33652064f9
- tests/: offline tree validation plus rootfs smoke tests that assert the hardening guarantees (kptr_restrict, default-deny firewall, key-only ssh, no snapd/telemetry, btrfs tooling). - ci/: GitLab pipeline - validate, build matrix (server/workstation/ cloud), smoke tests, publish on tags.
79 lines
3.6 KiB
Bash
Executable File
79 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — rootfs smoke test
|
|
#
|
|
# tests/smoke/verify-rootfs.sh <rootfs>
|
|
#
|
|
# Asserts the packaging + hardening guarantees of a built rootfs. Runs
|
|
# read-only against an extracted rootfs tree (no chroot needed). A failed
|
|
# assertion exits nonzero with a message.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
|
|
ROOTFS="${1:?usage: verify-rootfs.sh <rootfs>}"
|
|
[[ -d "$ROOTFS" ]] || { echo "FAIL: rootfs not found: $ROOTFS"; exit 1; }
|
|
|
|
pass=0; fail=0
|
|
ok() { printf ' \033[32m✓\033[0m %s\n' "$*"; pass=$((pass+1)); }
|
|
bad() { printf ' \033[31m✗\033[0m %s\n' "$*"; fail=$((fail+1)); }
|
|
|
|
have_file() { [[ -f "$ROOTFS/$1" ]]; }
|
|
have_dir() { [[ -d "$ROOTFS/$1" ]]; }
|
|
|
|
echo "─ hardening ───────────────────────────────────────────"
|
|
if have_file "etc/sysctl.d/10-arcline-hardening.conf"; then
|
|
grep -q 'kernel.kptr_restrict=2' "$ROOTFS/etc/sysctl.d/10-arcline-hardening.conf" \
|
|
&& ok "sysctl hardening present (kptr_restrict=2)" || bad "sysctl file missing kptr_restrict=2"
|
|
else
|
|
bad "missing etc/sysctl.d/10-arcline-hardening.conf"
|
|
fi
|
|
|
|
if have_file "etc/nftables.conf"; then
|
|
grep -q 'policy drop' "$ROOTFS/etc/nftables.conf" \
|
|
&& ok "nftables default-deny present" || bad "nftables policy is not drop"
|
|
else
|
|
bad "missing etc/nftables.conf"
|
|
fi
|
|
|
|
if have_file "etc/ssh/sshd_config.d/10-arcline-hardening.conf"; then
|
|
grep -q 'PasswordAuthentication no' "$ROOTFS/etc/ssh/sshd_config.d/10-arcline-hardening.conf" \
|
|
&& ok "ssh hardening present" || bad "ssh password auth not disabled"
|
|
else
|
|
bad "missing ssh hardening drop-in"
|
|
fi
|
|
|
|
have_file "etc/systemd/journald.conf.d/10-arcline.conf" \
|
|
&& ok "journald persistent config present" || bad "missing journald config"
|
|
have_file "etc/modprobe.d/arcline-hardening.conf" \
|
|
&& ok "module blacklist present" || bad "missing modprobe blacklist"
|
|
|
|
echo "─ telemetry (must be absent) ──────────────────────────"
|
|
if have_dir "var/lib/ubuntu-report" || have_dir "var/lib/popularity-contest"; then
|
|
bad "telemetry package artifacts found (ubuntu-report / popularity-contest)"
|
|
else
|
|
ok "no distro telemetry artifacts"
|
|
fi
|
|
if [[ -d "$ROOTFS/usr/lib/snapd" ]]; then
|
|
bad "snapd found (Arcline is snap-free)"
|
|
else
|
|
ok "no snapd"
|
|
fi
|
|
|
|
echo "─ core subsystems ─────────────────────────────────────"
|
|
if have_file "usr/local/sbin/arcline-snapshot"; then
|
|
ok "btrfs snapshot tooling present"
|
|
else
|
|
bad "missing arcline-snapshot"
|
|
fi
|
|
have_file "usr/local/sbin/arcline-rollback" \
|
|
&& ok "btrfs rollback tooling present" || bad "missing arcline-rollback"
|
|
have_file "usr/lib/systemd/system/arcline-snapshot.timer" \
|
|
&& ok "snapshot timer unit present" || bad "missing arcline-snapshot.timer"
|
|
|
|
grep -qi 'arcline' "$ROOTFS/etc/arcline-release" 2>/dev/null \
|
|
&& ok "arcline-release present" || bad "missing /etc/arcline-release"
|
|
|
|
echo "─ summary ─────────────────────────────────────────────"
|
|
echo " $pass passed, $fail failed"
|
|
[[ $fail -eq 0 ]]
|