diff --git a/internal/apply/placement_homes_test.go b/internal/apply/placement_homes_test.go index 39c53e2..6d924f9 100644 --- a/internal/apply/placement_homes_test.go +++ b/internal/apply/placement_homes_test.go @@ -20,10 +20,11 @@ func TestBelowAHomeOnlyThatAccountsDirectoryIsPlaced(t *testing.T) { if err := os.MkdirAll(home, 0o755); err != nil { t.Fatal(err) } - me := os.Getuid() + // A uid of its own, never the test's: the build seat runs tests as root, and root's home is no person's. + const alice = 4242 passwd := filepath.Join(dir, "passwd") if err := os.WriteFile(passwd, fmt.Appendf(nil, "root:x:0:0::/root:/bin/sh\nalice:x:%d:%d::%s:/bin/sh\n", - me, os.Getgid(), home), 0o644); err != nil { + alice, alice, home), 0o644); err != nil { t.Fatal(err) } before := passwdFile @@ -33,14 +34,13 @@ func TestBelowAHomeOnlyThatAccountsDirectoryIsPlaced(t *testing.T) { _, _, err := applyOnce(t, `{"id":"notes.data","type":"directory","path":"`+home+`/.config/autostart"}`, nil, store.State{}) refusedFor339(t, "root's directory below alice's home", err) _, _, err = applyOnce(t, `{"id":"notes.data","type":"directory","path":"`+home+`/.config/autostart",`+ - `"owner":"`+strconv.Itoa(me+1)+`"}`, nil, store.State{}) + `"owner":"`+strconv.Itoa(alice+1)+`"}`, nil, store.State{}) refusedFor339(t, "another account's directory below alice's home", err) if _, err := os.Stat(filepath.Join(home, ".config")); err == nil { t.Fatal("a refused directory's parent was made") } - // Alice's own is placed. - if _, _, err := applyOnce(t, `{"id":"notes.data","type":"directory","path":"`+home+`/.config/notes",`+ - `"owner":"`+strconv.Itoa(me)+":"+strconv.Itoa(os.Getgid())+`"}`, nil, store.State{}); err != nil { + // Alice's own is placed (judged, not applied: a chown to her needs root). + if err := refusePath(home+"/.config/notes", placingDirectory, "notes", strconv.Itoa(alice)+":"+strconv.Itoa(alice)); err != nil { t.Fatalf("alice's own directory: %v", err) } // A container mounting a refused directory is refused with it, and not run.