Add interactive NetBox host installer

host_agent/tests/test_executor.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import os
+import stat
 import tempfile
 import unittest
 from pathlib import Path
@@ -56,6 +58,8 @@ class ExecutorTests(unittest.TestCase):
         self.assertEqual(runner.commands, [])
         self.assertIsNone(journal.get_managed_plugin("demo-plugin"))
         self.assertFalse(config.paths.include_path.exists())
+        if os.name == "posix":
+            self.assertEqual(stat.S_IMODE(config.paths.temp_dir.stat().st_mode), 0o711)
 
     def test_install_is_disabled_and_uses_fixed_pip_argv(self) -> None:
         config = make_config(self.root, dry_run=False)

host_agent/tests/test_systemd_units.py

@@ -0,0 +1,22 @@
+import unittest
+from pathlib import Path
+
+
+class SystemdUnitTests(unittest.TestCase):
+    def test_socket_directory_is_traversable_but_socket_remains_restricted(self):
+        socket_unit = Path("systemd/netbox-store-agent.socket").read_text(encoding="utf-8")
+
+        self.assertIn("DirectoryMode=0755", socket_unit)
+        self.assertIn("SocketMode=0660", socket_unit)
+        self.assertIn("SocketGroup=netbox", socket_unit)
+
+    def test_state_traversal_does_not_relax_service_umask(self):
+        service_unit = Path("systemd/netbox-store-agent.service").read_text(encoding="utf-8")
+
+        self.assertIn("StateDirectoryMode=0711", service_unit)
+        self.assertIn("RuntimeDirectoryMode=0755", service_unit)
+        self.assertIn("UMask=0077", service_unit)
+
+
+if __name__ == "__main__":
+    unittest.main()