mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 21:27:02 +01:00
Krzysztof kuhy Rudnicki
6b828d29aa
The last unit over the cap is now github.com/kuhyx/digital-wellbeing, cloned at ~/digital-wellbeing, and `--warn` is gone from the directory-depth-cap hook. `check_directory_depth.sh --all` exits 0 with zero violations, down from 46 at the start of the session. That was the point of the campaign. History was filtered across all three paths the unit has lived at (63 commits); the current path alone holds 2. The six suites that test this code lived in linux_configuration/tests/ rather than beside it, so they were filtered separately (24 commits) and merged in as a second root. A path filter of the unit alone would have left them here, testing code that had left the repo -- and their names would still have been in shell-tests.yml's hardcoded arrays, failing CI on missing files. linux_configuration/lib/common.sh is vendored into vendor/ rather than trimmed to the four functions actually used: set_actual_user_vars calls two of the others, so a trim breaks silently. It is in vendor/ and not lib/ because test_music_parallelism.sh copies the unit's own lib/ into a scratch worktree while stubbing the shared lib; in one directory the real common.sh overwrote the stub, and the suite silently measured the wrong library. Running the callers caught what shellcheck and grep both missed: check_and_enable_services.sh died with "DW_REPO: unbound variable" because the definition sat below its first use. It now runs clean and reports ok for every extracted-unit check. Two long-standing live defects fixed as a consequence. The pacman-wrapper drift manifest embeds ABSOLUTE paths and had named deleted scripts/ paths since the flatten, so the check reported a permanent false "stale or tampered"; it now verifies, with unchanged hashes proving the extracted bytes are identical. And the last two stale live references are gone: 8 -> 0. The two pre-commit excludes for setup_midnight_shutdown.sh are dropped rather than moved. lsattr shows nothing in the unit is chattr +i any more, and the fixer hooks leave the file alone when allowed to run. Removing 80 shell files also shrank the jscpd denominator enough that the virtualenv/tqdm clones inside the GENERATED .ci-mirror-venv/ tipped the repo to 2.09% and blocked this commit, which adds no duplication. That directory is the same vendored third-party shell the ignore list already excludes as .venv/, just under another name; jscpd walks the working tree rather than the index, so being untracked did not spare it. Excluded by name: 1.74%. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
132 lines
4.4 KiB
Bash
Executable File
132 lines
4.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# tests/test_security_hardening.sh
