Publish Ludarium source

deploy/audit-eden-runtime.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+set -eu
+
+fail() {
+  printf 'Eden runtime audit failed: %s\n' "$1" >&2
+  exit 1
+}
+
+for command in eden Xwayland nginx python3 xdotool findmnt ss pgrep; do
+  command -v "$command" >/dev/null 2>&1 || fail "required command is absent: $command"
+done
+
+for command in docker dockerd containerd gcc g++ make cmake git ssh curl cron crond; do
+  command -v "$command" >/dev/null 2>&1 && fail "unused privileged/development command is present: $command"
+done
+
+for process in eden Xwayland nginx python3 selkies; do
+  pgrep -f "$process" >/dev/null 2>&1 || fail "required process is not running: $process"
+done
+
+for process in dockerd containerd cron crond sshd; do
+  pgrep -x "$process" >/dev/null 2>&1 && fail "unused service is running: $process"
+done
+
+mount_options="$(findmnt -n -o OPTIONS --target /games)"
+case ",$mount_options," in
+  *,ro,*) ;;
+  *) fail "/games is not mounted read-only" ;;
+esac
+
+[ -z "${DEV_MODE+x}" ] || fail "PixelFlux development mode must remain disabled"
+if env | grep -Eiq '^(http|https|all|no)_proxy=|^netrc='; then
+  fail "proxy or netrc environment can expose unused libcurl credential paths"
+fi
+if find /config /root -xdev -name .netrc -print -quit 2>/dev/null | grep -q .; then
+  fail "a runtime .netrc file is present"
+fi
+if grep -RIEq '^[[:space:]]*map[[:space:]]' /etc/nginx /defaults 2>/dev/null; then
+  fail "nginx map directives are forbidden in the isolated player"
+fi
+
+xwayland="$(pgrep -a -x Xwayland | head -1)"
+printf '%s' "$xwayland" | grep -Fq -- '-rootless' || fail "Xwayland is not rootless"
+printf '%s' "$xwayland" | grep -Eq -- '-listen[[:space:]]+tcp' && fail "Xwayland TCP listening is enabled"
+ss -lnt | awk 'NR > 1 { print $4 }' | grep -Eq '(^|:):?60[0-9][0-9]$' && fail "an X11 TCP port is listening"
+
+if find /config -xdev -type f \( -iname '*.svg' -o -iname '*.dtd' \) -print -quit 2>/dev/null | grep -q .; then
+  fail "untrusted SVG or DTD input is present in app-owned runtime configuration"
+fi
+if find /config -xdev -type f -size -1M -exec grep -Il 'rist://' {} + 2>/dev/null | grep -q .; then
+  fail "a RIST media URL is present in runtime configuration"
+fi
+env | grep -Eiq 'rist://' && fail "a RIST media URL is present in the environment"
+
+printf 'Eden runtime audit passed: minimal tools, read-only games, bounded local display and no vulnerable optional protocol configuration.\n'