mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-02 04:51:29 +02:00
74 lines
2.2 KiB
Go
74 lines
2.2 KiB
Go
//go:build (linux && !android) || freebsd
|
|
|
|
package server
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/netbirdio/netbird/client/configs"
|
|
)
|
|
|
|
// withRuntimeDir points configs.RuntimeDir at a temp tree for the test.
|
|
func withRuntimeDir(t *testing.T) string {
|
|
t.Helper()
|
|
root := t.TempDir()
|
|
prev := configs.RuntimeDir
|
|
configs.RuntimeDir = root
|
|
t.Cleanup(func() { configs.RuntimeDir = prev })
|
|
return root
|
|
}
|
|
|
|
func permOf(t *testing.T, dir string) os.FileMode {
|
|
t.Helper()
|
|
info, err := os.Stat(dir)
|
|
require.NoError(t, err)
|
|
return info.Mode().Perm()
|
|
}
|
|
|
|
// The runtime dir is shared: the daemon advertises its socket there and
|
|
// unprivileged clients list it to find one. Making the xauth dir traversable
|
|
// must not cost the read bit that listing needs.
|
|
func TestEnsureTraversableKeepsTheRuntimeDirReadable(t *testing.T) {
|
|
root := withRuntimeDir(t)
|
|
require.NoError(t, os.Chmod(root, 0o755))
|
|
|
|
sub := filepath.Join(root, vncXAuthSubdir)
|
|
require.NoError(t, os.Mkdir(sub, 0o700))
|
|
|
|
require.NoError(t, ensureTraversable(sub))
|
|
|
|
assert.Equal(t, os.FileMode(0o755), permOf(t, root), "an already-traversable shared dir must be left alone")
|
|
assert.Equal(t, os.FileMode(0o711), permOf(t, sub), "the xauth dir gains traversal, keeping its own bits")
|
|
}
|
|
|
|
// A runtime dir that is not traversable gains execute, and nothing else: no
|
|
// read bit is handed out that was not there before.
|
|
func TestEnsureTraversableAddsOnlyExecute(t *testing.T) {
|
|
root := withRuntimeDir(t)
|
|
require.NoError(t, os.Chmod(root, 0o700))
|
|
|
|
sub := filepath.Join(root, vncXAuthSubdir)
|
|
require.NoError(t, os.Mkdir(sub, 0o700))
|
|
|
|
require.NoError(t, ensureTraversable(sub))
|
|
|
|
assert.Equal(t, os.FileMode(0o711), permOf(t, root))
|
|
assert.Equal(t, os.FileMode(0o711), permOf(t, sub))
|
|
}
|
|
|
|
// A path outside the runtime dir is refused before anything is modified.
|
|
func TestEnsureTraversableRefusesOutsidePaths(t *testing.T) {
|
|
withRuntimeDir(t)
|
|
|
|
outside := t.TempDir()
|
|
require.NoError(t, os.Chmod(outside, 0o700))
|
|
|
|
require.Error(t, ensureTraversable(outside))
|
|
assert.Equal(t, os.FileMode(0o700), permOf(t, outside), "a refused path must not be chmodded")
|
|
}
|