Commit Graph

79 Commits

Author SHA1 Message Date
Serge Hallyn
61ca915ac5 run_some: fix shellcheck warning
shellcheck warns against using echo with flags, as posix sh won't
support it.  It suggests using printf, so let's do that.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-27 21:38:45 -06:00
Serge Hallyn
add4ab4bf0 ignore first test in run_some
bc github...

For some reason, the first test - ONLY on github - seems to not
give the '$ ' prompt expected when you spawn 'su testsuite'.
So just run the first test twice, and ignore the first failure.
2023-02-27 21:38:45 -06:00
Serge Hallyn
4da831c02f swap first two tests - does the first one still fail?
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-27 21:38:45 -06:00
Serge Hallyn
421c6cf951 tests: remove some github runner PATH tweaking
It messes with the expected results.

We can do better than this in the expect scripts, but let's
get things running for now.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-27 21:38:45 -06:00
Alejandro Colomar
a72065a108 tests: Support git-worktree(1)
git-worktree(1) uses a regular file for <.git>, instead of a directory.

Signed-off-by: Alejandro Colomar <alx@kernel.org>
2023-02-27 14:16:50 -06:00
Serge Hallyn
4445cee19d tests: newuidmap and newgidmap: update expected fail message
The failure message got changed, but the tests looking for it did
not.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-24 21:46:29 -06:00
Serge Hallyn
aa15bc445e libsubid: include alloc.h
Fixes: efbbcade43: Use safer allocation macros
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-24 21:27:02 -06:00
Serge Hallyn
9a9e163e71 run_some: log stderr
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-24 20:11:14 -06:00
Alejandro Colomar
efbbcade43 Use safer allocation macros
Use of these macros, apart from the benefits mentioned in the commit
that adds the macros, has some other good side effects:

-  Consistency in getting the size of the object from sizeof(type),
   instead of a mix of sizeof(type) sometimes and sizeof(*p) other
   times.

-  More readable code: no casts, and no sizeof(), so also shorter lines
   that we don't need to cut.

-  Consistency in using array allocation calls for allocations of arrays
   of objects, even when the object size is 1.

Cc: Valentin V. Bartenev <vbartenev@gmail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2023-02-23 20:28:43 -06:00
Serge Hallyn
8728bd87ed tests: print default timeout message to stderr
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2023-02-09 09:55:04 -06:00
James Addison
ed6c505312 Add '62_usermod_remove_supplementary_groups' test case to test runner scripts (run_some) 2022-12-11 10:58:37 -06:00
James Addison
f2bcb7a1b8 Add '62_usermod_remove_supplementary_groups' test case to test runner scripts (run_all, run_all.coverage) 2022-12-11 10:58:37 -06:00
James Addison
20f8ead9ec Add regression test for 'usermod -rG' -- it should not add users to groups they did not previously belong to 2022-12-11 10:58:37 -06:00
James Addison
899f7a43b1 Preparation / clarity: rename existing usermod test from 'remove_supplemental_groups' to 'clear_supplemental_groups' 2022-12-11 10:58:37 -06:00
Andy Zaugg
e8d2bc8d8b Allow supplementary groups to be added via config file
Allow supplementary groups to be set via the /etc/default/useradd config
file. Allowing an administrator to set additonal groups via the GROUPS
configurable and control the default behaviour of useradd.
2022-11-18 15:10:56 -06:00
Masatake YAMATO
18b8095a8d tests: add a case for testing -F option of useradd
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
2022-08-01 15:45:10 +02:00
Sam James
29309f5913 tests: replace egrep -> grep -E
"egrep" is an obsolete alias for grep -E and newer greps will warn on usage
of egrep, so let's just swap it out.

Signed-off-by: Sam James <sam@gentoo.org>
2022-05-15 17:36:08 -05:00
Serge Hallyn
5a7ed86fba Work around git safe.directory enforcement
Git wants to ensure that you do not read .git owned by other users.
But we fetch+build as 'build' user, and run tests as root user.  Those
tests calculate git topdir using git rev-parse --show-toplevel, which
git now fails.

