mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:27:02 +01:00
Krzysztof kuhy Rudnicki
656375275b
Two files under the cap. test_security_hardening.sh (423) keeps its filename -- shell-tests.yml runs the suite by name -- and its five sections move into three sourced libs. They are top-level blocks, not functions, so each is wrapped and called in the original order; the counters and LIVE_SECTION stay in the entry, which sourcing shares. Verified by diffing a full run against the same suite from a detached worktree at HEAD: byte-identical output, same exit status, still 18/1/5 on this host. The one failure is pre-existing. Linting a lib alone turns a bare LIVE_SECTION=1 into SC2034, since its only reader is test_result in the entry. A live_section() setter makes the write a real reference, so no suppression was needed. The mutation-driver split was already in the tree from the previous session and did not run: the operators had moved to _session_autopsy_mutations.py but the driver still named Mutation without importing it, so mypy and pylint both reported undefined-variable. Restored the import; the script now reports all 12 tests killed. block_compulsive_opening.sh (705) is deliberately untouched and now says so in the contract. install_all copies the running script to /usr/local/bin, so an entry sourcing lib/ would resolve SCRIPT_DIR there, find nothing, and leave beeper, signal-desktop and discord unlaunchable with a failing pacman hook. Splitting it means teaching the installer to copy the libs -- a refactor, not a line-count split. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
2.5 KiB
Bash
Executable File
74 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Security hardening tests: pacman wrapper and its policy files.
|
|
# Sourced by test_security_hardening.sh; inherits its strict mode,
|
|
# colors, counters (PASS/FAIL/SKIP), LIVE_SECTION and test_result().
|
|
|
|
sec_tests_pacman_wrapper() {
|
|
# ==================================================================
|
|
# PACMAN WRAPPER TESTS
|
|
# ==================================================================
|
|
echo "--- PACMAN WRAPPER ---"
|
|
|
|
# Test 12: pacman wrapper is installed
|
|
if [[ -L /usr/bin/pacman ]] && [[ -f /usr/bin/pacman.orig ]]; then
|
|
test_result "pacman wrapper installed" "pass"
|
|
else
|
|
if [[ ! -L /usr/bin/pacman ]]; then
|
|
test_result "pacman wrapper installed" "fail" "/usr/bin/pacman is not a symlink"
|
|
else
|
|
test_result "pacman wrapper installed" "fail" "/usr/bin/pacman.orig not found"
|
|
fi
|
|
fi
|
|
|
|
live_section 0 # repository checks from here on
|
|
|
|
# Test 13: google-chrome is blocked
|
|
blocked_file="$REPO_DIR/scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt"
|
|
if [[ -f "$blocked_file" ]]; then
|
|
if grep -qi "google-chrome" "$blocked_file"; then
|
|
test_result "google-chrome in blocked list" "pass"
|
|
else
|
|
test_result "google-chrome in blocked list" "fail" "Not found in $blocked_file"
|
|
fi
|
|
else
|
|
test_result "google-chrome in blocked list" "skip" "Blocked keywords file not found"
|
|
fi
|
|
|
|
# Test 14: chromium is blocked
|
|
if [[ -f "$blocked_file" ]]; then
|
|
if grep -qi "^chromium$" "$blocked_file"; then
|
|
test_result "chromium in blocked list" "pass"
|
|
else
|
|
test_result "chromium in blocked list" "fail" "Not found in $blocked_file"
|
|
fi
|
|
else
|
|
test_result "chromium in blocked list" "skip" "Blocked keywords file not found"
|
|
fi
|
|
|
|
# Test 15: Policy integrity file exists
|
|
# Lives under /var on the configured host, so it is a live check despite
|
|
# sitting among the repository ones.
|
|
live_section 1
|
|
if [[ -f /var/lib/pacman-wrapper/policy.sha256 ]]; then
|
|
test_result "Pacman policy integrity file exists" "pass"
|
|
else
|
|
test_result "Pacman policy integrity file exists" "fail" "Not found"
|
|
fi
|
|
live_section 0
|
|
|
|
# Test 16: LeechBlock auto-install function exists in wrapper
|
|
wrapper_file="$REPO_DIR/scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh"
|
|
if [[ -f "$wrapper_file" ]]; then
|
|
if grep -q "auto_install_leechblock" "$wrapper_file"; then
|
|
test_result "LeechBlock auto-install function exists" "pass"
|
|
else
|
|
test_result "LeechBlock auto-install function exists" "fail" "Function not found"
|
|
fi
|
|
else
|
|
test_result "LeechBlock auto-install function exists" "skip" "Wrapper file not found"
|
|
fi
|
|
|
|
echo ""
|
|
|
|
}
|