jschoubben
2cffa33bcc
A root in the group with setgid was kept without a warrant even when the data beneath it was not in the group, which §7 says the operator is asked about. A root is now kept without asking only when it is empty, or it and a bounded sample beneath it are all in the group with group write (and setgid on folders). On busybox, an account the mesh made is given its added groups with addgroup and delgroup; a change of its primary group is refused, saying why.
39 lines
1.4 KiB
Go
39 lines
1.4 KiB
Go
package system
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// busybox has no usermod (novox/hq ADR 0328 §4): an account the mesh made is given its added groups with addgroup
|
|
// and delgroup, and a change of its primary group is refused, saying why.
|
|
func TestBusyboxGivesAnAccountItsAddedGroupsAndRefusesAnotherPrimary(t *testing.T) {
|
|
var ran []string
|
|
run := func(_ context.Context, name string, args ...string) (string, error) {
|
|
ran = append(ran, name+" "+strings.Join(args, " "))
|
|
switch {
|
|
case name == "getent" && args[0] == "passwd":
|
|
return "mesh-radarr:x:61001:62000::/:/sbin/nologin\n", nil
|
|
case name == "getent" && args[0] == "group":
|
|
return "mesh-media:x:62000:\n", nil
|
|
case name == "id":
|
|
return "mesh-media mesh-old\n", nil
|
|
}
|
|
return "", nil
|
|
}
|
|
if err := (alpine{}).ModifyAccount(context.Background(), run, "mesh-radarr", 62000, []string{"mesh-books"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got := strings.Join(ran, "\n")
|
|
if !strings.Contains(got, "addgroup mesh-radarr mesh-books") || !strings.Contains(got, "delgroup mesh-radarr mesh-old") ||
|
|
strings.Contains(got, "delgroup mesh-radarr mesh-media") {
|
|
t.Fatalf("not given exactly its added groups:\n%s", got)
|
|
}
|
|
err := (alpine{}).ModifyAccount(context.Background(), run, "mesh-radarr", 62005, nil)
|
|
if !errors.Is(err, ErrUnsupported) || !strings.Contains(err.Error(), "primary group") {
|
|
t.Fatalf("a change of primary group was not refused saying why: %v", err)
|
|
}
|
|
}
|