Setting safe.directory, seems wrong.  Let's just use bash to figure
out the top dir.
2022-04-25 10:52:29 -05:00
Serge Hallyn
4ce27b5e60 nss test_range: make sure /etc/nsswitch.conf and /etc/subuid exists
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-12-27 15:47:29 -06:00
Serge Hallyn
962c820fba fix newuidmap testcase
sleep 2s before running newxidmap - it seems we were sometimes
racing, causing newxidmap to fail.

Make sure to remove /tmp/test-xidmap, for some reason they
were sometimes still there, causing test to fail.

Fix some irregular tabbing.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-12-27 09:27:44 -06:00
Serge Hallyn
363eab25f0 libsubid_zzz (test): fix pointer test
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-12-27 09:26:55 -06:00
Serge Hallyn
4758641b1d run_some: exit error if there were failed tests
Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-12-27 09:26:32 -06:00
KOSHIKAWA Kenichi
f7c2a54212 fixed typo in login.defs 2021-12-06 01:41:17 +09:00
Iker Pedrosa
3b6ccf642c getsubids: system binary for user's sub*ids
Rename list_subid_ranges to getsubids to provide a system binary to
check the sub*ids of a user. The intention is to provide this binary
with any distribution that includes the subid feature, so that system
administrators can check the subid ranges of a given user.

Finally, add a man page to explain the behaviour of getsubids.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1980780

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
2021-11-17 16:35:50 +01:00
a1346054
ecfcaed0b5 fix some shellcheck-identified issues in scripts 2021-08-18 18:21:06 +00:00
a1346054
f20c688a18 use a geographically close URL 2021-08-18 18:07:50 +00:00
Serge Hallyn
3d670ba7ed nss/libsubid: simplify the ranges variable for list_owner_ranges
Following alexey-tikhonov's suggestion.

Since we've dropped the 'owner' field in the data returned for
get_subid_ranges, we can just return a single allocated array of
simple structs.  This means we can return a ** instead of ***, and
we can get rid of the subid_free_ranges() helper, since the caller
can just free() the returned data.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-05-22 17:59:57 -05:00
Serge Hallyn
322db32971 Don't return owner in list_owner_ranges API call.
Closes: 339

struct subordinate_range is pretty closely tied to the existing
subid code and /etc/subuid format, so it includes an owner.  Dropping
that or even renaming it is more painful than I'd first thought.
So introduce a 'struct subid_range' which is only the start and
count, leaving 'struct subordinate_range' as the owner, start and
count.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-05-16 21:49:53 -05:00
Serge Hallyn
cc7ea6e8e5 tests: fix su failures under travis
HOME has to start as /root since we are testing
that su didn't change it.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:03:08 -05:00
Serge Hallyn
fa90ac11c8 su/03: export shell = sh
Otherwise our su -p uses bash if that is what root was
configured to use, and then fails to read /root/ for
.bash_profile.  This caused an unexpected error message
in /tmp/err, failing the test.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:03:08 -05:00
Serge Hallyn
716f3f99ce test: su -p doesn't set home
with out also doing '-'

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:03:08 -05:00
Serge Hallyn
8492dee663 subids: support nsswitch
Closes #154

When starting any operation to do with subuid delegation, check
nsswitch for a module to use.  If none is specified, then use
the traditional /etc/subuid and /etc/subgid files.

Currently only one module is supported, and there is no fallback
to the files on errors.  Several possibilities could be considered:

1. in case of connection error, fall back to files
2. in case of unknown user, also fall back to files

etc...

When non-files nss module is used, functions to edit the range
are not supported.  It may make sense to support it, but it also
may make sense to require another tool to be used.

libsubordinateio also uses the nss_ helpers.  This is how for instance
lxc could easily be converted to supporting nsswitch.

