From 5b1515c6f3b14abf161bbb933ed735efcaa12ca4 Mon Sep 17 00:00:00 2001 From: mesh-tools Date: Fri, 16 Oct 2026 08:06:39 +0000 Subject: [PATCH] Make nftables' escalation test independent of who runs it: an explicit non-root uid, and the default checked against the process's own (issue 877) --- modules/nftables/test/remove.test.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/nftables/test/remove.test.ts b/modules/nftables/test/remove.test.ts index 8c705c95..17003d2f 100644 --- a/modules/nftables/test/remove.test.ts +++ b/modules/nftables/test/remove.test.ts @@ -77,7 +77,15 @@ test("which chains jump to a target is read from a listing", () => { test("the filter's commands run as given by root and through sudo without a prompt by anyone else", () => { assert.deepEqual(escalated("nft", ["list", "ruleset"], 0), ["nft", ["list", "ruleset"]]); assert.deepEqual(escalated("nft", ["-f", "/etc/nftables.conf"], 1000), ["sudo", ["-n", "nft", "-f", "/etc/nftables.conf"]]); - assert.deepEqual(escalated("iptables-legacy", ["-S"], undefined), ["sudo", ["-n", "iptables-legacy", "-S"]]); + assert.deepEqual(escalated("iptables-legacy", ["-S"], 1000), ["sudo", ["-n", "iptables-legacy", "-S"]]); +}); + +test("without a uid given, the process's own decides: as given for root, through sudo for anyone else", () => { + // Whoever runs the check: the default is the uid this process has, so the expectation is derived from it. + const own = process.getuid?.(); + const want: [string, string[]] = own === 0 ? ["iptables-legacy", ["-S"]] : ["sudo", ["-n", "iptables-legacy", "-S"]]; + assert.deepEqual(escalated("iptables-legacy", ["-S"]), want); + assert.deepEqual(escalated("iptables-legacy", ["-S"], undefined), want); }); test("the filter file is the one the manifest's filtering names", () => {