jochen
994cab533b
mesh/merge-gate pass: builds new: modules/mesh-reads, sent nowhere; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
mesh/delivery delivered
Reading a file, searching one, listing a directory, the owner and mode of each component of a path and looking up an account went through the login shell's execute as the operator's account, which sees the operator's keys and the agent's credentials. This module holds node-reads on every node and runs as mesh-reads (no login, no group beside its own). It refuses the node's secret places by name, judging the file actually opened rather than the name asked, so a flipped link reaches nothing refused; withholds any line shaped like a secret through mesh-sdk's outward rule and every line of a BEGIN/END block; and bounds every answer. Replaces mesh-catalog #244 (reviews 55), whose first commit carried a built binary.
60 lines
1.7 KiB
Go
60 lines
1.7 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// ADR 0310 §3: the account the reads run as is the module's own, made by the mesh, with no login shell, no
|
|
// home of the operator's and no group beside its own, and the module runs as it.
|
|
func TestTheAccountHoldsNoSecretsGroupAndNoLogin(t *testing.T) {
|
|
raw, err := os.ReadFile("../../module.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var m struct {
|
|
RunsAs string `json:"runs-as"`
|
|
SecretsOwner string `json:"secrets-owner"`
|
|
Claims []map[string]any `json:"claims"`
|
|
Resources []map[string]any `json:"resources"`
|
|
}
|
|
if err := json.Unmarshal(raw, &m); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if m.RunsAs != "mesh-reads" || m.SecretsOwner != "mesh-reads" {
|
|
t.Errorf("runs as %q, secrets owned by %q", m.RunsAs, m.SecretsOwner)
|
|
}
|
|
if len(m.Claims) != 1 || m.Claims[0]["name"] != Seat {
|
|
t.Errorf("claims %v", m.Claims)
|
|
}
|
|
found := false
|
|
for _, r := range m.Resources {
|
|
if r["type"] != "user" {
|
|
continue
|
|
}
|
|
found = true
|
|
if r["name"] != m.RunsAs {
|
|
t.Errorf("a user other than its own: %v", r)
|
|
}
|
|
if r["shell"] != "/usr/bin/nologin" {
|
|
t.Errorf("the account has a login shell: %v", r["shell"])
|
|
}
|
|
if home, _ := r["home"].(string); !strings.HasPrefix(home, "/var/lib/") {
|
|
t.Errorf("the account's home is %q, not one of the mesh's", home)
|
|
}
|
|
if _, grouped := r["groups"]; grouped {
|
|
t.Errorf("the account is put in groups: %v", r["groups"])
|
|
}
|
|
}
|
|
if !found {
|
|
t.Error("the module makes no account of its own")
|
|
}
|
|
for _, r := range m.Resources {
|
|
if r["type"] != "user" && r["type"] != "directory" {
|
|
t.Errorf("a read-only holder declares a %v: %v", r["type"], r)
|
|
}
|
|
}
|
|
}
|