branderson
38a8df5d5a
The timer exists because the rules it checks are edited on the hypervisor, in a console, possibly by someone not thinking about this VM at the time. A rule dragged below the DROPs or a Firewall checkbox cleared while debugging something else produces no symptom here at all: the box keeps working, it is simply no longer contained. Hourly means nobody has to remember. The service runs reach and not all. That is a security decision rather than a tidiness one: the radius report inventories credentials by path, and a timer would write that into the journal on a schedule, where it outlives the run and is readable by anything that later gets root. units.bats is not a straight copy. It read BIN_DIR out of install.sh, and this repository has none by design, so it now reads the one entry point. Copied unchanged it would have passed by reading a file that does not exist. Its first test also passed vacuously with no units present, because grep failing to open a file gives the same non-zero status the test was looking for; it now asserts there is something to check before checking it.
26 lines
974 B
Desktop File
26 lines
974 B
Desktop File
[Unit]
|
|
Description=Check that the hypervisor firewall is still applied to this VM
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
|
|
# `reach`, not `all`, and that is a security decision rather than a tidiness
|
|
# one. The radius report inventories credentials by path, and a timer running
|
|
# it would write that inventory into the journal on a schedule, where it
|
|
# outlives the session that produced it and is readable by anything that later
|
|
# gets root. The reachability half has no sensitive output at all, and it is
|
|
# also the only half that can change without anyone touching this VM.
|
|
ExecStart=@@BIN_DIR@@/dejima-devbox-audit reach
|
|
|
|
# The path above is a marker. bootstrap substitutes it and then checks that
|
|
# what it wrote is executable, because a unit naming a program that is not
|
|
# there fails with 203/EXEC on every start and says nothing anyone reads.
|
|
|
|
User=root
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
NoNewPrivileges=yes
|