jochen
07164e40f3
A directory the engine used as found kept its owner and mode in silence, so a module that cannot write it would just fail (hq issue 339 review). Each one is now a WARNING in every apply's log and its module's resource of kind directory, stated unhealthy on every look with its owner and what was declared, which the controller raises as the module's condition; `mesh-host hand-over <dir>` at the machine hands it to the mesh, and the next apply gives it the declared owner and mode. The guard also refuses the spool, /opt, the container runtimes' data (its configured data-root too), and an account's .ssh as an access, a mount, or a directory anywhere but its own home.
37 lines
1.2 KiB
Go
37 lines
1.2 KiB
Go
package apply
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
// An account's .ssh below its own home, as that account's, is still placed (the ssh-client module's); as an
|
|
// access or a mount it is refused there too (novox/hq issue 339).
|
|
func TestAnAccountsOwnSSHIsPlacedAndNeverMounted(t *testing.T) {
|
|
dir := t.TempDir()
|
|
home := filepath.Join(dir, "home", "alice")
|
|
passwd := filepath.Join(dir, "passwd")
|
|
if err := os.WriteFile(passwd, fmt.Appendf(nil, "alice:x:4242:4242::%s:/bin/sh\n", home), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
before := passwdFile
|
|
passwdFile = passwd
|
|
t.Cleanup(func() { passwdFile = before })
|
|
if err := refusePath(home+"/.ssh", placingDirectory, "ssh-client", "alice"); err != nil {
|
|
t.Fatalf("alice's own .ssh: %v", err)
|
|
}
|
|
if err := refusePath(home+"/.ssh/config.d", placingDirectory, "ssh-client", "alice"); err != nil {
|
|
t.Fatalf("alice's own .ssh/config.d: %v", err)
|
|
}
|
|
for _, kind := range []placing{placingAccess, placingMount} {
|
|
if err := refusePath(home+"/.ssh", kind, "notes", ""); err == nil {
|
|
t.Errorf("%v of alice's .ssh was taken", kind)
|
|
}
|
|
}
|
|
if err := refusePath(home+"/.ssh", placingDirectory, "notes", "4243"); err == nil {
|
|
t.Error("another account's directory at alice's .ssh was taken")
|
|
}
|
|
}
|