55 lines
1.4 KiB
Go
55 lines
1.4 KiB
Go
package admin
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestScertSystemdUnitPolicy(t *testing.T) {
|
|
unitPath := filepath.Join("..", "..", "..", "deploy", "systemd", "Scert.service")
|
|
data, err := os.ReadFile(unitPath)
|
|
if err != nil {
|
|
t.Fatalf("读取 Scert systemd unit 失败：%v", err)
|
|
}
|
|
unit := activeUnitText(string(data))
|
|
for _, required := range []string{
|
|
"Documentation=file:///scert/docs/Scert-service-management.md",
|
|
"User=Scert",
|
|
"Group=Scert",
|
|
"ExecStart=/scert/scert --config /scert/conf/scert.json serve",
|
|
"Restart=on-failure",
|
|
"UMask=0077",
|
|
"CapabilityBoundingSet=",
|
|
"AmbientCapabilities=",
|
|
"PrivateDevices=yes",
|
|
"ProtectSystem=strict",
|
|
"ProtectHostname=yes",
|
|
"ProtectClock=yes",
|
|
"ProtectKernelTunables=yes",
|
|
"ProtectKernelModules=yes",
|
|
"ProtectControlGroups=yes",
|
|
"ProtectKernelLogs=yes",
|
|
"LockPersonality=yes",
|
|
"MemoryDenyWriteExecute=yes",
|
|
"RestrictNamespaces=yes",
|
|
"RestrictRealtime=yes",
|
|
"RestrictSUIDSGID=yes",
|
|
"RemoveIPC=yes",
|
|
"SystemCallArchitectures=native",
|
|
"ReadWritePaths=/ssl /scert/conf /scert/data /scert/log /scert/backups",
|
|
"[Install]",
|
|
"WantedBy=multi-user.target",
|
|
} {
|
|
if !strings.Contains(unit, required) {
|
|
t.Errorf("Scert systemd unit 缺少必要策略：%s", required)
|
|
}
|
|
}
|
|
for _, forbidden := range []string{"ExecReload=", "Restart=always"} {
|
|
if strings.Contains(unit, forbidden) {
|
|
t.Errorf("Scert systemd unit 不得包含：%s", forbidden)
|
|
}
|
|
}
|
|
}
|