bastion 0.53.2

client-go/walkfail_test.go

@@ -0,0 +1,500 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// A walk that did not happen, seen from every consumer that used to read it as
+// an empty machine. Each of these was a place where the failure vanished:
+// the accounting saved it under a coverage label that later let a blind pass
+// close findings, the delta compared nothing against everything, the census
+// recorded a clean pass, and the two pages rendered "nothing running".
+
+func failTheWalk(t *testing.T) {
+	t.Helper()
+	prev := scanProcessesFn
+	t.Cleanup(func() { scanProcessesFn = prev })
+	scanProcessesFn = func() (map[int]agentObs, error) { return nil, errors.New("read /proc: too many open files") }
+}
+
+func TestNoBaselineIsTakenFromAWalkThatDidNotHappen(t *testing.T) {
+	failTheWalk(t)
+	f, _, _, _, err := collectBaseline()
+	if err == nil {
+		t.Fatalf("an accounting was built from a failed walk: coverage=%q entries=%d — saved, it would be labelled as if it had looked", f.Coverage, len(f.Entries))
+	}
+	if !strings.Contains(err.Error(), "no baseline taken") || !strings.Contains(err.Error(), "too many open files") {
+		t.Fatalf("the refusal must say no baseline was taken and why: %v", err)
+	}
+}
+
+func TestADeltaPassOnAFailedWalkComparesNothingAndSaysSo(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	isolateConfigDir(t)
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	failTheWalk(t)
+	r := deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
+	if r.Complete {
+		t.Fatal("a pass that could not walk the machine reported itself complete")
+	}
+	for _, f := range r.Findings {
+		if f.Kind != deltaBinaryChanged {
+			t.Fatalf("a pass that walked nothing produced a finding: %+v — an empty live set read every entry as gone", f)
+		}
+	}
+	// Every class the pass would have compared is named, so "no findings" on a
+	// failed walk cannot be read as a quiet machine for any of them.
+	for _, class := range []string{"processes", "scheduled jobs", "listeners", "accounts"} {
+		if !strings.Contains(strings.Join(r.Notes, "\n"), class) {
+			t.Fatalf("the note must say %s were not compared either: %v", class, r.Notes)
+		}
+	}
+	if !strings.Contains(strings.Join(r.Notes, "\n"), "process walk failed this pass") {
+		t.Fatalf("the pass must name the failed walk, not blame the platform: %v", r.Notes)
+	}
+	if strings.Contains(strings.Join(r.Notes, "\n"), "no unfiltered process walk") {
+		t.Fatalf("the platform note is the wrong cause for a failed walk: %v", r.Notes)
+	}
+}
+
+func TestTheCensusRecordsAFailedWalkInsteadOfACleanPass(t *testing.T) {
+	prev := observedAgents
+	t.Cleanup(func() { observedAgents = prev })
+	recordPolicyCensusError(nil)
+	observedAgents = func() ([]agentObs, error) { return nil, errors.New("ps sweep: exit 1") }
+	policyCensusTick()
+	msg, at := policyCensusError()
+	if msg == "" || at.IsZero() {
+		t.Fatal("a failed walk left the census reading clean — the page would say nothing would have been stopped")
+	}
+	if !strings.Contains(msg, "walk failed") || !strings.Contains(msg, "ps sweep") {
+		t.Fatalf("the census error must name the walk and its cause: %q", msg)
+	}
+}
+
+func TestThePagesBannerAFailedWalkRatherThanAnEmptyMachine(t *testing.T) {
+	prev := observedAgents
+	t.Cleanup(func() { observedAgents = prev })
+	observedAgents = func() ([]agentObs, error) { return nil, errors.New("read /proc: permission denied") }
+	a := collectAgentsView()
+	if a.WalkError == "" || a.Observed != 0 || len(a.Rows) != 0 {
+		t.Fatalf("the agents page rendered a failed walk as a machine with nothing on it: walk=%q observed=%d", a.WalkError, a.Observed)
+	}
+	p := collectPolicyView()
+	if p.WalkError == "" || len(p.Rows) != 0 {
+		t.Fatalf("the policy page rendered a failed walk as nothing to stop: walk=%q rows=%d", p.WalkError, len(p.Rows))
+	}
+}
+
+// THE STORE CLOSES NOTHING ON A PASS THAT WALKED NOTHING — on the platforms
+// where Complete=false is the everyday state. baseline_all_other.go returns
+// false unconditionally on darwin and windows, so their accountings are
+// labelled processes=recognised-only and storeScopeAgrees waves an incomplete
+// pass through by design. A pass whose walk FAILED compared no entries; read
+// as scope-agreeing it closed every open finding, pinned criticals included.
