aboutsummaryrefslogtreecommitdiff
path: root/tests/setuid.nix
diff options
context:
space:
mode:
Diffstat (limited to 'tests/setuid.nix')
-rw-r--r--tests/setuid.nix198
1 files changed, 107 insertions, 91 deletions
diff --git a/tests/setuid.nix b/tests/setuid.nix
index 6f2f7d392..35eb304ed 100644
--- a/tests/setuid.nix
+++ b/tests/setuid.nix
@@ -2,12 +2,13 @@
{ nixpkgs, system, overlay }:
-with import (nixpkgs + "/nixos/lib/testing.nix") {
+with import (nixpkgs + "/nixos/lib/testing-python.nix") {
inherit system;
extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
};
makeTest {
+ name = "setuid";
machine =
{ config, lib, pkgs, ... }:
@@ -17,94 +18,109 @@ makeTest {
virtualisation.pathsInNixDB = [ pkgs.stdenv pkgs.pkgsi686Linux.stdenv ];
};
- testScript = { nodes }:
- ''
- startAll;
-
- # Copying to /tmp should succeed.
- $machine->succeed('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" {} "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- # Creating a setuid binary should fail.
- $machine->fail('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" {} "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- chmod 4755 /tmp/id
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- # Creating a setgid binary should fail.
- $machine->fail('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" {} "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- chmod 2755 /tmp/id
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- # The checks should also work on 32-bit binaries.
- $machine->fail('nix-build --no-sandbox -E \'(with import <nixpkgs> { system = "i686-linux"; }; runCommand "foo" {} "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- chmod 2755 /tmp/id
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- # The tests above use fchmodat(). Test chmod() as well.
- $machine->succeed('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- perl -e \"chmod 0666, qw(/tmp/id) or die\"
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 666 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- $machine->fail('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- perl -e \"chmod 04755, qw(/tmp/id) or die\"
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- # And test fchmod().
- $machine->succeed('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 01750, \\\$x or die\"
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 1750 ]]');
-
- $machine->succeed("rm /tmp/id");
-
- $machine->fail('nix-build --no-sandbox -E \'(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
- mkdir -p $out
- cp ${pkgs.coreutils}/bin/id /tmp/id
- perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 04777, \\\$x or die\"
- ")\' ');
-
- $machine->succeed('[[ $(stat -c %a /tmp/id) = 555 ]]');
-
- $machine->succeed("rm /tmp/id");
- '';
-
+ testScript = { nodes }: ''
+ # fmt: off
+ start_all()
+
+ # Copying to /tmp should succeed.
+ machine.succeed(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ # Creating a setuid binary should fail.
+ machine.fail(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ chmod 4755 /tmp/id
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ # Creating a setgid binary should fail.
+ machine.fail(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ chmod 2755 /tmp/id
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ # The checks should also work on 32-bit binaries.
+ machine.fail(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> { system = "i686-linux"; }; runCommand "foo" {} "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ chmod 2755 /tmp/id
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ # The tests above use fchmodat(). Test chmod() as well.
+ machine.succeed(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ perl -e \"chmod 0666, qw(/tmp/id) or die\"
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 666 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ machine.fail(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ perl -e \"chmod 04755, qw(/tmp/id) or die\"
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ # And test fchmod().
+ machine.succeed(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 01750, \\\$x or die\"
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 1750 ]]')
+
+ machine.succeed("rm /tmp/id")
+
+ machine.fail(r"""
+ nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+ mkdir -p $out
+ cp ${pkgs.coreutils}/bin/id /tmp/id
+ perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 04777, \\\$x or die\"
+ ")'
+ """.strip())
+
+ machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+
+ machine.succeed("rm /tmp/id")
+ '';
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 05:29:17 +0000