84 lines
2.5 KiB
Bash
Executable File
84 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT HUP INT TERM
|
|
|
|
snapshot_path() {
|
|
path=$1
|
|
if [ ! -e "$path" ] && [ ! -L "$path" ]; then
|
|
printf 'absent\t%s\n' "$path"
|
|
return
|
|
fi
|
|
|
|
# An unprivileged CI user cannot traverse every protected system root. Keep
|
|
# a stable top-level observation for those roots instead of using sudo or
|
|
# failing before the tests run. Readable roots are still traversed fully and
|
|
# every readable regular file is content-hashed.
|
|
stat --printf='top-metadata\t%F\t%a\t%u\t%g\t%N\n' -- "$path"
|
|
if { [ -d "$path" ] && { [ ! -r "$path" ] || [ ! -x "$path" ]; }; } || \
|
|
{ [ ! -d "$path" ] && [ ! -r "$path" ]; };
|
|
then
|
|
printf 'unreadable\t%s\n' "$path"
|
|
return
|
|
fi
|
|
|
|
traversal_complete=true
|
|
if ! find -H "$path" -xdev \
|
|
-exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
|
|
>"$work/snapshot-metadata" 2>/dev/null
|
|
then
|
|
traversal_complete=false
|
|
fi
|
|
LC_ALL=C sort "$work/snapshot-metadata"
|
|
|
|
if ! find -H "$path" -xdev \
|
|
\( \( -type d \( ! -readable -o ! -executable \) \) -o \( -type f ! -readable \) \) \
|
|
-printf='unreadable\t%p\n' >"$work/snapshot-unreadable" 2>/dev/null
|
|
then
|
|
traversal_complete=false
|
|
fi
|
|
LC_ALL=C sort "$work/snapshot-unreadable"
|
|
|
|
if ! find -H "$path" -xdev -type f -readable -exec sha256sum -- {} + \
|
|
>"$work/snapshot-content" 2>/dev/null
|
|
then
|
|
traversal_complete=false
|
|
fi
|
|
LC_ALL=C sort "$work/snapshot-content"
|
|
|
|
if [ "$traversal_complete" = false ]; then
|
|
printf 'unreadable-descendant\t%s\n' "$path"
|
|
fi
|
|
}
|
|
|
|
snapshot() {
|
|
for path in \
|
|
"$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
|
|
/etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
|
|
/etc/systemd/system/docker.service.d
|
|
do
|
|
snapshot_path "$path"
|
|
done
|
|
if command -v gsettings >/dev/null 2>&1; then
|
|
gsettings list-recursively org.gnome.system.proxy 2>&1 || true
|
|
else
|
|
printf 'gsettings absent\n'
|
|
fi
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl show docker.service -p ActiveState -p SubState -p NRestarts -p ExecMainStartTimestampMonotonic 2>&1 || true
|
|
else
|
|
printf 'systemctl absent\n'
|
|
fi
|
|
}
|
|
|
|
snapshot >"$work/before"
|
|
(
|
|
cd "$repo"
|
|
go test ./...
|
|
)
|
|
snapshot >"$work/after"
|
|
cmp "$work/before" "$work/after"
|
|
printf 'full Go suite passed unprivileged: readable host configuration content and metadata were unchanged; protected roots retained the same top metadata and unreadable markers; no sudo was used\n'
|