bastion 0.55.3

client-go/harness_creds_linux_test.go

@@ -0,0 +1,44 @@
+package main
+
+// The agent's credential for a harness run is a file in a folder mounted into
+// the container. No other local user may reach either: as root the bastion
+// hands both to the container's user, owner-only; as anyone else it opens them
+// for that user, inside a folder only the bastion can enter.
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestTheHarnessCredentialIsReadableOnlyByTheContainersUser(t *testing.T) {
+	// A stand-in runtime: on `run` it records the mode and owner of the folder
+	// the credential folder sits in, of that folder and of the file, then
+	// fails, so the run stops there.
+	bin := t.TempDir()
+	record := filepath.Join(bin, "record")
+	rt := filepath.Join(bin, "runtime")
+	script := "#!/bin/sh\n[ \"$1\" = run ] || exit 1\nfor a; do case \"$a\" in *:/home/privatae/.claude) d=${a%:/home/privatae/.claude};; esac; done\n" +
+		"[ -n \"$d\" ] && stat -c '%a %u %g' \"$(dirname \"$d\")\" \"$d\" \"$d/.credentials.json\" > " + record + "\nexit 1\n"
+	if err := os.WriteFile(rt, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	spec := harnessSpec{HarnessID: "h1", Image: "harness:test", AgentCreds: `{"claudeAiOauth":{}}`}
+	if _, err := driveHarnessAgent(rt, t.TempDir(), spec, 1); err == nil {
+		t.Fatal("the stand-in runtime fails the start; the run must report it")
+	}
+	got, err := os.ReadFile(record)
+	if err != nil {
+		t.Fatalf("the credential folder was not mounted: %v", err)
+	}
+	self := strconv.Itoa(os.Geteuid()) + " " + strconv.Itoa(os.Getegid())
+	want := "700 " + self + "\n777 " + self + "\n666 " + self
+	if os.Geteuid() == 0 {
+		want = "700 " + self + "\n700 10005 10005\n600 10005 10005" // the harness image's user
+	}
+	if strings.TrimSpace(string(got)) != want {
+		t.Fatalf("enclosing folder, folder, then file: want %q, got %q", want, strings.TrimSpace(string(got)))
+	}
+}