jochen
e2e8be72fa
Issue 339's guard (#63/#64/#65) now refuses the machine's own trees, another account's directory below a home, and uses a found directory as found; this branch's own copy of those rules goes. What stays is the one rule only an account that never becomes root needs: below its home it owns every parent and could swap a link in between the engine's check and an unpack or a write-into (hq ADR 0266 §7). One reader of the user database serves both.
37 lines
1.9 KiB
Go
37 lines
1.9 KiB
Go
package apply
|
|
|
|
// Defends novox/hq ADR 0266 §7: no archive is unpacked and no file is written into below the home of an account
|
|
// the declaration says never becomes root; a whole file there still passes.
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-host/internal/declaration"
|
|
)
|
|
|
|
func TestNothingIsUnpackedOrWrittenIntoBelowAnAgentsHome(t *testing.T) {
|
|
was := accountsOfHomes
|
|
accountsOfHomes = func() map[string]homeAccount {
|
|
return map[string]homeAccount{"/home/agent": {"agent", 1001}, "/home/operator": {"operator", 1000}}
|
|
}
|
|
t.Cleanup(func() { accountsOfHomes = was })
|
|
agent := []string{"/home/agent"}
|
|
if err := refuseUnderAgentHome(&declaration.Archive{ID: "a.x", Type: declaration.TypeArchive, Path: "/home/agent/.local/x", Owner: "agent"}, agent); err == nil {
|
|
t.Error("an archive below an agent's home is refused")
|
|
}
|
|
if err := refuseUnderAgentHome(&declaration.File{ID: "a.f", Type: declaration.TypeFile, Path: "/home/agent/.claude.json", Owner: "agent", Into: "json", Content: "{}"}, agent); err == nil {
|
|
t.Error("a file written into below an agent's home is refused")
|
|
}
|
|
if err := refuseUnderAgentHome(&declaration.File{ID: "a.f", Type: declaration.TypeFile, Path: "/home/agent/x", Owner: "agent", Content: "x"}, agent); err != nil {
|
|
t.Errorf("a whole file there passes: %v", err)
|
|
}
|
|
if err := refuseUnderAgentHome(&declaration.Archive{ID: "a.x", Type: declaration.TypeArchive, Path: "/home/operator/x", Owner: "operator"}, agent); err != nil {
|
|
t.Errorf("an archive in a home whose account may become root is placement_guard.go's to judge, not this: %v", err)
|
|
}
|
|
d := parse(t, `{"declaration":1,"resources":[{"id":"c.agent","type":"user","name":"agent","root":"never"},`+
|
|
`{"id":"c.op","type":"user","name":"operator"}]}`)
|
|
if got := rootNeverHomes(d); len(got) != 1 || got[0] != "/home/agent" {
|
|
t.Errorf("the agent's home is known by the user database: %v", got)
|
|
}
|
|
}
|