Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8)

2026-10-09 17:08:17 +02:00
parent c2c75ceb3b
commit debb897c21
20 changed files with 937 additions and 111 deletions
@@ -0,0 +1,34 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq ADR 0259 §8: who can become root here without a person, as the self-check asks it.
+func TestWhoCanBecomeRootWithoutAPerson(t *testing.T) {
+	var calls []call
+	run := byLine(map[string]Ran{
+		"id -nG ops":            {Stdout: "ops wheel\n"},
+		"sudo -n -l -U ops":     {Stdout: "User ops may run the following commands on anchor:\n    (ALL : ALL) NOPASSWD: ALL\n"},
+		"id -nG agents":         {Stdout: "agents\n"},
+		"sudo -n -l -U agents":  {Stdout: "User agents is not allowed to run sudo on anchor.\n"},
+		"id -nG builder":        {Stdout: "builder docker\n"},
+		"id -nG careful":        {Stdout: "careful wheel\n"},
+		"sudo -n -l -U careful": {Stdout: "User careful may run the following commands on anchor:\n    (ALL : ALL) ALL\n"},
+		"id -nG ghost":          {Status: 1, Stderr: "id: 'ghost': no such user"},
+	}, &calls)
+	got, err := machine(run, 1000).Escalations([]string{"ops", "agents", "builder", "careful", "ghost", "root"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]bool{"ops": true, "agents": false, "builder": true, "careful": false, "ghost": false, "root": true}
+	for _, e := range got {
+		if e.Root != want[e.Account] || e.Why == "" {
+			t.Errorf("%s: root %v (%s), want %v", e.Account, e.Root, e.Why, want[e.Account])
+		}
+	}
+	if _, err := machine(run, 1000).Escalations([]string{"a b"}); err == nil || !strings.Contains(err.Error(), "not an account name") {
+		t.Errorf("an account name that is not one was asked: %v", err)
+	}
+}