mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-17 20:19:55 +00:00
a89a5c5b9c
The host-safe unit run dropped sudo but two privileged test groups were never tagged, and the Docker privileged job silently never ran the suite: - Gate the ssh/server PrivilegeDropper command-construction tests behind the privileged tag (they require root to target a different UID); split them into executor_unix_privileged_test.go. - Tag sharedsock raw-socket tests privileged (need CAP_NET_RAW). - Fix the Docker job command: nested single quotes around the build tags closed the sh -c wrapper early, dropping the go list package set and the privileged tag, so go test ran on the empty repo root. Use double quotes. Make the self-hosting harness usable from a dev Mac: - Build it on darwin as well as linux; it only drives Docker. - Resolve the active docker context endpoint into DOCKER_HOST when the default /var/run/docker.sock is absent (Docker Desktop, Colima, OrbStack). - Rename the misspelled containerGoModache constant to containerGoModCache.
67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
//go:build unix && privileged
|
|
|
|
package server
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPrivilegeDropper_CreateExecutorCommand(t *testing.T) {
|
|
pd := NewPrivilegeDropper()
|
|
|
|
config := ExecutorConfig{
|
|
UID: 1000,
|
|
GID: 1000,
|
|
Groups: []uint32{1000, 1001},
|
|
WorkingDir: "/home/testuser",
|
|
Shell: "/bin/bash",
|
|
Command: "ls -la",
|
|
}
|
|
|
|
cmd, err := pd.CreateExecutorCommand(context.Background(), config)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, cmd)
|
|
|
|
// Verify the command is calling netbird ssh exec
|
|
assert.Contains(t, cmd.Args, "ssh")
|
|
assert.Contains(t, cmd.Args, "exec")
|
|
assert.Contains(t, cmd.Args, "--uid")
|
|
assert.Contains(t, cmd.Args, "1000")
|
|
assert.Contains(t, cmd.Args, "--gid")
|
|
assert.Contains(t, cmd.Args, "1000")
|
|
assert.Contains(t, cmd.Args, "--groups")
|
|
assert.Contains(t, cmd.Args, "1000")
|
|
assert.Contains(t, cmd.Args, "1001")
|
|
assert.Contains(t, cmd.Args, "--working-dir")
|
|
assert.Contains(t, cmd.Args, "/home/testuser")
|
|
assert.Contains(t, cmd.Args, "--shell")
|
|
assert.Contains(t, cmd.Args, "/bin/bash")
|
|
assert.Contains(t, cmd.Args, "--cmd")
|
|
assert.Contains(t, cmd.Args, "ls -la")
|
|
}
|
|
|
|
func TestPrivilegeDropper_CreateExecutorCommandInteractive(t *testing.T) {
|
|
pd := NewPrivilegeDropper()
|
|
|
|
config := ExecutorConfig{
|
|
UID: 1000,
|
|
GID: 1000,
|
|
Groups: []uint32{1000},
|
|
WorkingDir: "/home/testuser",
|
|
Shell: "/bin/bash",
|
|
Command: "",
|
|
}
|
|
|
|
cmd, err := pd.CreateExecutorCommand(context.Background(), config)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, cmd)
|
|
|
|
// Verify no command mode (command is empty so no --cmd flag)
|
|
assert.NotContains(t, cmd.Args, "--cmd")
|
|
assert.NotContains(t, cmd.Args, "--interactive")
|
|
}
|