mram
a88955e35c
The Linux install now mirrors the Windows virtual-account hardening: the unit runs with DynamicUser=yes (transient per-service UID, no login), ProtectSystem=strict with only StateDirectory writable (the install dir, so self-update can rewrite the binary), NoNewPrivileges, empty capability sets, restricted address families and a @system-service syscall filter. Install copies the binary to /var/lib/gpu-turnstile and the config to /etc/gpu-turnstile.env; Remove cleans up the unit and binary but keeps the config.
30 lines
701 B
Go
30 lines
701 B
Go
//go:build linux
|
|
|
|
package service
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestRenderUnit(t *testing.T) {
|
|
unit := renderUnit("/var/lib/gpu-turnstile/gpu-turnstile", "/etc/gpu-turnstile.env")
|
|
for _, want := range []string{
|
|
"Type=notify",
|
|
"WatchdogSec=30s",
|
|
`ExecStart="/var/lib/gpu-turnstile/gpu-turnstile" -config "/etc/gpu-turnstile.env"`,
|
|
"Restart=on-failure",
|
|
"WantedBy=multi-user.target",
|
|
"DynamicUser=yes",
|
|
"StateDirectory=gpu-turnstile",
|
|
"ProtectSystem=strict",
|
|
"NoNewPrivileges=yes",
|
|
"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
|
|
"SystemCallFilter=@system-service",
|
|
} {
|
|
if !strings.Contains(unit, want) {
|
|
t.Fatalf("unit missing %q:\n%s", want, unit)
|
|
}
|
|
}
|
|
}
|