56 lines
2.3 KiB
Bash
56 lines
2.3 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
fail() {
|
|
printf 'Eden runtime audit failed: %s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
for command in eden Xwayland nginx python3 xdotool findmnt ss pgrep; do
|
|
command -v "$command" >/dev/null 2>&1 || fail "required command is absent: $command"
|
|
done
|
|
|
|
for command in docker dockerd containerd gcc g++ make cmake git ssh curl cron crond; do
|
|
command -v "$command" >/dev/null 2>&1 && fail "unused privileged/development command is present: $command"
|
|
done
|
|
|
|
for process in eden Xwayland nginx python3 selkies; do
|
|
pgrep -f "$process" >/dev/null 2>&1 || fail "required process is not running: $process"
|
|
done
|
|
|
|
for process in dockerd containerd cron crond sshd; do
|
|
pgrep -x "$process" >/dev/null 2>&1 && fail "unused service is running: $process"
|
|
done
|
|
|
|
mount_options="$(findmnt -n -o OPTIONS --target /games)"
|
|
case ",$mount_options," in
|
|
*,ro,*) ;;
|
|
*) fail "/games is not mounted read-only" ;;
|
|
esac
|
|
|
|
[ -z "${DEV_MODE+x}" ] || fail "PixelFlux development mode must remain disabled"
|
|
if env | grep -Eiq '^(http|https|all|no)_proxy=|^netrc='; then
|
|
fail "proxy or netrc environment can expose unused libcurl credential paths"
|
|
fi
|
|
if find /config /root -xdev -name .netrc -print -quit 2>/dev/null | grep -q .; then
|
|
fail "a runtime .netrc file is present"
|
|
fi
|
|
if grep -RIEq '^[[:space:]]*map[[:space:]]' /etc/nginx /defaults 2>/dev/null; then
|
|
fail "nginx map directives are forbidden in the isolated player"
|
|
fi
|
|
|
|
xwayland="$(pgrep -a -x Xwayland | head -1)"
|
|
printf '%s' "$xwayland" | grep -Fq -- '-rootless' || fail "Xwayland is not rootless"
|
|
printf '%s' "$xwayland" | grep -Eq -- '-listen[[:space:]]+tcp' && fail "Xwayland TCP listening is enabled"
|
|
ss -lnt | awk 'NR > 1 { print $4 }' | grep -Eq '(^|:):?60[0-9][0-9]$' && fail "an X11 TCP port is listening"
|
|
|
|
if find /config -xdev -type f \( -iname '*.svg' -o -iname '*.dtd' \) -print -quit 2>/dev/null | grep -q .; then
|
|
fail "untrusted SVG or DTD input is present in app-owned runtime configuration"
|
|
fi
|
|
if find /config -xdev -type f -size -1M -exec grep -Il 'rist://' {} + 2>/dev/null | grep -q .; then
|
|
fail "a RIST media URL is present in runtime configuration"
|
|
fi
|
|
env | grep -Eiq 'rist://' && fail "a RIST media URL is present in the environment"
|
|
|
|
printf 'Eden runtime audit passed: minimal tools, read-only games, bounded local display and no vulnerable optional protocol configuration.\n'
|