60 lines
2.4 KiB
Go
60 lines
2.4 KiB
Go
//go:build linux
|
|
|
|
package adminconsole
|
|
|
|
import "testing"
|
|
|
|
func TestAuthorizeLinuxProcessRequiresSystemdInvocation(t *testing.T) {
|
|
validID := "0123456789abcdef0123456789abcdef"
|
|
tests := []struct {
|
|
name string
|
|
euid int
|
|
pid int
|
|
parentPID int
|
|
invocation string
|
|
execPID string
|
|
want bool
|
|
}{
|
|
{name: "systemd service", euid: 0, pid: 120, parentPID: 1, invocation: validID, execPID: "120", want: true},
|
|
{name: "systemd without optional exec pid", euid: 0, pid: 120, parentPID: 1, invocation: validID, want: true},
|
|
{name: "non root", euid: 1000, pid: 120, parentPID: 1, invocation: validID, execPID: "120"},
|
|
{name: "direct execution", euid: 0, pid: 120, parentPID: 99, invocation: validID, execPID: "120"},
|
|
{name: "missing invocation", euid: 0, pid: 120, parentPID: 1, execPID: "120"},
|
|
{name: "forged exec pid", euid: 0, pid: 120, parentPID: 1, invocation: validID, execPID: "121"},
|
|
{name: "invalid invocation", euid: 0, pid: 120, parentPID: 1, invocation: "not-an-invocation-id", execPID: "120"},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if got := authorizeLinuxProcess(test.euid, test.pid, test.parentPID, test.invocation, test.execPID); got != test.want {
|
|
t.Fatalf("authorizeLinuxProcess() = %v, want %v", got, test.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestAuthorizedSystemdJobOnlyAllowsExplicitStart(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
output string
|
|
want bool
|
|
}{
|
|
{name: "start running", output: "42 Scert-admin.service start running\n", want: true},
|
|
{name: "start waiting", output: "42 Scert-admin.service start waiting\n", want: true},
|
|
{name: "restart", output: "42 Scert-admin.service restart running\n"},
|
|
{name: "try restart", output: "42 Scert-admin.service try-restart running\n"},
|
|
{name: "reload or restart", output: "42 Scert-admin.service reload-or-restart running\n"},
|
|
{name: "try reload or restart", output: "42 Scert-admin.service try-reload-or-restart running\n"},
|
|
{name: "reload", output: "42 Scert-admin.service reload running\n"},
|
|
{name: "stop", output: "42 Scert-admin.service stop running\n"},
|
|
{name: "other unit", output: "42 smail.service start running\n"},
|
|
{name: "malformed", output: "Scert-admin.service start\n"},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if got := hasAuthorizedStartJob(test.output); got != test.want {
|
|
t.Fatalf("hasAuthorizedStartJob() = %v, want %v", got, test.want)
|
|
}
|
|
})
|
|
}
|
|
}
|