rothmanandClaude Opus 5.5
eb0242c182
Services (daynivo-kiosk-*, daynivo-network-guard, daynivo-boot-import), programs in /usr/lib/daynivo-kiosk, folders /etc, /var/lib, /var/log and /var/cache daynivo-kiosk*, the system user daynivo, DAYNIVO_* settings, the plymouth theme, network profiles daynivo-eth0/wlan0, the image stage and its first user daynivoadmin. install.sh moves a kiosk installed up to 1.2.x over once: old services stopped and removed, folders moved (configuration, password, browser profile, logs) with symlinks under the old names, the voxip user renamed with the same uid, network profiles renamed unless a change awaits confirmation, and old leftovers removed. Tested by upgrading a configured 1.2.0 installation in a container, and running the install a second time. Old names keep working where people type or place them: voxip-config.json, voxip-authorized_keys, voxip-network-reset, voxip-kiosk-ctl, and VOXIP_DEFAULT_URL / VOXIP_DEVICE_NAME for image builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.2 KiB
Python
31 lines
1.2 KiB
Python
from pathlib import Path
|
|
|
|
UNITS = Path(__file__).resolve().parent.parent / "systemd"
|
|
|
|
# Settings that make systemd set no_new_privs for a unit that does not run as root
|
|
# (systemd.exec(5)). sudo cannot gain root under that flag.
|
|
IMPLY_NO_NEW_PRIVILEGES = (
|
|
"NoNewPrivileges", "SystemCallFilter", "SystemCallArchitectures", "RestrictAddressFamilies",
|
|
"RestrictNamespaces", "PrivateDevices", "ProtectKernelTunables", "ProtectKernelModules",
|
|
"ProtectKernelLogs", "ProtectClock", "MemoryDenyWriteExecute", "RestrictRealtime",
|
|
"RestrictSUIDSGID", "DynamicUser", "LockPersonality",
|
|
)
|
|
|
|
|
|
def settings(unit):
|
|
result = {}
|
|
for line in (UNITS / unit).read_text().splitlines():
|
|
key, sep, value = line.partition("=")
|
|
if sep and not line.startswith("#"):
|
|
result[key.strip()] = value.strip()
|
|
return result
|
|
|
|
|
|
def test_manager_can_use_sudo_for_the_helper():
|
|
unit = settings("daynivo-kiosk-manager.service")
|
|
assert unit["User"] == "daynivo"
|
|
for key in IMPLY_NO_NEW_PRIVILEGES:
|
|
assert unit.get(key, "no") in ("no", "false", ""), key
|
|
for key in ("ProtectSystem", "ProtectHome", "PrivateTmp"):
|
|
assert key not in unit, key
|