rothmanandClaude Opus 5.5
1eabb839d3
ProtectKernelTunables, ProtectKernelModules and LockPersonality imply NoNewPrivileges for a non-root unit, so sudo refused to start the helper (hostname, reboot, network changes all failed). Guarded by a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.2 KiB
Python
31 lines
1.2 KiB
Python
from pathlib import Path
|
|
|
|
UNITS = Path(__file__).resolve().parent.parent / "systemd"
|
|
|
|
# Settings that make systemd set no_new_privs for a unit that does not run as root
|
|
# (systemd.exec(5)). sudo cannot gain root under that flag.
|
|
IMPLY_NO_NEW_PRIVILEGES = (
|
|
"NoNewPrivileges", "SystemCallFilter", "SystemCallArchitectures", "RestrictAddressFamilies",
|
|
"RestrictNamespaces", "PrivateDevices", "ProtectKernelTunables", "ProtectKernelModules",
|
|
"ProtectKernelLogs", "ProtectClock", "MemoryDenyWriteExecute", "RestrictRealtime",
|
|
"RestrictSUIDSGID", "DynamicUser", "LockPersonality",
|
|
)
|
|
|
|
|
|
def settings(unit):
|
|
result = {}
|
|
for line in (UNITS / unit).read_text().splitlines():
|
|
key, sep, value = line.partition("=")
|
|
if sep and not line.startswith("#"):
|
|
result[key.strip()] = value.strip()
|
|
return result
|
|
|
|
|
|
def test_manager_can_use_sudo_for_the_helper():
|
|
unit = settings("voxip-kiosk-manager.service")
|
|
assert unit["User"] == "voxip"
|
|
for key in IMPLY_NO_NEW_PRIVILEGES:
|
|
assert unit.get(key, "no") in ("no", "false", ""), key
|
|
for key in ("ProtectSystem", "ProtectHome", "PrivateTmp"):
|
|
assert key not in unit, key
|