bastion 0.63.1

client-go/anchorpolicy_linux_test.go

@@ -0,0 +1,37 @@
+//go:build linux
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The policy readers accept only what the machine's administrator or policy
+// engine could have written: on Linux a file root owns that nobody else can
+// write. Run as an ordinary user, the suite's own file is not root's, so it is
+// no policy.
+func TestALinuxPolicyFileMustBeRoots(t *testing.T) {
+	dir := t.TempDir()
+	prev := anchorPolicyFile
+	anchorPolicyFile = filepath.Join(dir, "policy.json")
+	t.Cleanup(func() { anchorPolicyFile = prev })
+	if err := os.WriteFile(anchorPolicyFile, []byte(`{"anchor_host":"`+"managed.host.privatae.ai"+`"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	p := readAnchorPolicyOS()
+	if os.Geteuid() == 0 {
+		if p == nil || p.Host != "managed.host.privatae.ai" {
+			t.Fatalf("root's own policy file was not read: %+v", p)
+		}
+		_ = os.Chmod(anchorPolicyFile, 0o666)
+		if readAnchorPolicyOS() != nil {
+			t.Error("a policy file anyone can write was read")
+		}
+		return
+	}
+	if p != nil {
+		t.Errorf("a policy file root does not own was read: %+v", p)
+	}
+}