41 lines
1.6 KiB
Bash
41 lines
1.6 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
fail=0
|
|
expect_denied() { if "$@" >/dev/null 2>&1; then echo "UNEXPECTED SUCCESS: $*" >&2; fail=1; fi; }
|
|
|
|
test "$(id -u)" -eq 1200
|
|
test "$DOCKER_HOST" = unix:///run/user/1200/docker.sock
|
|
touch /srv/le-app-codex/tmp/phase2b-write-test
|
|
rm /srv/le-app-codex/tmp/phase2b-write-test
|
|
expect_denied ls /var/www
|
|
expect_denied ls /root
|
|
expect_denied ls /home
|
|
expect_denied ls /srv/directus-archive
|
|
expect_denied ls /srv/codex-work
|
|
expect_denied stat /run/docker.sock
|
|
expect_denied stat /var/run/docker.sock
|
|
expect_denied stat /run/containerd/containerd.sock
|
|
expect_denied stat /dev/sda
|
|
expect_denied stat /proc/1/root
|
|
expect_denied sh -c 'echo x > /etc/phase2b-write-test'
|
|
expect_denied sh -c 'echo x > /srv/phase2b-write-test'
|
|
expect_denied curl -4fsS --connect-timeout 2 http://127.0.0.1
|
|
expect_denied curl -4fsS --connect-timeout 2 http://10.200.120.1
|
|
expect_denied curl -4fsS --connect-timeout 2 http://192.168.10.151
|
|
expect_denied nc -w2 -z 192.168.10.1 53
|
|
expect_denied curl -4fsS --connect-timeout 2 http://10.98.0.2
|
|
expect_denied curl -4fsS --connect-timeout 2 http://74.67.173.56
|
|
expect_denied curl -4fsS --connect-timeout 2 http://169.254.169.254/latest/meta-data/
|
|
expect_denied curl -6fsS --connect-timeout 2 https://[::1]/
|
|
expect_denied nc -w2 -z 1.1.1.1 25
|
|
expect_denied nc -w2 -z 1.1.1.1 465
|
|
expect_denied nc -w2 -z 1.1.1.1 587
|
|
test "$(ps -e --no-headers | wc -l)" -lt 32
|
|
test -w /dev/fuse
|
|
test -w /dev/net/tun
|
|
grep -q '^nameserver 9\.9\.9\.9$' /etc/resolv.conf
|
|
grep -q '^nameserver 149\.112\.112\.112$' /etc/resolv.conf
|
|
getent ahostsv4 example.com >/dev/null
|
|
test -r /sys/fs/cgroup/cpu.max
|
|
test -r /sys/fs/cgroup/memory.max
|
|
exit "$fail"
|