85 lines
3.0 KiB
Python
85 lines
3.0 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "import_controller_bootstrap.py"
|
|
SPEC = importlib.util.spec_from_file_location("controller_bootstrap_import_host", SCRIPT)
|
|
assert SPEC is not None and SPEC.loader is not None
|
|
host_import = importlib.util.module_from_spec(SPEC)
|
|
SPEC.loader.exec_module(host_import)
|
|
|
|
|
|
def test_reads_root_private_bootstrap_without_newline(tmp_path, monkeypatch):
|
|
path = tmp_path / "bootstrap"
|
|
path.write_bytes(b"x" * 64 + b"\n")
|
|
path.chmod(0o600)
|
|
monkeypatch.setattr(host_import.os, "geteuid", lambda: 0, raising=False)
|
|
assert host_import.read_bootstrap(path) == b"x" * 64
|
|
path.write_bytes(b"short\n")
|
|
with pytest.raises(ValueError):
|
|
host_import.read_bootstrap(path)
|
|
|
|
|
|
def test_bootstrap_passes_only_on_stdin(monkeypatch):
|
|
observed = {}
|
|
|
|
def fake_run(argv, *, input, capture_output, check, timeout):
|
|
observed.update({"argv": argv, "input": input, "capture_output": capture_output})
|
|
|
|
class Result:
|
|
returncode = 0
|
|
stdout = json.dumps({"status": "imported", "secretRef": "ENROLLMENT_BOOTSTRAP"}).encode()
|
|
|
|
return Result()
|
|
|
|
monkeypatch.setattr(host_import.subprocess, "run", fake_run)
|
|
assert host_import.import_bootstrap(b"sensitive-test-value") == "imported"
|
|
assert observed["input"] == b"sensitive-test-value"
|
|
assert "sensitive-test-value" not in " ".join(observed["argv"])
|
|
assert observed["capture_output"] is True
|
|
|
|
|
|
@pytest.mark.skipif(os.name == "nt", reason="POSIX metadata and symlinks")
|
|
def test_bootstrap_import_rejects_symlinks_and_multiple_links(tmp_path, monkeypatch):
|
|
monkeypatch.setattr(host_import.os, "geteuid", lambda: 0)
|
|
secret = tmp_path / "bootstrap"
|
|
secret.write_bytes(b"x" * 64)
|
|
secret.chmod(0o600)
|
|
link = tmp_path / "link"
|
|
link.symlink_to(secret)
|
|
with pytest.raises(ValueError):
|
|
host_import.read_bootstrap(link)
|
|
link.unlink()
|
|
os.link(secret, link)
|
|
with pytest.raises(ValueError):
|
|
host_import.read_bootstrap(secret)
|
|
|
|
|
|
def test_host_import_uses_protected_volume_configuration():
|
|
assert host_import.BOOTSTRAP_FILE.as_posix() == (
|
|
"/var/lib/docker/volumes/itworx-controller-hub-releases/_data/controller-config/"
|
|
"appops-enrollment-bootstrap"
|
|
)
|
|
|
|
|
|
@pytest.mark.skipif(os.name == "nt", reason="POSIX mode checks")
|
|
def test_bootstrap_import_rechecks_private_mode_after_open(tmp_path, monkeypatch):
|
|
secret = tmp_path / "bootstrap"
|
|
secret.write_bytes(b"x" * 64)
|
|
secret.chmod(0o600)
|
|
monkeypatch.setattr(host_import.os, "geteuid", lambda: 0)
|
|
original_open = host_import.os.open
|
|
|
|
def change_mode_before_open(path, flags):
|
|
secret.chmod(0o644)
|
|
return original_open(path, flags)
|
|
|
|
monkeypatch.setattr(host_import.os, "open", change_mode_before_open)
|
|
with pytest.raises(ValueError, match="changed while opening"):
|
|
host_import.read_bootstrap(secret)
|