+func TestAFailedWalkClosesNothingOnARecognisedOnlyPlatform(t *testing.T) {
+	isolateConfigDir(t)
+	at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
+	full := storeReport("base-a", storeFinding("aaa", deltaCritical), storeFinding("bbb", deltaHigh))
+	full.Complete = false
+	full.Coverage = "processes=recognised-only,schedulers=recognised-only"
+	if _, err := storeRecordPass(full, at); err != nil {
+		t.Fatal(err)
+	}
+	blind := storeReport("base-a")
+	blind.Complete = false
+	blind.Coverage = full.Coverage
+	blind.WalkFailed = "ps sweep: exit 1"
+	n, err := storeRecordPass(blind, at.Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("a pass that walked nothing closed %d finding(s) on a recognised-only platform", n)
+	}
+	for _, l := range storeReadJournal(t, at) {
+		if l.Transition == "closed" {
+			t.Fatalf("a failed walk wrote a close: %s", storeTransitions(storeReadJournal(t, at)))
+		}
+	}
+	// The same platform, the walk working and the entry really gone: closes.
+	again := storeReport("base-a", storeFinding("aaa", deltaCritical))
+	again.Complete = false
+	again.Coverage = full.Coverage
+	if _, err := storeRecordPass(again, at.Add(2*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	lines := storeReadJournal(t, at)
+	if lines[len(lines)-1].Transition != "closed" {
+		t.Fatalf("a working recognised-only pass must still close: %s", storeTransitions(lines))
+	}
+}
+
+// The pass itself carries the failure to the store: deltaPass on a failed walk
+// must set WalkFailed, or the guard above has nothing to read.
+func TestADeltaPassOnAFailedWalkSaysTheWalkFailed(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	isolateConfigDir(t)
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	failTheWalk(t)
+	r := deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
+	if r.WalkFailed == "" || !strings.Contains(r.WalkFailed, "too many open files") {
+		t.Fatalf("the pass did not carry the failed walk to the store: %+v", r.WalkFailed)
+	}
+	if storeScopeAgrees(r) {
+		t.Fatal("the store would read a failed-walk pass as scope-agreeing")
+	}
+}
+
+// The recognised-only platforms' own path: no unfiltered walk AND the
+// filtered plane fails. Reverting that branch to "return the list, blind"
+// re-creates a zero-entry accounting saved under processes=recognised-only.
+func TestNoBaselineIsTakenOnARecognisedOnlyPlatformWhenTheWalkFails(t *testing.T) {
+	prev := baselineAllProcessesFn
+	t.Cleanup(func() { baselineAllProcessesFn = prev })
+	baselineAllProcessesFn = func() ([]agentObs, bool) { return nil, false }
+	failTheWalk(t)
+	f, _, _, _, err := collectBaseline()
+	if err == nil {
+		t.Fatalf("a recognised-only platform took an accounting from a failed walk: coverage=%q entries=%d", f.Coverage, len(f.Entries))
+	}
+	if !strings.Contains(err.Error(), "no baseline taken") {
+		t.Fatalf("the refusal must say so: %v", err)
+	}
+}
+
+// A list that arrived WITH an error is not believed by the agents page either.
+func TestTheAgentsPageDisbelievesAListThatCameWithAnError(t *testing.T) {
+	prev := observedAgents
+	t.Cleanup(func() { observedAgents = prev })
+	observedAgents = func() ([]agentObs, error) {
+		return []agentObs{{PID: 4242, Kind: kindAgent, Signature: "claude-code"}}, errors.New("partial walk")
+	}
+	a := collectAgentsView()
+	if a.WalkError == "" || len(a.Rows) != 0 || a.Observed != 0 {
+		t.Fatalf("a list that came with an error was rendered: walk=%q rows=%d", a.WalkError, len(a.Rows))
+	}
+}
+
+// THE BEAT. The detect summary is what the host reads; buried in `note`, a
+// failed walk read as baseline=ok with zero counts — the exact shape of clean.
+func TestTheBeatSummaryCarriesTheFailedWalk(t *testing.T) {
+	r := deltaReport{Baseline: deltaBaselineOK, WalkFailed: "read /proc: too many open files"}
+	b, err := json.Marshal(r.summary())
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m map[string]any
+	if err := json.Unmarshal(b, &m); err != nil {
+		t.Fatal(err)
+	}
+	if m["walk_failed"] != "read /proc: too many open files" {
+		t.Fatalf("the summary does not carry the failed walk in its own key: %s", b)
+	}
+	if b, _ := json.Marshal(deltaReport{Baseline: deltaBaselineOK}.summary()); strings.Contains(string(b), "walk_failed") {
+		t.Fatal("a pass that walked must not carry the key")
+	}
+}
+
+// THE OPERATOR'S PRINT. `observe:delta` printed the all-clear line for a
+// pass that walked nothing, with the failure three lines below it.
