Node / ReticulumProjects / MeshChatX.git / files / vendor / rns_filesync / packaging / docker-test / test-bwrap.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Exercise the documented Bubblewrap sandbox command on the host.

Tffa657set -eu

Te6edf3ROOTTff7b72=Ta5d6ff"Tff7b72$(Te6edf3CDPATHTff7b72= Tffa657cd -- Ta5d6ff"Tff7b72$(dirname Ta5d6ff"Te6edf3$0Ta5d6ff"Tff7b72)Ta5d6ff/../..Ta5d6ff" Tff7b72&& Tffa657pwdTff7b72)Ta5d6ff"

Tff7b72if Tff7b72[ -x Ta5d6ff"Te6edf3$ROOTTa5d6ff/.venv/bin/rns-filesyncTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Te6edf3RNS_BINTff7b72=Ta5d6ff"Te6edf3$ROOTTa5d6ff/.venv/bin/rns-filesyncTa5d6ff"

Tff7b72elif Tffa657command -v rns-filesync >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

Te6edf3RNS_BINTff7b72=Ta5d6ff"Tff7b72$(Tffa657command -v rns-filesyncTff7b72)Ta5d6ff"

Tff7b72else

Tffa657echo Ta5d6ff"FAIL: rns-filesync not found"

Tffa657exit T79c0ff1

Tff7b72fi

Tff7b72if ! Tffa657command -v bwrap >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"FAIL: bwrap not installed (package bubblewrap)"

Tffa657exit T79c0ff1

Tff7b72fi

Te6edf3DATATff7b72=Ta5d6ff"Tffd700${Te6edf3XDG_DATA_HOMETff7b72:-Te6edf3$HOMETb4b4b4/.local/shareTffd700}Ta5d6ff/rns-filesync-sandbox-testTa5d6ff"

rm -rf Ta5d6ff"Te6edf3$DATATa5d6ff"

mkdir -p Ta5d6ff"Te6edf3$DATATa5d6ff/configTa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff/syncTa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff/reticulumTa5d6ff"

cat > Ta5d6ff"Te6edf3$DATATa5d6ff/config/configTa5d6ff" Ta5d6ff<<EOF

[filesync]

announce_interval = 300

directory = $DATA/sync

identity = rns_filesync

[access]

sync = r:all

[logging]

loglevel = 6

EOF

cat > Ta5d6ff"Te6edf3$DATATa5d6ff/reticulum/configTa5d6ff" Ta5d6ff<<'EOF'

[reticulum]

enable_transport = Yes

share_instance = No

shared_instance_port = 37501

instance_name = filesync_bwrap_test

panic_on_interface_error = No

[logging]

loglevel = 6

[interfaces]

[[Loopback UDP]]

type = UDPInterface

enabled = yes

listen_ip = 127.0.0.1

listen_port = 42610

forward_ip = 127.0.0.1

forward_port = 42611

EOF

Tffa657echo Ta5d6ff"==> version inside bwrap"

bwrap Tffea00\

--die-with-parent Tffea00\

--new-session Tffea00\

--proc /proc Tffea00\

--dev /dev Tffea00\

--ro-bind / / Tffea00\

--tmpfs /tmp Tffea00\

--bind Ta5d6ff"Te6edf3$DATATa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff" Tffea00\

--uid Ta5d6ff"Tff7b72$(id -uTff7b72)Ta5d6ff" --gid Ta5d6ff"Tff7b72$(id -gTff7b72)Ta5d6ff" Tffea00\

Ta5d6ff"Te6edf3$RNS_BINTa5d6ff" --version

Tffa657echo Ta5d6ff"==> start sandboxed daemon (README command shape)"

bwrap Tffea00\

--die-with-parent Tffea00\

--new-session Tffea00\

--proc /proc Tffea00\

--dev /dev Tffea00\

--ro-bind / / Tffea00\

--tmpfs /tmp Tffea00\

--bind Ta5d6ff"Te6edf3$DATATa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff" Tffea00\

--uid Ta5d6ff"Tff7b72$(id -uTff7b72)Ta5d6ff" --gid Ta5d6ff"Tff7b72$(id -gTff7b72)Ta5d6ff" Tffea00\

Ta5d6ff"Te6edf3$RNS_BINTa5d6ff" Tffea00\

--config Ta5d6ff"Te6edf3$DATATa5d6ff/configTa5d6ff" Tffea00\

--rnsconfig Ta5d6ff"Te6edf3$DATATa5d6ff/reticulumTa5d6ff" Tffea00\

-d Ta5d6ff"Te6edf3$DATATa5d6ff/syncTa5d6ff" Tffea00\

--no-repl Tffea00\

-q Tb4b4b4&

Te6edf3BPIDTff7b72=Te6edf3$!

sleep T79c0ff3

Tff7b72if ! Tffa657kill -0 Ta5d6ff"Te6edf3$BPIDTa5d6ff" T79c0ff2>/dev/nullTb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"FAIL: bwrap daemon died"

Tffa657wait Ta5d6ff"Te6edf3$BPIDTa5d6ff" Tff7b72|| Tffa657true

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffOK: sandboxed daemon pid=Te6edf3$BPIDTa5d6ff aliveTa5d6ff"

Tffa657echo sandbox-write-ok > Ta5d6ff"Te6edf3$DATATa5d6ff/sync/probe.txtTa5d6ff"

Tffa657test -f Ta5d6ff"Te6edf3$DATATa5d6ff/sync/probe.txtTa5d6ff"

Tffa657echo Ta5d6ff"OK: DATA sync dir is writable"

Tff7b72if bwrap Tffea00\

--die-with-parent Tffea00\

--new-session Tffea00\

--proc /proc Tffea00\

--dev /dev Tffea00\

--ro-bind / / Tffea00\

--tmpfs /tmp Tffea00\

--bind Ta5d6ff"Te6edf3$DATATa5d6ff" Ta5d6ff"Te6edf3$DATATa5d6ff" Tffea00\

--uid Ta5d6ff"Tff7b72$(id -uTff7b72)Ta5d6ff" --gid Ta5d6ff"Tff7b72$(id -gTff7b72)Ta5d6ff" Tffea00\

/bin/sh -c Ta5d6ff'echo should-fail > /etc/rns-filesync-bwrap-probe'Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"FAIL: wrote outside DATA"

Tffa657kill Ta5d6ff"Te6edf3$BPIDTa5d6ff" T79c0ff2>/dev/null Tff7b72|| Tffa657true

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657echo Ta5d6ff"OK: root outside DATA is read-only"

Tffa657kill Ta5d6ff"Te6edf3$BPIDTa5d6ff" T79c0ff2>/dev/null Tff7b72|| Tffa657true

Tffa657wait Ta5d6ff"Te6edf3$BPIDTa5d6ff" T79c0ff2>/dev/null Tff7b72|| Tffa657true

rm -rf Ta5d6ff"Te6edf3$DATATa5d6ff"

Tffa657echo Ta5d6ff"PASS: bwrap sandbox command"