bastion 0.53.2

client-go/machinestore_unix_test.go

@@ -0,0 +1,91 @@
+//go:build !windows
+
+package main
+
+// Tagged !windows for the reason singleton_test.go states: syscall.Umask does
+// not exist on that target. The rest of the machine store's tests are portable
+// and stay in machinestore_test.go.
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// A day-file that ALREADY EXISTS with a loose mode is tightened before the
+// machine's findings are appended to it.
+//
+// THIS IS THE TEST THE FIRST VERSION GOT WRONG, and the mutation sweep is what
+// said so. That version set the umask to 0 and asserted 0600 — but a umask only
+// ever clears bits, so an O_CREATE of 0600 comes out 0600 under every umask
+// there is, and deleting the chmod under test left it green. What the chmod
+// really guards is the file it did NOT create: O_APPEND|O_CREATE does not touch
+// the mode of an existing file, so a day-file restored from a backup or copied
+// in with `cp -p` keeps whatever mode it arrived with while this process writes
+// the machine's findings into it.
+//
+// The umask is still set to 0, for a different and now-honest reason: it proves
+// the 0644 below is the mode the file really has rather than one the umask
+// happened to allow.
+func TestAnExistingLooseDayFileIsTightenedBeforeItIsAppendedTo(t *testing.T) {
+	isolateConfigDir(t)
+	old := syscall.Umask(0)
+	defer syscall.Umask(old)
+
+	at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
+	p, err := storeDayPath(storeFindings, at)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Arrives world-readable, the way a restored or copied file does.
+	if err := os.WriteFile(p, []byte("{}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if fi, err := os.Stat(p); err != nil || fi.Mode().Perm() != 0o644 {
+		t.Fatalf("the fixture is not loose to begin with, so this test cannot fail: %v %v", fi, err)
+	}
+
+	if _, err := storeRecordPass(storeReport("base-a", storeFinding("aaa", deltaHigh)), at); err != nil {
+		t.Fatal(err)
+	}
+	fi, err := os.Stat(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fi.Mode().Perm() != 0o600 {
+		t.Fatalf("journal file is %v, want 0600 — the machine's own record stayed world-readable", fi.Mode().Perm())
+	}
+}
+
+// The writer's own state file is bookkeeping the host must not be able to
+// reach: a file the host could write is a file that could suppress a finding by
+// pre-declaring it open.
+func TestTheWritersStateFileIsOwnerOnly(t *testing.T) {
+	isolateConfigDir(t)
+	old := syscall.Umask(0)
+	defer syscall.Umask(old)
+
+	at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
+	sp, err := storeStatePath()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Dir(sp), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(sp, []byte("{}"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := storeRecordPass(storeReport("base-a", storeFinding("aaa", deltaHigh)), at); err != nil {
+		t.Fatal(err)
+	}
+	fi, err := os.Stat(sp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fi.Mode().Perm() != 0o600 {
+		t.Fatalf("store state is %v, want 0600", fi.Mode().Perm())
+	}
+}