3a17504dd0
- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair (MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain. - scripts/secureboot/sign-image.sh: signs kernels and EFI binaries (already-signed files skipped) with sbsign. - arcline-mok-enroll.service (+ script): one-time MOK enrollment at first boot via mokutil; no-ops when no key was shipped. - build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the public MOK in the image. Smoke test now asserts the enroll unit exists.
81 lines
3.7 KiB
Bash
Executable File
81 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Arcline OS — rootfs smoke test
|
|
#
|
|
# tests/smoke/verify-rootfs.sh <rootfs>
|
|
#
|
|
# Asserts the packaging + hardening guarantees of a built rootfs. Runs
|
|
# read-only against an extracted rootfs tree (no chroot needed). A failed
|
|
# assertion exits nonzero with a message.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
|
|
ROOTFS="${1:?usage: verify-rootfs.sh <rootfs>}"
|
|
[[ -d "$ROOTFS" ]] || { echo "FAIL: rootfs not found: $ROOTFS"; exit 1; }
|
|
|
|
pass=0; fail=0
|
|
ok() { printf ' \033[32m✓\033[0m %s\n' "$*"; pass=$((pass+1)); }
|
|
bad() { printf ' \033[31m✗\033[0m %s\n' "$*"; fail=$((fail+1)); }
|
|
|
|
have_file() { [[ -f "$ROOTFS/$1" ]]; }
|
|
have_dir() { [[ -d "$ROOTFS/$1" ]]; }
|
|
|
|
echo "─ hardening ───────────────────────────────────────────"
|
|
if have_file "etc/sysctl.d/10-arcline-hardening.conf"; then
|
|
grep -q 'kernel.kptr_restrict=2' "$ROOTFS/etc/sysctl.d/10-arcline-hardening.conf" \
|
|
&& ok "sysctl hardening present (kptr_restrict=2)" || bad "sysctl file missing kptr_restrict=2"
|
|
else
|
|
bad "missing etc/sysctl.d/10-arcline-hardening.conf"
|
|
fi
|
|
|
|
if have_file "etc/nftables.conf"; then
|
|
grep -q 'policy drop' "$ROOTFS/etc/nftables.conf" \
|
|
&& ok "nftables default-deny present" || bad "nftables policy is not drop"
|
|
else
|
|
bad "missing etc/nftables.conf"
|
|
fi
|
|
|
|
if have_file "etc/ssh/sshd_config.d/10-arcline-hardening.conf"; then
|
|
grep -q 'PasswordAuthentication no' "$ROOTFS/etc/ssh/sshd_config.d/10-arcline-hardening.conf" \
|
|
&& ok "ssh hardening present" || bad "ssh password auth not disabled"
|
|
else
|
|
bad "missing ssh hardening drop-in"
|
|
fi
|
|
|
|
have_file "etc/systemd/journald.conf.d/10-arcline.conf" \
|
|
&& ok "journald persistent config present" || bad "missing journald config"
|
|
have_file "etc/modprobe.d/arcline-hardening.conf" \
|
|
&& ok "module blacklist present" || bad "missing modprobe blacklist"
|
|
|
|
echo "─ telemetry (must be absent) ──────────────────────────"
|
|
if have_dir "var/lib/ubuntu-report" || have_dir "var/lib/popularity-contest"; then
|
|
bad "telemetry package artifacts found (ubuntu-report / popularity-contest)"
|
|
else
|
|
ok "no distro telemetry artifacts"
|
|
fi
|
|
if [[ -d "$ROOTFS/usr/lib/snapd" ]]; then
|
|
bad "snapd found (Arcline is snap-free)"
|
|
else
|
|
ok "no snapd"
|
|
fi
|
|
|
|
echo "─ core subsystems ─────────────────────────────────────"
|
|
if have_file "usr/local/sbin/arcline-snapshot"; then
|
|
ok "btrfs snapshot tooling present"
|
|
else
|
|
bad "missing arcline-snapshot"
|
|
fi
|
|
have_file "usr/local/sbin/arcline-rollback" \
|
|
&& ok "btrfs rollback tooling present" || bad "missing arcline-rollback"
|
|
have_file "usr/lib/systemd/system/arcline-snapshot.timer" \
|
|
&& ok "snapshot timer unit present" || bad "missing arcline-snapshot.timer"
|
|
have_file "usr/lib/systemd/system/arcline-mok-enroll.service" \
|
|
&& ok "secure-boot MOK enrollment unit present" || bad "missing arcline-mok-enroll.service"
|
|
|
|
grep -qi 'arcline' "$ROOTFS/etc/arcline-release" 2>/dev/null \
|
|
&& ok "arcline-release present" || bad "missing /etc/arcline-release"
|
|
|
|
echo "─ summary ─────────────────────────────────────────────"
|
|
echo " $pass passed, $fail failed"
|
|
[[ $fail -eq 0 ]]
|