Download this file
| 1 | package caps |
| 2 | |
| 3 | import ( |
| 4 | "errors" |
| 5 | "os" |
| 6 | "testing" |
| 7 | ) |
| 8 | |
| 9 | func TestPlan14CapabilityMutationAuthorization(t *testing.T) { |
| 10 | for _, operation := range []string{"converge", "restore", "restart"} { |
| 11 | t.Run(operation, func(t *testing.T) { |
| 12 | o, sys, _, users := testOps(t) |
| 13 | p := keymailPlan(t, Grants{Ports: map[int]bool{25: true}}) |
| 14 | if _, err := Converge(o, p); err != nil { |
| 15 | t.Fatal(err) |
| 16 | } |
| 17 | service, socket := DropInPaths(o.EtcDir, p.Host) |
| 18 | beforeService, beforeSocket := string(readFile(t, service)), string(readFile(t, socket)) |
| 19 | sys.reset() |
| 20 | *users = nil |
| 21 | calls := 0 |
| 22 | o.Authorize = func() error { calls++; return os.ErrPermission } |
| 23 | var err error |
| 24 | switch operation { |
| 25 | case "converge": |
| 26 | p.Grants = Grants{} |
| 27 | _, err = Converge(o, p) |
| 28 | case "restore": |
| 29 | err = Restore(o, Snapshot{Host: p.Host}) |
| 30 | case "restart": |
| 31 | err = Restart(o, p) |
| 32 | } |
| 33 | if !errors.Is(err, os.ErrPermission) || calls != 1 || len(sys.calls) != 0 || len(*users) != 0 { |
| 34 | t.Fatal("unauthorized operation", err, calls, sys.calls, *users) |
| 35 | } |
| 36 | if string(readFile(t, service)) != beforeService || string(readFile(t, socket)) != beforeSocket { |
| 37 | t.Fatal("refusal changed files") |
| 38 | } |
| 39 | }) |
| 40 | } |
| 41 | } |
| 42 | |
amadan