32 lines
1.6 KiB
Bash
Executable File
32 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# 编译产物必须在空环境、其它工作目录下加载完整模块图与解析沙箱。
|
|
# preflight 缺配置以 2 退出;模块图加载失败以 1 退出。
|
|
set -u
|
|
bin="${1:-dist/umt-server}"
|
|
case "$bin" in /*) ;; *) bin="$PWD/$bin" ;; esac
|
|
[ -x "$bin" ] || { echo "check-compiled-binary: 找不到编译产物 $bin(先跑 bun run build)" >&2; exit 1; }
|
|
out=$(cd /tmp && env -i PATH="$PATH" "$bin" --role preflight 2>&1)
|
|
code=$?
|
|
if [ "$code" -eq 2 ] && printf '%s' "$out" | grep -q '配置无效'; then
|
|
# 正常任务与拒绝策略都必须在空环境、/tmp 下成立。
|
|
sb=$(cd /tmp && printf '{"id":"1","task":"self.test","input":{"mode":"ok"}}\n' | env -i PATH="$PATH" "$bin" --role sandbox 2>&1)
|
|
if ! printf '%s' "$sb" | grep -q '"type":"result"'; then
|
|
echo "check-compiled-binary: 沙箱子进程起不来:$sb" >&2
|
|
exit 1
|
|
fi
|
|
for mode in io async-io write net exec; do
|
|
sb=$(cd /tmp && printf '{"id":"1","task":"self.test","input":{"mode":"%s"}}\n' "$mode" | env -i PATH="$PATH" "$bin" --role sandbox 2>&1)
|
|
# policy.lockdown 已直接核验 socket/openat/execve 返回 EPERM。
|
|
# Bun 编译产物的网络异常可能被归一化成 ECONNREFUSED。
|
|
if ! printf '%s' "$sb" | grep -q '"type":"error"' || ! printf '%s' "$sb" | grep -Eiq 'EPERM|operation not permitted|ECONNREFUSED'; then
|
|
echo "check-compiled-binary: 沙箱没有拒绝 $mode:$sb" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "check-compiled-binary: ok(模块图加载完整,沙箱拒绝文件访问/网络/执行程序)"
|
|
exit 0
|
|
fi
|
|
echo "check-compiled-binary: 编译产物自检失败(退出码 $code):" >&2
|
|
printf '%s\n' "$out" >&2
|
|
exit 1
|