Files
Ludarium-Public/deploy/audit-eden-runtime.sh
T
Ludarium release export df869819ce
Public source validation / source (push) Successful in 2m16s
Publish Ludarium source
2026-09-03 02:08:58 +02:00

56 lines
2.3 KiB
Bash

#!/bin/sh
set -eu
fail() {
printf 'Eden runtime audit failed: %s\n' "$1" >&2
exit 1
}
for command in eden Xwayland nginx python3 xdotool findmnt ss pgrep; do
command -v "$command" >/dev/null 2>&1 || fail "required command is absent: $command"
done
for command in docker dockerd containerd gcc g++ make cmake git ssh curl cron crond; do
command -v "$command" >/dev/null 2>&1 && fail "unused privileged/development command is present: $command"
done
for process in eden Xwayland nginx python3 selkies; do
pgrep -f "$process" >/dev/null 2>&1 || fail "required process is not running: $process"
done
for process in dockerd containerd cron crond sshd; do
pgrep -x "$process" >/dev/null 2>&1 && fail "unused service is running: $process"
done
mount_options="$(findmnt -n -o OPTIONS --target /games)"
case ",$mount_options," in
*,ro,*) ;;
*) fail "/games is not mounted read-only" ;;
esac
[ -z "${DEV_MODE+x}" ] || fail "PixelFlux development mode must remain disabled"
if env | grep -Eiq '^(http|https|all|no)_proxy=|^netrc='; then
fail "proxy or netrc environment can expose unused libcurl credential paths"
fi
if find /config /root -xdev -name .netrc -print -quit 2>/dev/null | grep -q .; then
fail "a runtime .netrc file is present"
fi
if grep -RIEq '^[[:space:]]*map[[:space:]]' /etc/nginx /defaults 2>/dev/null; then
fail "nginx map directives are forbidden in the isolated player"
fi
xwayland="$(pgrep -a -x Xwayland | head -1)"
printf '%s' "$xwayland" | grep -Fq -- '-rootless' || fail "Xwayland is not rootless"
printf '%s' "$xwayland" | grep -Eq -- '-listen[[:space:]]+tcp' && fail "Xwayland TCP listening is enabled"
ss -lnt | awk 'NR > 1 { print $4 }' | grep -Eq '(^|:):?60[0-9][0-9]$' && fail "an X11 TCP port is listening"
if find /config -xdev -type f \( -iname '*.svg' -o -iname '*.dtd' \) -print -quit 2>/dev/null | grep -q .; then
fail "untrusted SVG or DTD input is present in app-owned runtime configuration"
fi
if find /config -xdev -type f -size -1M -exec grep -Il 'rist://' {} + 2>/dev/null | grep -q .; then
fail "a RIST media URL is present in runtime configuration"
fi
env | grep -Eiq 'rist://' && fail "a RIST media URL is present in the environment"
printf 'Eden runtime audit passed: minimal tools, read-only games, bounded local display and no vulnerable optional protocol configuration.\n'