| 1 | //go:build linux |
| 2 | |
| 3 | package host |
| 4 | |
| 5 | import ( |
| 6 | "bytes" |
| 7 | "github.com/carlosframework/platform/internal/hostbox" |
| 8 | "github.com/carlosframework/platform/internal/rootstate" |
| 9 | "os" |
| 10 | "testing" |
| 11 | ) |
| 12 | |
| 13 | func testPersistentInventory(t *testing.T, path string) rootstate.FileIdentity { |
| 14 | t.Helper() |
| 15 | f, err := hostbox.OpenInventoryFile(path) |
| 16 | if err != nil { |
| 17 | t.Fatal(err) |
| 18 | } |
| 19 | defer f.Close() |
| 20 | id, err := rootstate.ObjectIdentity(f) |
| 21 | if err != nil { |
| 22 | t.Fatal(err) |
| 23 | } |
| 24 | return id |
| 25 | } |
| 26 | |
| 27 | func TestPlan14ProofFileSourceBootEvidence(t *testing.T) { |
| 28 | before := proofUnitFile{Path: "/opt/app", Persistent: rootstate.FileIdentity{Boot: "old", Device: 1, Inode: 2, Filesystem: "fs", Handle: "handle", MountRoot: "/", MountPoint: "/", MountNamespace: "mnt:[1]", Mount: 3, MountLineage: "/\t/\n", MountUnique: 100, NamespaceUnique: 10}} |
| 29 | after := before |
| 30 | after.Persistent.Boot = "new" |
| 31 | after.Persistent.Device++ |
| 32 | after.Persistent.Mount++ |
| 33 | after.Persistent.MountUnique++ |
| 34 | after.Persistent.NamespaceUnique++ |
| 35 | if !sameProofFiles([]proofUnitFile{before}, []proofUnitFile{after}) || !bytes.Equal(proofFileSource(before), proofFileSource(after)) { |
| 36 | t.Fatal("unchanged persistent file lost its proof across reboot") |
| 37 | } |
| 38 | after = before |
| 39 | after.Persistent.MountUnique++ |
| 40 | if sameProofFiles([]proofUnitFile{before}, []proofUnitFile{after}) { |
| 41 | t.Fatal("stable proof hash admitted a replacement mount") |
| 42 | } |
| 43 | if !bytes.Equal(proofFileSource(before), proofFileSource(after)) { |
| 44 | t.Fatal("boot-local mount evidence entered the stable hash") |
| 45 | } |
| 46 | after = before |
| 47 | after.Persistent.Handle = "other" |
| 48 | if sameProofFiles([]proofUnitFile{before}, []proofUnitFile{after}) || bytes.Equal(proofFileSource(before), proofFileSource(after)) { |
| 49 | t.Fatal("changed persistent file retained its proof") |
| 50 | } |
| 51 | } |
| 52 | func TestPlan14InventoryWithoutPersistentEvidenceRefuses(t *testing.T) { |
| 53 | path := t.TempDir() |
| 54 | f, err := os.Open(path) |
| 55 | if err != nil { |
| 56 | t.Fatal(err) |
| 57 | } |
| 58 | defer f.Close() |
| 59 | id, err := rootstate.Identity(f) |
| 60 | if err != nil { |
| 61 | t.Fatal(err) |
| 62 | } |
| 63 | e := hostbox.StopInventoryEntry{Device: id.Device, Inode: id.Inode, Type: 0040000} |
| 64 | if err := hostbox.VerifyInventoryFile(f, e); err == nil { |
| 65 | t.Fatal("old boot-unknown inventory admitted") |
| 66 | } |
| 67 | e.Identity = testPersistentInventory(t, path) |
| 68 | if err := hostbox.VerifyInventoryFile(f, e); err != nil { |
| 69 | t.Fatal(err) |
| 70 | } |
| 71 | } |
| 72 | |
amadan