jochen
2410796869
A machine with millions of files never finished the walk within fifteen minutes, so its agent account was never judged and the router refused to link. Only root can make a setuid-root file, so a complete search stays sound until root acts: it now runs at idle priority with no bound, is kept beside the engine's state, judges for rootsearch.FreshFor from its start, runs again daily and after an apply that moves accounts, packages, actions or sudo rules, and an incomplete or stale search is never free.
30 lines
1.3 KiB
Go
30 lines
1.3 KiB
Go
package apply
|
|
|
|
import "testing"
|
|
|
|
// An apply that moved what root controls asks for a new search for setuid programs (novox/hq issue 361); one
|
|
// that moved nothing of it does not.
|
|
func TestAnApplyMovesRootThroughAnAccountAPackageAnActionOrSudosRules(t *testing.T) {
|
|
for _, c := range []struct {
|
|
o Outcome
|
|
want bool
|
|
}{
|
|
{Outcome{Type: "user", Target: "nox", Action: "created"}, true},
|
|
{Outcome{Type: "user", Target: "nox", Action: "unchanged"}, false},
|
|
{Outcome{Type: "package", Target: "telegram", Action: "created"}, true},
|
|
{Outcome{Type: "package", Target: "telegram", Action: "removed"}, true},
|
|
{Outcome{Type: "action", Target: "setup", Action: "updated"}, true},
|
|
{Outcome{Type: "file", Target: "/etc/sudoers.d/mesh", Action: "updated"}, true},
|
|
{Outcome{Type: "file", Target: "/etc/group", Action: "corrected"}, true},
|
|
{Outcome{Type: "directory", Target: "/etc/polkit-1/rules.d", Action: "created"}, true},
|
|
{Outcome{Type: "file", Target: "/etc/sudoers.dx", Action: "updated"}, false},
|
|
{Outcome{Type: "file", Target: "/etc/nginx/nginx.conf", Action: "updated"}, false},
|
|
{Outcome{Type: "container", Target: "plex", Action: "updated"}, false},
|
|
{Outcome{Type: "package", Target: "x", Action: heldStill}, false},
|
|
} {
|
|
if got := MovesRoot([]Outcome{c.o}); got != c.want {
|
|
t.Errorf("%+v: moves root %v, want %v", c.o, got, c.want)
|
|
}
|
|
}
|
|
}
|