73 lines
3.4 KiB
Bash
Executable File
73 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Test-image-only stage-2 child. It never ships in the normal rootfs or opens hardware.
|
|
set -euo pipefail
|
|
exec >/dev/console 2>&1
|
|
trap 'printf "FDS_M2_FAIL: guest check failed at line %s\n" "$LINENO"; /usr/bin/poweroff' ERR
|
|
|
|
[[ $(readlink /proc/1/exe) == /usr/bin/s6-svscan ]]
|
|
printf 'FDS_M2_PID1: %s\n' "$(readlink /proc/1/exe)"
|
|
[[ $(findmnt -n -o FSTYPE /) == "${FDS_TEST_ROOT_TYPE:-ext4}" ]]
|
|
findmnt -n -o OPTIONS / | grep -qw ro
|
|
if touch /etc/fds-unexpected-write 2>/dev/null; then
|
|
printf 'ERROR: the root filesystem unexpectedly accepted a write\n'
|
|
false
|
|
fi
|
|
for mount in /run /tmp /var/tmp /var/log; do
|
|
[[ $(findmnt -n -o FSTYPE "$mount") == tmpfs ]]
|
|
done
|
|
[[ $(hostname) == fds ]]
|
|
[[ $(stat -c %u:%g:%a /) == 0:0:755 ]]
|
|
[[ $(stat -c %u /etc/shadow) == 0 && $(stat -c %a /etc/shadow) == 600 ]]
|
|
getcap /usr/bin/iputils-ping | grep -q cap_net_raw
|
|
[[ $(stat -c %g /usr/lib/utempter/utempter) == 14 ]]
|
|
ip -o link show dev lo | grep -q UP
|
|
printf 'FDS_M2_FILESYSTEM: read-only root, writable tmpfs, root ownership and capabilities\n'
|
|
|
|
# Wait on s6 readiness/events, not elapsed time or a boot-time compiler.
|
|
s6-svwait -U -t 15000 /run/service/eudevd
|
|
udevadm control --timeout=2 --log-priority=info
|
|
s6-svstat /run/service/getty
|
|
s6-svstat /run/service/dasungd
|
|
s6-svwait -U -t 15000 /run/service/cartridged
|
|
fds bays | grep -q "BAY 12"
|
|
if [[ $(cat /usr/share/fds/image-profile) != recovery ]]; then
|
|
if fds recovery check 2 >/tmp/recovery-rejection 2>&1; then
|
|
printf 'ERROR: normal SYSTEM accepted a privileged recovery operation\n'
|
|
false
|
|
fi
|
|
grep -q 'requires the local root console in the recovery image' /tmp/recovery-rejection
|
|
printf 'FDS_M12_RECOVERY_BOUNDARY: normal SYSTEM rejects recovery operations even for root\n'
|
|
fi
|
|
[[ $(s6-svstat -o up /run/service/getty) == true ]]
|
|
[[ $(s6-svstat -o up /run/service/dasungd) == true ]]
|
|
# Getty has now been verified. Stop it before reporting the remaining checks:
|
|
# its shutdown hangup can flush queued console output, including the final marker.
|
|
s6-rc -l /run/s6-rc -t 5000 -d change getty
|
|
exec >/dev/console 2>&1
|
|
printf 'FDS_M2_BOOT: getty, eudev and Dasung supervised without a monitor\n'
|
|
|
|
# The original rc.init completed the boot transaction before invoking this child.
|
|
[[ $(s6-svstat -o up /run/service/test-echo) == false ]]
|
|
s6-rc -l /run/s6-rc -t 10000 -u change test-echo
|
|
[[ $(s6-svstat -o up,ready /run/service/test-echo) == 'true true' ]]
|
|
response=$(printf 'FDS echo roundtrip\n' | s6-ipcclient /run/fds-test/echo.sock s6-ioconnect -t 3000)
|
|
[[ $response == 'FDS echo roundtrip' ]]
|
|
old_pid=$(s6-svstat -o pid /run/service/test-echo)
|
|
s6-svc -wR -T 5000 -r /run/service/test-echo
|
|
new_pid=$(s6-svstat -o pid /run/service/test-echo)
|
|
[[ $new_pid != "$old_pid" ]]
|
|
s6-rc -l /run/s6-rc -t 5000 -d change test-echo
|
|
[[ $(s6-svstat -o up /run/service/test-echo) == false ]]
|
|
s6-rc -l /run/s6-rc -t 5000 -u change test-echo
|
|
[[ $(s6-svstat -o up,ready /run/service/test-echo) == 'true true' ]]
|
|
s6-rc -l /run/s6-rc -t 5000 -d change test-echo
|
|
printf 'FDS_M2_SERVICE: s6-rc start, echo, supervised restart, stop and start passed\n'
|
|
printf 'FDS_M2_PASS\n'
|
|
if grep -qw 'fds.vm_shell=1' /proc/cmdline; then
|
|
s6-rc -l /run/s6-rc -t 5000 -d change getty
|
|
printf '\nFDS development VM: temporary root shell; no network or host devices.\n'
|
|
printf 'Use s6-rc to control test-echo. Type exit to power off this VM.\n'
|
|
setsid --ctty /bin/bash --login </dev/console >/dev/console 2>&1
|
|
fi
|
|
/usr/bin/poweroff
|