forked from security/hakurei
Ophestra
e42ea32dbe
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix. Signed-off-by: Ophestra <cat@gensokyo.uk>
61 lines
2.9 KiB
Python
61 lines
2.9 KiB
Python
start_all()
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
# To check sharefs version:
|
|
print(machine.succeed("sharefs -V"))
|
|
|
|
# Make sure sharefs started:
|
|
machine.wait_for_unit("sdcard.mount")
|
|
|
|
machine.succeed("mkdir /mnt")
|
|
def check_bad_opts_output(opts, want, source="/etc", privileged=False):
|
|
output = machine.fail(("" if privileged else "sudo -u alice -i ") + f"sharefs -f -o source={source},{opts} /mnt 2>&1")
|
|
if output != want:
|
|
raise Exception(f"unexpected output: {output}")
|
|
|
|
# Malformed setuid/setgid representation:
|
|
check_bad_opts_output("setuid=ff", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=ff", "sharefs: invalid value for option setgid\n")
|
|
|
|
# Bounds check for setuid/setgid:
|
|
check_bad_opts_output("setuid=0", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=0", "sharefs: invalid value for option setgid\n")
|
|
check_bad_opts_output("setuid=-1", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=-1", "sharefs: invalid value for option setgid\n")
|
|
|
|
# Non-root setuid/setgid:
|
|
check_bad_opts_output("setuid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("setgid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("setuid=1023,setgid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("mkdir", "sharefs: mkdir has no effect when not starting as root\n")
|
|
|
|
# Starting as root without setuid/setgid:
|
|
check_bad_opts_output("allow_other", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
check_bad_opts_output("setuid=1023", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
check_bad_opts_output("setgid=1023", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
|
|
# Make sure nothing actually got mounted:
|
|
machine.fail("umount /mnt")
|
|
machine.succeed("rmdir /mnt")
|
|
|
|
# Unprivileged mount/unmount:
|
|
machine.succeed("sudo -u alice -i mkdir /home/alice/{sdcard,persistent}")
|
|
machine.succeed("sudo -u alice -i sharefs -o source=/home/alice/persistent /home/alice/sdcard")
|
|
machine.succeed("sudo -u alice -i touch /home/alice/sdcard/check")
|
|
machine.succeed("sudo -u alice -i umount /home/alice/sdcard")
|
|
machine.succeed("sudo -u alice -i rm /home/alice/persistent/check")
|
|
machine.succeed("sudo -u alice -i rmdir /home/alice/{sdcard,persistent}")
|
|
|
|
# Benchmark sharefs:
|
|
machine.succeed("fs_mark -v -d /sdcard/fs_mark -l /tmp/fs_log.txt")
|
|
machine.copy_from_vm("/tmp/fs_log.txt", "")
|
|
|
|
# Check permissions:
|
|
machine.succeed("sudo -u sharefs touch /var/lib/hakurei/sdcard/fs_mark/.check")
|
|
machine.succeed("sudo -u sharefs rm /var/lib/hakurei/sdcard/fs_mark/.check")
|
|
machine.succeed("sudo -u alice rm -rf /sdcard/fs_mark")
|
|
machine.fail("ls /var/lib/hakurei/sdcard/fs_mark")
|
|
|
|
# Run hakurei tests on sharefs:
|
|
machine.succeed("sudo -u alice -i sharefs-workload-hakurei-tests")
|