verify-systemd.sh (1421B)
1 #!/bin/sh 2 set -eu 3 4 repository_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P) 5 cd "$repository_root" 6 7 if [ "$(uname -s)" != Linux ]; then 8 echo "systemd_qualification_unavailable: Linux is required" >&2 9 exit 1 10 fi 11 if ! command -v systemd-analyze >/dev/null 2>&1; then 12 echo "systemd_qualification_unavailable: systemd-analyze is required" >&2 13 exit 1 14 fi 15 16 systemd_major=$(systemd-analyze --version | awk 'NR == 1 { print $2 }') 17 case "$systemd_major" in 18 ''|*[!0-9]*) 19 echo "systemd_qualification_invalid: cannot determine systemd version" >&2 20 exit 1 21 ;; 22 esac 23 if [ "$systemd_major" -lt 252 ]; then 24 echo "systemd_qualification_invalid: systemd 252 or newer is required" >&2 25 exit 1 26 fi 27 28 temporary_directory=$(mktemp -d "${TMPDIR:-/tmp}/rhi-systemd.XXXXXX") 29 cleanup() { 30 rm -rf -- "$temporary_directory" 31 } 32 trap cleanup EXIT HUP INT TERM 33 34 sed 's|^ExecStart=/usr/bin/rhi --profile service-host --instance %i run$|ExecStart=/bin/true|' \ 35 packaging/systemd/rhi@.service >"$temporary_directory/rhi@.service" 36 if [ "$(grep -c '^ExecStart=/bin/true$' "$temporary_directory/rhi@.service")" -ne 1 ]; then 37 echo "systemd_qualification_invalid: exact ExecStart was not admitted" >&2 38 exit 1 39 fi 40 41 systemd-analyze verify "$temporary_directory/rhi@.service" 42 systemd-analyze security --offline=yes --threshold=30 --no-pager \ 43 "$temporary_directory/rhi@.service" >/dev/null 44 45 echo "systemd qualification ok: rhi"