+func TestObserveDeltaNeverPrintsTheAllClearForAFailedWalk(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	isolateConfigDir(t)
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	failTheWalk(t)
+	pr, pw, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	stdout := os.Stdout
+	os.Stdout = pw
+	runErr := cmdObserveDelta(false)
+	os.Stdout = stdout
+	_ = pw.Close()
+	var buf strings.Builder
+	if _, err := io.Copy(&buf, pr); err != nil {
+		t.Fatal(err)
+	}
+	if runErr != nil {
+		t.Fatal(runErr)
+	}
+	out := buf.String()
+	if strings.Contains(out, "nothing on this machine is outside what was accounted for") {
+		t.Fatalf("the all-clear was printed for a pass that walked nothing:\n%s", out)
+	}
+	if !strings.Contains(out, "NOTHING WAS COMPARED") || !strings.Contains(out, "too many open files") {
+		t.Fatalf("the print does not say the walk failed:\n%s", out)
+	}
+}
+
+// THE CLOCKS. Grace (keepMissing) and the noise filter (settleHeld) read
+// "absent from this pass" as "came back" / "settled"; on a pass that walked
+// nothing that wiped every gone-clock and every hold, and counted the
+// settled holds as short-lived processes the pass never saw.
+func TestAFailedWalkKeepsTheGoneAndHeldClocks(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	isolateConfigDir(t)
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	loaded, _, err := baselineLoad()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	st := deltaStateLoad(loaded.Digest)
+	st.setMissingSince("fp-gone-nine-minutes", now.Add(-9*time.Minute))
+	st.hold("fp-respawner", now.Add(-time.Minute))
+	if err := st.save(); err != nil {
+		t.Fatal(err)
+	}
+	failTheWalk(t)
+	r := deltaPass(&digestCache{}, now, deltaRoleDaemon)
+	if r.ShortLived != 0 {
+		t.Fatalf("a pass that walked nothing reported %d short-lived process(es)", r.ShortLived)
+	}
+	after := deltaStateLoad(loaded.Digest)
+	if _, ok := after.missingSince("fp-gone-nine-minutes"); !ok {
+		t.Fatal("the failed walk wiped the gone-clock: a disappearance can never mature while walks fail inside the grace window")
+	}
+	if _, ok := after.heldSince("fp-respawner"); !ok {
+		t.Fatal("the failed walk settled the hold: a crash-looping process never reaches 'respawning'")
+	}
+}
+
+// binaryBox stands up an isolated config dir with an accounting whose
+// bastion-binary digest is a fixture file; the returned writer swaps it.
+func binaryBox(t *testing.T) func(string) string {
+	t.Helper()
+	isolateConfigDir(t)
+	fixture := filepath.Join(t.TempDir(), "privatae-bastion")
+	writeBinary := func(body string) string {
+		t.Helper()
+		if _, err := os.Stat(fixture); err == nil {
+			if err := os.Rename(fixture, fixture+".old"); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := os.WriteFile(fixture, []byte(body), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		d, _ := baselineExeDigest(fixture)
+		return d
+	}
+	oldPath := deltaSelfPath
+	deltaSelfPath = fixture
+	t.Cleanup(func() { deltaSelfPath = oldPath })
+	first := writeBinary("version one")
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	base.BastionDigest, base.BastionVersion = first, clientVersion
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	return writeBinary
+}
+
+// THE BINARY RUNG SURVIVES A FAILED WALK. It reads the disk, not the process
+// list, and a swapped bastion is the one finding no flag may suppress — so a
+// pass that walked nothing still carries it (and the host reads that count
+// as real). Nothing pinned `findings = events`; `findings = nil`
+// was green.
+func TestAFailedWalkStillReportsASwappedBinary(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	writeBinary := binaryBox(t)
+	writeBinary("version two — swapped")
+	failTheWalk(t)
+	r := deltaPass(&digestCache{}, time.Now(), deltaRoleDaemon)
+	if r.WalkFailed == "" {
+		t.Fatal("the walk did not fail")
+	}
+	var swapped bool
+	for _, f := range r.Findings {
+		if f.Kind == deltaBinaryChanged {
+			swapped = true
+		}
+	}
+	if !swapped {
+		t.Fatalf("a failed-walk pass dropped the swapped-binary finding: %+v", r.Findings)
+	}
+	if r.Critical+r.High == 0 {
+		t.Fatalf("the swap was carried but not counted: critical=%d high=%d", r.Critical, r.High)
+	}
+}
+
+// THE PRUNE READS STAMPS A FAILED WALK NEVER REFRESHED. Seven days of failed
+// walks would otherwise forget every hold and first-seen silently.