|
|
# Verify all security mechanisms are working
|
|
#
|
|
# Run with: bash tests/test_security_hardening.sh
|
|
# Some tests require root privileges
|
|
|
|
set -uo pipefail
|
|
# Note: NOT using -e because we need to handle test failures gracefully
|
|
|
|
PASS=0
|
|
FAIL=0
|
|
SKIP=0
|
|
|
|
# Roughly half this suite inspects a *configured machine* (chattr flags, systemd
|
|
# guard units, /usr/local payloads) rather than the repository. Those checks
|
|
# cannot pass in CI or a container, where none of it is installed — but the
|
|
# repo-file checks further down can and should still run. So live checks are
|
|
# reported as skipped off-host instead of failed, which keeps the suite
|
|
# meaningful in both places rather than permanently red in one.
|
|
# Detection must not consult `systemctl is-system-running`: it exits non-zero
|
|
# when the system is *degraded*, which is exactly the state a failed guard unit
|
|
# produces. Using it would make this suite skip the very failures it exists to
|
|
# catch. Test instead for systemd being init plus the guard payload being
|
|
# installed — both true on a configured host regardless of unit health.
|
|
IS_CONFIGURED_HOST=0
|
|
if [[ -d /run/systemd/system ]] && [[ -d /usr/local/share/hosts-guard ]]; then
|
|
IS_CONFIGURED_HOST=1
|
|
fi
|
|
# Set to 1 while inside the live-host sections, 0 for repository checks.
|
|
LIVE_SECTION=0
|
|
|
|
# Colors
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
test_result() {
|
|
local name="$1"
|
|
local result="$2"
|
|
local reason="${3:-}"
|
|
|
|
case "$result" in
|
|
pass)
|
|
echo -e "${GREEN}✅ PASS${NC}: $name"
|
|
((PASS++))
|
|
;;
|
|
fail)
|
|
if ((LIVE_SECTION == 1)) && ((IS_CONFIGURED_HOST == 0)); then
|
|
# Off-host: the mechanism being absent is expected, not a defect.
|
|
echo -e "${YELLOW}⏭️ SKIP${NC}: $name"
|
|
echo -e " ${YELLOW}Reason: not a configured host (CI/container)${NC}"
|
|
((SKIP++))
|
|
return
|
|
fi
|
|
echo -e "${RED}❌ FAIL${NC}: $name"
|
|
[[ -n "$reason" ]] && echo -e " ${RED}Reason: $reason${NC}"
|
|
((FAIL++))
|
|
;;
|
|
skip)
|
|
echo -e "${YELLOW}⏭️ SKIP${NC}: $name"
|
|
[[ -n "$reason" ]] && echo -e " ${YELLOW}Reason: $reason${NC}"
|
|
((SKIP++))
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# Setter for LIVE_SECTION. The section libs are linted in isolation, where a
|
|
# bare `LIVE_SECTION=1` looks like an unused variable (SC2034) because its only
|
|
# reader — test_result, above — lives in this file. Going through a function
|
|
# makes the write a real reference instead of needing a suppression.
|
|
live_section() {
|
|
LIVE_SECTION="$1"
|
|
}
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_DIR="$(dirname "$SCRIPT_DIR")"
|
|
# The pacman wrapper and the compulsive-opening blocker were EXTRACTED to
|
|
# github.com/kuhyx/digital-wellbeing. The checks that read them are guarded by
|
|
# [[ -f ]], so a stale path here does not fail -- it SKIPS, silently reporting
|
|
# a clean run for tests that never executed.
|
|
# shellcheck source=../lib/extracted_repos.sh
|
|
source "$REPO_DIR/lib/extracted_repos.sh"
|
|
DW_REPO="$(extracted_repo_dir digital-wellbeing)"
|
|
|
|
echo "=========================================="
|
|
echo "Security Hardening Test Suite"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo "Testing components in: $REPO_DIR"
|
|
echo ""
|
|
|
|
# The test sections live in libs to keep this file under the 250-line cap.
|
|
# They are functions, but they mutate this script's counters and LIVE_SECTION
|
|
# exactly as the former top-level blocks did — sourcing shares the shell.
|
|
LIB_DIR="$SCRIPT_DIR/lib"
|
|
# shellcheck source=lib/security_hosts_shutdown.sh
|
|
source "$LIB_DIR/security_hosts_shutdown.sh"
|
|
# shellcheck source=lib/security_pacman.sh
|
|
source "$LIB_DIR/security_pacman.sh"
|
|
# shellcheck source=lib/security_apps.sh
|
|
source "$LIB_DIR/security_apps.sh"
|
|
|
|
# Order matters: it is the order the sections ran in before the split.
|
|
sec_tests_hosts_guard
|
|
sec_tests_shutdown_schedule
|
|
sec_tests_pacman_wrapper
|
|
sec_tests_compulsive_block
|
|
sec_tests_screen_locker
|
|
|
|
# ==================================================================
|
|
# SUMMARY
|
|
# ==================================================================
|
|
echo "=========================================="
|
|
echo "RESULTS SUMMARY"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo -e "${GREEN}Passed: $PASS${NC}"
|
|
echo -e "${RED}Failed: $FAIL${NC}"
|
|
echo -e "${YELLOW}Skipped: $SKIP${NC}"
|
|
echo ""
|
|
echo "=========================================="
|
|
|
|
if [[ $FAIL -gt 0 ]]; then
|
|
echo -e "${RED}Some tests failed! Review the output above.${NC}"
|
|
exit 1
|
|
else
|
|
echo -e "${GREEN}All active tests passed!${NC}"
|
|
exit 0
|
|
fi
|