forked from security/hakurei
Ophestra
e7982b4ee9
This optional behaviour is required on NixOS as it is otherwise impossible to set this up: systemd.mounts breaks startup order somehow even though my unit looks identical to generated ones, fileSystems does not support any kind of initialisation or ordering other than against other mount points. Signed-off-by: Ophestra <cat@gensokyo.uk>
61 lines
2.9 KiB
Python
61 lines
2.9 KiB
Python
start_all()
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
# To check sharefs version:
|
|
print(machine.succeed("/etc/sharefs -V"))
|
|
|
|
# Make sure sharefs did not terminate:
|
|
machine.wait_for_unit("sharefs.service")
|
|
|
|
machine.succeed("mkdir /mnt")
|
|
def check_bad_opts_output(opts, want, source="/etc", privileged=False):
|
|
output = machine.fail(("" if privileged else "sudo -u alice -i ") + f"/etc/sharefs -f -o source={source},{opts} /mnt 2>&1")
|
|
if output != want:
|
|
raise Exception(f"unexpected output: {output}")
|
|
|
|
# Malformed setuid/setgid representation:
|
|
check_bad_opts_output("setuid=ff", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=ff", "sharefs: invalid value for option setgid\n")
|
|
|
|
# Bounds check for setuid/setgid:
|
|
check_bad_opts_output("setuid=0", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=0", "sharefs: invalid value for option setgid\n")
|
|
check_bad_opts_output("setuid=-1", "sharefs: invalid value for option setuid\n")
|
|
check_bad_opts_output("setgid=-1", "sharefs: invalid value for option setgid\n")
|
|
|
|
# Non-root setuid/setgid:
|
|
check_bad_opts_output("setuid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("setgid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("setuid=1023,setgid=1023", "sharefs: setuid and setgid has no effect when not starting as root\n")
|
|
check_bad_opts_output("mkdir", "sharefs: mkdir has no effect when not starting as root\n")
|
|
|
|
# Starting as root without setuid/setgid:
|
|
check_bad_opts_output("allow_other", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
check_bad_opts_output("setuid=1023", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
check_bad_opts_output("setgid=1023", "sharefs: setuid and setgid must not be 0\n", privileged=True)
|
|
|
|
# Make sure nothing actually got mounted:
|
|
machine.fail("umount /mnt")
|
|
machine.succeed("rmdir /mnt")
|
|
|
|
# Unprivileged mount/unmount:
|
|
machine.succeed("sudo -u alice -i mkdir /home/alice/{sdcard,persistent}")
|
|
machine.succeed("sudo -u alice -i /etc/sharefs -o source=/home/alice/persistent /home/alice/sdcard")
|
|
machine.succeed("sudo -u alice -i touch /home/alice/sdcard/check")
|
|
machine.succeed("sudo -u alice -i umount /home/alice/sdcard")
|
|
machine.succeed("sudo -u alice -i rm /home/alice/persistent/check")
|
|
machine.succeed("sudo -u alice -i rmdir /home/alice/{sdcard,persistent}")
|
|
|
|
# Benchmark sharefs:
|
|
machine.succeed("fs_mark -v -d /sdcard/fs_mark -l /tmp/fs_log.txt")
|
|
machine.copy_from_vm("/tmp/fs_log.txt", "")
|
|
|
|
# Check permissions:
|
|
machine.succeed("sudo -u sharefs touch /var/lib/hakurei/sdcard/fs_mark/.check")
|
|
machine.succeed("sudo -u sharefs rm /var/lib/hakurei/sdcard/fs_mark/.check")
|
|
machine.succeed("sudo -u alice rm -rf /sdcard/fs_mark")
|
|
machine.fail("ls /var/lib/hakurei/sdcard/fs_mark")
|
|
|
|
# Run hakurei tests on sharefs:
|
|
machine.succeed("sudo -u alice -i sharefs-workload-hakurei-tests")
|