Add a set of test cases, including a dummy libsubid_zzz module.  This
hardcodes values such that:

'ubuntu' gets 200000 - 300000
'user1' gets 100000 - 165536
'error' emulates an nss module error
'unknown' emulates a user unknown to the nss module
'conn' emulates a connection error ot the nss module

Changes to libsubid:

Change the list_owner_ranges api: return a count instead of making the array
null terminated.

This is a breaking change, so bump the libsubid abi major number.

Rename free_subuid_range and free_subgid_range to ungrant_subuid_range,
because otherwise it's confusing with free_subid_ranges which frees
    memory.

Run libsubid tests in jenkins

Switch argument order in find_subid_owners

Move the db locking into subordinateio.c

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-04-16 21:02:37 -05:00
Martijn de Gouw
246d5c1c25 Add tests for group checking in newuidmap/newgidmap 2021-02-08 13:32:18 +01:00
Serge Hallyn
c32743808d Revert "Update su tests"
This reverts commit cf8101aaae.
2020-08-28 15:15:47 -05:00
Serge Hallyn
cf8101aaae Update su tests
Some of these tests seem wrong.  The assume that

    su -- -c command

should work, whereas -- should mean pass all remaining arguments
along to the command.

Add some new tests based on examples in Issue 253

Signed-off-by: Serge Hallyn <shallyn@cisco.com>
2020-08-27 23:59:07 -05:00
Serge Hallyn
0a7888b1fa Create a new libsubid
Closes #154

Currently this has three functions: one which returns the
list of subuid ranges for a user, one returning the subgids,
and one which frees the ranges lists.

I might be mistaken about what -disable-man means;  some of
the code suggests it means just don't re-generate them, but
not totally ignore them.  But that doesn't seem to really work,
so let's just ignore man/ when -disable-man.

Remove --disable-shared.  I'm not sure why it was there, but it stems
from long, long ago, and I suspect it comes from some ancient
toolchain bug.

Create a tests/run_some, a shorter version of run_all.  I'll
slowly add tests to this as I verify they work, then I can
work on fixing the once which don't.

Also, don't touch man/ if not -enable-man.

Changelog:
	Apr 22: change the subid list api as recomended by Dan Walsh.
	Apr 23: implement get_subid_owner
	Apr 24: implement range add/release
	Apr 25: finish tests and rebase
	May 10: make @owner const

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2020-06-07 12:11:58 -05:00
Serge Hallyn
089cf55e2c drop svn complications from test runner
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
2020-06-07 12:07:14 -05:00
Serge Hallyn
316a153abb tests: use git to determine top_dir
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
2020-06-07 12:07:09 -05:00
Josh Soref
5070132ee6
spelling: with-an 2020-03-17 17:09:26 -04:00
Josh Soref
a063580dbb spelling: within 2017-10-22 21:37:53 +00:00
Josh Soref
08248f0859 spelling: typical 2017-10-22 21:28:58 +00:00
Josh Soref
2c930b19ba spelling: succeeded 2017-10-22 21:23:22 +00:00
Josh Soref
4e0ac33eae spelling: password 2017-10-22 21:03:28 +00:00
Josh Soref
146a0da7b3 spelling: overridden 2017-10-22 21:01:25 +00:00
Josh Soref
008be2848e spelling: nonexistent 2017-10-22 20:54:42 +00:00
Josh Soref
63261593c8 spelling: negative 2017-10-22 20:48:57 +00:00
Josh Soref
4724e503b0 spelling: multiple 2017-10-22 20:41:18 +00:00
Josh Soref
5136659a59 spelling: maximum 2017-10-22 20:33:55 +00:00
Josh Soref
0556fea593 spelling: locally 2017-10-22 20:28:46 +00:00
Josh Soref
74fcf6f28d spelling: interactive 2017-10-22 20:24:32 +00:00