diff options
Diffstat (limited to 'tests/drop-privileges')
| -rw-r--r-- | tests/drop-privileges | 33 |
1 files changed, 24 insertions, 9 deletions
diff --git a/tests/drop-privileges b/tests/drop-privileges index 0596e31..3589ee3 100644 --- a/tests/drop-privileges +++ b/tests/drop-privileges @@ -1,6 +1,17 @@ # Check privilige drop: UID/GID changes, chdir, environment, and file # descriptors +# ensure failure to drop privileges doesn't retain root privileges +sed -ri 's/^#(user|group)\s*=\s*$/\1 = nonexistent-\1/' /etc/lacme/lacme.conf +! lacme account 2>"$STDERR" || fail +grepstderr -Fxq "getgrnam(nonexistent-group)" +grepstderr -Fxq "Error: Invalid client version" + +sed -ri 's/^group\s*=\s*nonexistent.*/#&/' /etc/lacme/lacme.conf +! lacme account 2>"$STDERR" || fail +grepstderr -Fxq "getpwnam(nonexistent-user)" +grepstderr -Fxq "Error: Invalid client version" + # create wrapper to inspect processes STATUSDIR="/dev/shm/lacme-wrap" install -oroot -groot -m0755 /dev/stdin /run/lacme-wrap <<-EOF @@ -24,8 +35,7 @@ adduser --system --group \ --home /nonexistent --no-create-home \ --gecos "lacme account user" \ --quiet lacme-account -sed -ri 's|^#user\s*=\s*$|user = lacme-account|' /etc/lacme/lacme.conf -sed -ri 's|^#group\s*=\s*$|group = lacme-account|' /etc/lacme/lacme.conf +sed -ri 's/^#?(user|group)\s*=\s*nonexistent.*/\1 = lacme-account/' /etc/lacme/lacme.conf chown lacme-account: /etc/lacme/account.key install -oroot -groot -dm0755 -- "$STATUSDIR" @@ -71,7 +81,8 @@ check_accountd() { USER=lacme-account EOF - stderr="$(readlink -e "/proc/$$/fd/2")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stderr" || return -1 socket_ino="$(sed -rn '/^0 .* socket:\[([0-9]+)\]$/ {s//\1/p;q}' "$prefix/fd")" [ -n "$socket_ino" ] || return 1 grep -Fxq "0 0700 $UID:$GID socket:[$socket_ino]" "$prefix/fd" || return 1 @@ -96,8 +107,10 @@ check_client() { USER=_lacme-client EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 if [ "$command" = "account" ]; then # no pipe grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 @@ -113,8 +126,8 @@ check_client() { grep -Exq "[0-9]+ 0700 $UID:$GID socket:\[[0-9]+\]" "$prefix/fd" || return 1 sed -ri '0,\#^[0-9]+ .* socket:\[[0-9]+\]$# {//d}' "$prefix/fd" - grep -Exq "[0-9]+ 0500 $UID:$GID /etc/lacme/lacme\.conf" "$prefix/fd" || return 1 - sed -ri '0,\#^[0-9]+ .* /etc/lacme/lacme\.conf$# {//d}' "$prefix/fd" + grep -Eq "^[0-9]+ 0500 $UID:$GID /tmp/lacme-client.conf\.json-" "$prefix/fd" || return 1 + sed -ri '0,\#^[0-9]+ .* /tmp/lacme-client.conf\.json-# {//d}' "$prefix/fd" ! test -s "$prefix/fd" || return 1 } check_webserver() { @@ -133,8 +146,10 @@ check_webserver() { USER=_lacme-www EOF - stdout="$(readlink -e "/proc/$$/fd/1")" - stderr="$(readlink -e "/proc/$$/fd/2")" + stdout="$(readlink -f "/proc/$$/fd/1")" + stderr="$(readlink -f "/proc/$$/fd/2")" + test -n "$stdout" || return -1 + test -n "$stderr" || return -1 grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1 grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1 grep -Fxq "2 0700 $UID:$GID $stderr" "$prefix/fd" || return 1 |