| 1 | //go:build linux && rootrunner |
| 2 | |
| 3 | package host |
| 4 | |
| 5 | import ( |
| 6 | "os" |
| 7 | "path/filepath" |
| 8 | "testing" |
| 9 | "time" |
| 10 | |
| 11 | "github.com/carlosframework/platform/internal/release" |
| 12 | "github.com/carlosframework/platform/internal/rollout" |
| 13 | "github.com/carlosframework/platform/internal/rootstate" |
| 14 | ) |
| 15 | |
| 16 | func TestPlan14SwapFailureHostileRootRunner(t *testing.T) { |
| 17 | if os.Geteuid() != 0 { |
| 18 | t.Fatal("root required") |
| 19 | } |
| 20 | dir, err := os.MkdirTemp("/var/lib", "carlos-e3-") |
| 21 | if err != nil { |
| 22 | t.Fatal(err) |
| 23 | } |
| 24 | defer os.RemoveAll(dir) |
| 25 | s, err := rootstate.Open(dir, false, false) |
| 26 | if err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | defer s.Close() |
| 30 | b, err := rollout.InitializeRootFailures(s, "box/en/1", nil) |
| 31 | if err != nil { |
| 32 | t.Fatal(err) |
| 33 | } |
| 34 | rec := rollout.FailureRecord{Account: "bab", App: "km", Build: "v1", Host: "h.example.com", HeldDown: []string{"h.example.com"}} |
| 35 | if _, err = b.Record(rec); err != nil { |
| 36 | t.Fatal(err) |
| 37 | } |
| 38 | if err = os.Chmod(dir, 0777); err != nil { |
| 39 | t.Fatal(err) |
| 40 | } |
| 41 | if bad, err := rootstate.Open(dir, false, false); err == nil { |
| 42 | bad.Close() |
| 43 | t.Fatal("hostile ancestor admitted") |
| 44 | } |
| 45 | if err = os.Chmod(dir, 0700); err != nil { |
| 46 | t.Fatal(err) |
| 47 | } |
| 48 | if err = os.Chown(dir, 65534, 65534); err != nil { |
| 49 | t.Fatal(err) |
| 50 | } |
| 51 | if bad, err := rootstate.Open(dir, false, false); err == nil { |
| 52 | bad.Close() |
| 53 | t.Fatal("foreign owner admitted") |
| 54 | } |
| 55 | if err = os.Chown(dir, 0, 0); err != nil { |
| 56 | t.Fatal(err) |
| 57 | } |
| 58 | renamed := dir + "-retained" |
| 59 | if err = os.Rename(dir, renamed); err != nil { |
| 60 | t.Fatal(err) |
| 61 | } |
| 62 | defer os.RemoveAll(renamed) |
| 63 | if err = os.Mkdir(dir, 0700); err != nil { |
| 64 | t.Fatal(err) |
| 65 | } |
| 66 | b, err = rollout.OpenRootFailures(s, "box/en/1") |
| 67 | if err != nil { |
| 68 | t.Fatal(err) |
| 69 | } |
| 70 | testRootSettingsPass(t, b, "combined") |
| 71 | if !b.HeldDown("bab", "km", "v1", rec.Host) { |
| 72 | t.Fatal("rename dropped denial") |
| 73 | } |
| 74 | if _, err = os.Stat(filepath.Join(dir, "book.json")); !os.IsNotExist(err) { |
| 75 | t.Fatal("replacement acquired authority", err) |
| 76 | } |
| 77 | seed, public, _ := release.GenerateKey() |
| 78 | priv, _ := release.ParseSigningKey(seed, "test") |
| 79 | pub, _ := release.ParsePublicKey(public, "test") |
| 80 | wire, err := release.SignHostRetry(release.RootSigner(priv), "bab", "km", rec.Host, "v1", b.ID(), b.PublishedEpoch("bab", "km", "v1", rec.Host), time.Now()) |
| 81 | if err != nil { |
| 82 | t.Fatal(err) |
| 83 | } |
| 84 | failing := true |
| 85 | fault := rootstate.WithWriteFault(s, func(name, stage string, op func() error) error { |
| 86 | if stage == "parent-sync" && failing { |
| 87 | return os.ErrPermission |
| 88 | } |
| 89 | return op() |
| 90 | }) |
| 91 | b, err = rollout.OpenRootFailures(fault, "box/en/1") |
| 92 | if err == nil { |
| 93 | t.Fatal("owed directory sync admitted") |
| 94 | } |
| 95 | failing = false |
| 96 | b, err = rollout.OpenRootFailures(fault, "box/en/1") |
| 97 | if err != nil { |
| 98 | t.Fatal(err) |
| 99 | } |
| 100 | failing = true |
| 101 | if err = b.VerifiedRetry(pub, wire, "bab", "km", rec.Host, time.Now()); err == nil { |
| 102 | t.Fatal("visible retry reported durable") |
| 103 | } |
| 104 | if !b.SaveOwed() { |
| 105 | t.Fatal("failure disappeared") |
| 106 | } |
| 107 | if _, err = rollout.OpenRootFailures(fault, "box/en/1"); err == nil { |
| 108 | t.Fatal("retry granted while sync still fails") |
| 109 | } |
| 110 | failing = false |
| 111 | b, err = rollout.OpenRootFailures(fault, "box/en/1") |
| 112 | if err != nil { |
| 113 | t.Fatal(err) |
| 114 | } |
| 115 | if b.HeldDown("bab", "km", "v1", rec.Host) { |
| 116 | t.Fatal("durably recovered retry not applied") |
| 117 | } |
| 118 | } |
| 119 | |
| 120 | func TestPlan14SwapFailureNoCensusRootRunner(t *testing.T) { |
| 121 | if os.Geteuid() != 0 { |
| 122 | t.Fatal("root required") |
| 123 | } |
| 124 | for _, path := range []string{"/var/lib/carlos-claims/authority/execution/census.json", rollout.RootFailuresDir} { |
| 125 | if _, err := os.Lstat(path); !os.IsNotExist(err) { |
| 126 | t.Fatal("fixture requires absent authority", path, err) |
| 127 | } |
| 128 | } |
| 129 | p, err := productionRootUpdates(t.TempDir())(t.Context(), nil, nil) |
| 130 | if err != nil || p != nil { |
| 131 | t.Fatal("no-census branch changed", p, err) |
| 132 | } |
| 133 | if _, err := os.Lstat(rollout.RootFailuresDir); !os.IsNotExist(err) { |
| 134 | t.Fatal("no-census pass created authority", err) |
| 135 | } |
| 136 | TestUpdatesPassOptionReadsTheBookEveryPass(t) |
| 137 | } |
| 138 | |
amadan