jochen
9afea75f93
An agent the operator starts as the agent account through sudo (hq ADR 0266) would otherwise share the operator's terminal and could push keystrokes into their shell after it ends. sudo still runs without a terminal for the mesh's own tools, so nothing they do changes.
66 lines
2.3 KiB
Go
66 lines
2.3 KiB
Go
package main
|
|
|
|
// The module's shape (novox/hq to-be 42 Phase 1, research 027): it declares the sudo package and one
|
|
// drop-in, mode 0440, granting the operator account passwordless escalation — and that drop-in is
|
|
// rendered and checked by visudo here, because a sudoers file that does not parse locks sudo for
|
|
// every account on the machine, the operator's included.
|
|
|
|
import (
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestItDeclaresThePackageAndTheDropInSudoReads(t *testing.T) {
|
|
m := manifest(t)
|
|
if m.Module != "sudo" || m.Version != "1" {
|
|
t.Fatalf("%s %s", m.Module, m.Version)
|
|
}
|
|
if p := m.resource(t, "package"); p["type"] != "package" || p["package"] != "sudo" {
|
|
t.Fatalf("package: %v", p)
|
|
}
|
|
f := m.resource(t, "operator")
|
|
if f["path"] != MeshDropIn || f["mode"] != "0440" || f["into"] != nil || f["owner"] != nil {
|
|
t.Fatalf("the drop-in is root's, whole, 0440: %v", f)
|
|
}
|
|
if !ReadBySudo(filepath.Base(MeshDropIn)) {
|
|
t.Fatal("sudo would skip the drop-in by its name")
|
|
}
|
|
if len(m.Resources) != 2 {
|
|
t.Fatalf("the module declares the package and the drop-in, nothing else: %v", m.Resources)
|
|
}
|
|
}
|
|
|
|
func TestTheDropInGrantsExactlyTheOperatorAccountAndParses(t *testing.T) {
|
|
content := manifest(t).resource(t, "operator")["content"].(string)
|
|
var rules []string
|
|
for _, l := range strings.Split(content, "\n") {
|
|
if l = strings.TrimSpace(l); l != "" && !strings.HasPrefix(l, "#") {
|
|
rules = append(rules, l)
|
|
}
|
|
}
|
|
if len(rules) != 2 || rules[0] != "Defaults use_pty" || rules[1] != "${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL" {
|
|
t.Fatalf("rules: %q", rules)
|
|
}
|
|
if !strings.HasSuffix(content, "\n") {
|
|
t.Fatal("sudo requires the last line to end in a newline")
|
|
}
|
|
visudo, err := exec.LookPath("visudo")
|
|
if err != nil {
|
|
t.Skip("visudo is not installed here; the rendered drop-in is not checked")
|
|
}
|
|
for _, account := range []string{"operator", "ace", "jochen-s"} {
|
|
file := filepath.Join(t.TempDir(), "10-mesh-operator")
|
|
rendered := strings.ReplaceAll(content, "${machine:account}", account)
|
|
if err := os.WriteFile(file, []byte(rendered), 0o440); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := exec.Command(visudo, "-c", "-f", file).CombinedOutput()
|
|
if err != nil || !strings.Contains(string(out), "parsed OK") {
|
|
t.Fatalf("visudo refuses the drop-in rendered for %s: %v\n%s", account, err, out)
|
|
}
|
|
}
|
|
}
|