founder
fa44ffbb24
1. The state directory was created too late and never verified. ensure_state_dir only ran when the ownership record was written, well after assert_swap_path_is_safe had already required every parent of swap.path to exist. On a clean host that meant a perfectly legal /var/lib/awg2-harness/swapfile was rejected because the directory this package is supposed to create did not exist yet. Worse, when the directory did exist the check only confirmed it was a directory. A pre-existing /var/lib/awg2-harness that was group- or world-writable defeated the whole point of restricting swap.path to root-owned roots: another user could still swap the swapfile out from under a root-owned fallocate or mkswap. ensure_state_dir now runs first in ensure_swap and asserts what the restriction actually depends on: the parent is a real directory and not a symlink, the state directory itself is not a symlink, it is owned by uid 0, and it is not writable by group or others. A mode that is merely narrower than 0700 is tightened rather than rejected; anything group- or world-writable is a hard error, because the safety argument for the whole allow-list rests on it. The units also declare StateDirectory=awg2-harness with mode 0700 and RuntimeDirectory=awg2-harness, so in the common case systemd creates and owns both and the binary only has to verify. The runtime checks stay regardless: the CLI subcommands run outside the service lifecycle. 2. The fstab copies could be more permissive than the file they mirror. The backup and pristine copies were written at a hardcoded 0644 with a comment claiming they must not be wider than the original. On a host where /etc/fstab is 0600 they were, and the rollback then handed that wider mode to the live file too. FstabTransaction now captures the live mode when it opens and uses it for the backup, the pristine copy, the candidate and the rollback. One test added, unix-only since it asserts a mode: a 0600 fstab produces 0600 copies and stays 0600 after the commit. cargo test --workspace: 180 + 4 passed. clippy -D warnings clean. Unit files not verified here - no systemd on this host; tools/build.sh runs systemd-analyze verify on the build machine.
28 lines
821 B
Desktop File
28 lines
821 B
Desktop File
[Unit]
|
|
Description=AWG2 Harness reboot scheduler
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
StartLimitIntervalSec=15min
|
|
StartLimitBurst=10
|
|
|
|
[Service]
|
|
Type=exec
|
|
User=root
|
|
ExecStart=/usr/sbin/awg2-reboot-scheduler --config /etc/awg2-harness/config.toml
|
|
# Shared with awg2-harness.service; the plan file lives here.
|
|
RuntimeDirectory=awg2-harness
|
|
RuntimeDirectoryMode=0755
|
|
RuntimeDirectoryPreserve=yes
|
|
# The scheduler exits 0 in two normal cases: reboot.enabled = false, and after systemd has
|
|
# accepted the reboot request. Neither is a failure, so on-failure is required here -
|
|
# Restart=always would respawn it in a loop on a host with reboots disabled.
|
|
Restart=on-failure
|
|
RestartSec=10s
|
|
RestartSteps=4
|
|
RestartMaxDelaySec=160s
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|