Files
netbird/client/vnc/server/xauth_x11_test.go

74 lines
2.2 KiB
Go

//go:build (linux && !android) || freebsd
package server
import (
"os"
"path/filepath"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/client/configs"
)
// withRuntimeDir points configs.RuntimeDir at a temp tree for the test.
func withRuntimeDir(t *testing.T) string {
t.Helper()
root := t.TempDir()
prev := configs.RuntimeDir
configs.RuntimeDir = root
t.Cleanup(func() { configs.RuntimeDir = prev })
return root
}
func permOf(t *testing.T, dir string) os.FileMode {
t.Helper()
info, err := os.Stat(dir)
require.NoError(t, err)
return info.Mode().Perm()
}
// The runtime dir is shared: the daemon advertises its socket there and
// unprivileged clients list it to find one. Making the xauth dir traversable
// must not cost the read bit that listing needs.
func TestEnsureTraversableKeepsTheRuntimeDirReadable(t *testing.T) {
root := withRuntimeDir(t)
require.NoError(t, os.Chmod(root, 0o755))
sub := filepath.Join(root, vncXAuthSubdir)
require.NoError(t, os.Mkdir(sub, 0o700))
require.NoError(t, ensureTraversable(sub))
assert.Equal(t, os.FileMode(0o755), permOf(t, root), "an already-traversable shared dir must be left alone")
assert.Equal(t, os.FileMode(0o711), permOf(t, sub), "the xauth dir gains traversal, keeping its own bits")
}
// A runtime dir that is not traversable gains execute, and nothing else: no
// read bit is handed out that was not there before.
func TestEnsureTraversableAddsOnlyExecute(t *testing.T) {
root := withRuntimeDir(t)
require.NoError(t, os.Chmod(root, 0o700))
sub := filepath.Join(root, vncXAuthSubdir)
require.NoError(t, os.Mkdir(sub, 0o700))
require.NoError(t, ensureTraversable(sub))
assert.Equal(t, os.FileMode(0o711), permOf(t, root))
assert.Equal(t, os.FileMode(0o711), permOf(t, sub))
}
// A path outside the runtime dir is refused before anything is modified.
func TestEnsureTraversableRefusesOutsidePaths(t *testing.T) {
withRuntimeDir(t)
outside := t.TempDir()
require.NoError(t, os.Chmod(outside, 0o700))
require.Error(t, ensureTraversable(outside))
assert.Equal(t, os.FileMode(0o700), permOf(t, outside), "a refused path must not be chmodded")
}