = UNIT.read_text(encoding="utf-8")
|
|
for directive in (
|
|
"ProtectSystem=strict",
|
|
"ProtectHome=read-only",
|
|
"NoNewPrivileges=yes",
|
|
"MemoryDenyWriteExecute=yes",
|
|
"StateDirectory=enodia-sentinel-go",
|
|
"LimitMEMLOCK=infinity",
|
|
"Type=notify",
|
|
"NotifyAccess=main",
|
|
"PrivateDevices=yes",
|
|
"RestrictAddressFamilies=AF_UNIX AF_NETLINK",
|
|
"SystemCallArchitectures=native",
|
|
):
|
|
with self.subTest(directive=directive):
|
|
self.assertIn(directive, text)
|
|
|
|
def test_install_requires_explicit_go_target(self) -> None:
|
|
makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
|
|
default_install = makefile.split("\ninstall-go:", 1)[0]
|
|
self.assertNotIn("enodia-sentinel-go-sidecar.service", default_install)
|
|
self.assertIn("install-go: build-go", makefile)
|
|
self.assertIn("enable-go:", makefile)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|