+func TestAFailedWalkDoesNotPruneTheState(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	isolateConfigDir(t)
+	base, _, _, _, err := collectBaseline()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := baselineSave(base); err != nil {
+		t.Fatal(err)
+	}
+	loaded, _, err := baselineLoad()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	st := deltaStateLoad(loaded.Digest)
+	st.seen("fp-eight-days-quiet", now.Add(-8*24*time.Hour))
+	st.hold("fp-eight-days-quiet", now.Add(-8*24*time.Hour))
+	if err := st.save(); err != nil {
+		t.Fatal(err)
+	}
+	failTheWalk(t)
+	deltaPass(&digestCache{}, now, deltaRoleDaemon)
+	after := deltaStateLoad(loaded.Digest)
+	if _, ok := after.heldSince("fp-eight-days-quiet"); !ok {
+		t.Fatal("a failed walk pruned a hold whose stamps it never refreshed")
+	}
+}
+
+// The print, with a finding: "nothing was compared" directly above a critical
+// invites discounting it, so the sentence says what DID run.
+func TestObserveDeltaNamesTheBinaryCheckWhenAFailedWalkStillFoundASwap(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	writeBinary := binaryBox(t)
+	writeBinary("version two — swapped")
+	failTheWalk(t)
+	pr, pw, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	stdout := os.Stdout
+	os.Stdout = pw
+	runErr := cmdObserveDelta(false)
+	os.Stdout = stdout
+	_ = pw.Close()
+	var buf strings.Builder
+	if _, err := io.Copy(&buf, pr); err != nil {
+		t.Fatal(err)
+	}
+	if runErr != nil {
+		t.Fatal(runErr)
+	}
+	out := buf.String()
+	if strings.Contains(out, "NOTHING WAS COMPARED") {
+		t.Fatalf("a pass that found a swapped binary said nothing was compared:\n%s", out)
+	}
+	if !strings.Contains(out, "only the bastion-binary check ran") || !strings.Contains(out, "binary") {
+		t.Fatalf("the print does not name the check that ran:\n%s", out)
+	}
+}
+
+// A successful pass still prunes, and a failed pass still SAVES — the prune
+// gate must not become a dropped save. The save is pinned through the one
+// thing a failed daemon pass writes: the bastion digest it read from disk.
+func TestASuccessfulPassPrunesAndAFailedPassStillSaves(t *testing.T) {
+	if !processIsRoot() {
+		t.Skip("a pass needs machine authority, which is its own test")
+	}
+	binaryBox(t)
+	loaded, _, err := baselineLoad()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	st := deltaStateLoad(loaded.Digest)
+	// A first-seen/last-seen pair is what only the PRUNE removes (a hold is
+	// also settled by the noise filter on a walked pass, which would pass this
+	// test with the prune deleted).
+	st.seen("fp-eight-days-quiet", now.Add(-8*24*time.Hour))
+	if err := st.save(); err != nil {
+		t.Fatal(err)
+	}
+	if deltaStateLoad(loaded.Digest).BastionDigest != "" {
+		t.Fatal("fixture: the state already carries a bastion digest")
+	}
+	failTheWalk(t)
+	deltaPass(&digestCache{}, now, deltaRoleDaemon)
+	after := deltaStateLoad(loaded.Digest)
+	if after.BastionDigest == "" {
+		t.Fatal("a failed-walk pass did not save its state (the bastion digest it read is missing)")
+	}
+	if _, ok := after.FirstSeen["fp-eight-days-quiet"]; !ok {
+		t.Fatal("a failed walk pruned")
+	}
+	scanProcessesFn = scanProcesses // the walk works again
+	deltaPass(&digestCache{}, now, deltaRoleDaemon)
+	if _, ok := deltaStateLoad(loaded.Digest).FirstSeen["fp-eight-days-quiet"]; ok {
+		t.Fatal("a successful pass did not prune an eight-day-old entry")
+	}
+}
+
+// The retake-close note, on a pass that could not walk, does not promise a
+// re-open "on this pass".
+func TestTheRetakeNoteOnAFailedWalkDoesNotPromiseAReopenNow(t *testing.T) {
+	isolateConfigDir(t)
+	at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
+	if _, err := storeRecordPass(storeReport("base-a", storeFinding("aaa", deltaHigh)), at); err != nil {
+		t.Fatal(err)
+	}
+	retaken := storeReport("base-b")
+	retaken.WalkFailed = "ps sweep: exit 1"
+	if _, err := storeRecordPass(retaken, at.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	lines := storeReadJournal(t, at)
+	var closed *storeLine
+	for i := range lines {
+		if lines[i].Transition == "closed" {
+			closed = &lines[i]
+		}
+	}
+	if closed == nil {
+		t.Fatalf("the retake did not close the old finding: %s", storeTransitions(lines))
+	}
+	if strings.Contains(closed.Note, "re-open on this pass") || !strings.Contains(closed.Note, "could not walk") {
+		t.Fatalf("the retake note on a failed walk is wrong: %q", closed.Note)
+	}
+}