| 1 | //go:build linux && rootrunner |
| 2 | |
| 3 | package host |
| 4 | |
| 5 | import ( |
| 6 | "crypto/ed25519" |
| 7 | "encoding/base64" |
| 8 | "encoding/json" |
| 9 | "github.com/carlosframework/platform/internal/hostfloor" |
| 10 | "os" |
| 11 | "os/exec" |
| 12 | "path/filepath" |
| 13 | "strings" |
| 14 | "syscall" |
| 15 | "testing" |
| 16 | ) |
| 17 | |
| 18 | func TestPlan14GuardExecEdgeRootRunner(t *testing.T) { |
| 19 | if os.Getenv("PLAN14_P3_EDGE_CHILD") == "1" { |
| 20 | RunSystemGuardExec([]string{"edge"}) |
| 21 | t.Fatal("exec returned") |
| 22 | } |
| 23 | if err := os.Mkdir("/var/lib/carlos-claims", 0700); err != nil { |
| 24 | t.Fatal(err) |
| 25 | } |
| 26 | t.Cleanup(func() { os.RemoveAll("/var/lib/carlos-claims") }) |
| 27 | dir := generationRootRunnerDir(t) |
| 28 | self, err := os.ReadFile(os.Args[0]) |
| 29 | if err != nil { |
| 30 | t.Fatal(err) |
| 31 | } |
| 32 | helper := filepath.Join(dir, "runner.test") |
| 33 | if err := os.WriteFile(helper, self, 0755); err != nil { |
| 34 | t.Fatal(err) |
| 35 | } |
| 36 | pub, _, err := ed25519.GenerateKey(nil) |
| 37 | if err != nil { |
| 38 | t.Fatal(err) |
| 39 | } |
| 40 | t.Setenv("CARLOS_OPT_DIR", dir) |
| 41 | t.Setenv("CARLOS_DEPLOYMENT_BUCKET", "deploy") |
| 42 | t.Setenv("CARLOS_RELEASE_PUBKEY", base64.StdEncoding.EncodeToString(pub)) |
| 43 | guard := filepath.Join(dir, "system", "guard") |
| 44 | if err := os.MkdirAll(guard, 0755); err != nil { |
| 45 | t.Fatal(err) |
| 46 | } |
| 47 | raw, _ := json.Marshal(hostfloor.Policy{Schema: 1, DeploymentBucket: "deploy", Mode: "unpublished"}) |
| 48 | if err := os.WriteFile(filepath.Join(guard, "policy.json"), raw, 0644); err != nil { |
| 49 | t.Fatal(err) |
| 50 | } |
| 51 | entry, err := os.ReadFile("/usr/bin/echo") |
| 52 | if err != nil { |
| 53 | t.Fatal(err) |
| 54 | } |
| 55 | if err := os.WriteFile(systemBinaryPath(dir), entry, 0755); err != nil { |
| 56 | t.Fatal(err) |
| 57 | } |
| 58 | for _, floor := range []bool{false, true} { |
| 59 | if floor { |
| 60 | if err := os.MkdirAll(filepath.Join(guard, "moves", "private"), 0700); err != nil { |
| 61 | t.Fatal(err) |
| 62 | } |
| 63 | } |
| 64 | cmd := exec.CommandContext(t.Context(), helper, "-test.run=^TestPlan14GuardExecEdgeRootRunner$") |
| 65 | cmd.Env = append(os.Environ(), "PLAN14_P3_EDGE_CHILD=1") |
| 66 | cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}} |
| 67 | out, err := cmd.CombinedOutput() |
| 68 | if err != nil || !strings.Contains(string(out), "agent") { |
| 69 | t.Fatalf("floor=%v: %v %s", floor, err, out) |
| 70 | } |
| 71 | } |
| 72 | } |
| 73 | |
amadan