35 lines
1.5 KiB
Go
35 lines
1.5 KiB
Go
package main
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// novox/hq ADR 0259 §8: who can become root here without a person, as the self-check asks it.
|
|
func TestWhoCanBecomeRootWithoutAPerson(t *testing.T) {
|
|
var calls []call
|
|
run := byLine(map[string]Ran{
|
|
"id -nG ops": {Stdout: "ops wheel\n"},
|
|
"sudo -n -l -U ops": {Stdout: "User ops may run the following commands on anchor:\n (ALL : ALL) NOPASSWD: ALL\n"},
|
|
"id -nG agents": {Stdout: "agents\n"},
|
|
"sudo -n -l -U agents": {Stdout: "User agents is not allowed to run sudo on anchor.\n"},
|
|
"id -nG builder": {Stdout: "builder docker\n"},
|
|
"id -nG careful": {Stdout: "careful wheel\n"},
|
|
"sudo -n -l -U careful": {Stdout: "User careful may run the following commands on anchor:\n (ALL : ALL) ALL\n"},
|
|
"id -nG ghost": {Status: 1, Stderr: "id: 'ghost': no such user"},
|
|
}, &calls)
|
|
got, err := machine(run, 1000).Escalations([]string{"ops", "agents", "builder", "careful", "ghost", "root"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
want := map[string]bool{"ops": true, "agents": false, "builder": true, "careful": false, "ghost": false, "root": true}
|
|
for _, e := range got {
|
|
if e.Root != want[e.Account] || e.Why == "" {
|
|
t.Errorf("%s: root %v (%s), want %v", e.Account, e.Root, e.Why, want[e.Account])
|
|
}
|
|
}
|
|
if _, err := machine(run, 1000).Escalations([]string{"a b"}); err == nil || !strings.Contains(err.Error(), "not an account name") {
|
|
t.Errorf("an account name that is not one was asked: %v", err)
|
|
}
|
|
}
|