mirror of
https://github.com/troglobit/finit.git
synced 2026-10-08 16:34:45 +07:00
Aaron Andersen
be2a0ec3e7
Implement Linux capability support for services, allowing them to run with minimal required privileges instead of running as root. This uses the modern IAB (Inheritable, Ambient, Bounding) API from libcap.
79 lines
2.4 KiB
YAML
79 lines
2.4 KiB
YAML
name: Bob the Builder
|
|
|
|
# Run on all branches, including all pull requests, except the 'dev'
|
|
# branch since that's where we run Coverity Scan (limited tokens/day)
|
|
on:
|
|
push:
|
|
branches:
|
|
- '**'
|
|
- '!dev'
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, labeled]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
# Verify we can build on latest Ubuntu with both gcc and clang
|
|
name: ${{ matrix.compiler }}
|
|
runs-on: ubuntu-latest
|
|
# Skip redundant builds for PRs - prefer PR builds over push builds
|
|
if: github.event_name != 'push' || github.ref == 'refs/heads/master'
|
|
strategy:
|
|
matrix:
|
|
compiler: [gcc, clang]
|
|
fail-fast: false
|
|
env:
|
|
CC: ${{ matrix.compiler }}
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get -y update
|
|
sudo apt-get -y install pkg-config tree jq libuev-dev libite-dev libcap-dev
|
|
- uses: actions/checkout@v4
|
|
- name: Static Finit
|
|
run: |
|
|
./autogen.sh
|
|
./configure --prefix= --enable-static
|
|
make -j3 V=1
|
|
- name: Regular Finit
|
|
run: |
|
|
./configure --prefix=/usr --exec-prefix= --sysconfdir=/etc --localstatedir=/var \
|
|
--enable-x11-common-plugin --enable-testserv-plugin --with-watchdog \
|
|
--with-keventd --with-libsystemd \
|
|
CFLAGS="-fsanitize=address -ggdb"
|
|
make -j3 clean
|
|
make -j3 V=1
|
|
- name: Install to /tmp
|
|
run: |
|
|
DESTDIR=/tmp make install-strip
|
|
tree /tmp || true
|
|
- name: Check dependencies
|
|
run: |
|
|
ldd /tmp/sbin/finit
|
|
size /tmp/sbin/finit
|
|
ldd /tmp/sbin/initctl
|
|
size /tmp/sbin/initctl
|
|
ldd /tmp/sbin/reboot
|
|
size /tmp/sbin/reboot
|
|
- name: Verify starting and showing usage text
|
|
run: |
|
|
sudo /tmp/sbin/finit -h
|
|
sudo /tmp/sbin/initctl -h
|
|
- name: Enable unprivileged userns (unshare)
|
|
run: |
|
|
sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
|
|
- name: Run Unit Tests
|
|
run: |
|
|
make check || (cat test/test-suite.log; false)
|
|
- name: Upload Test Results
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: finit-test-${{ matrix.compiler }}
|
|
path: test/*.log
|