Privatae
45 lines
1.8 KiB
Go
45 lines
1.8 KiB
Go
package main
|
|
|
|
// The agent's credential for a harness run is a file in a folder mounted into
|
|
// the container. No other local user may reach either: as root the bastion
|
|
// hands both to the container's user, owner-only; as anyone else it opens them
|
|
// for that user, inside a folder only the bastion can enter.
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestTheHarnessCredentialIsReadableOnlyByTheContainersUser(t *testing.T) {
|
|
// A stand-in runtime: on `run` it records the mode and owner of the folder
|
|
// the credential folder sits in, of that folder and of the file, then
|
|
// fails, so the run stops there.
|
|
bin := t.TempDir()
|
|
record := filepath.Join(bin, "record")
|
|
rt := filepath.Join(bin, "runtime")
|
|
script := "#!/bin/sh\n[ \"$1\" = run ] || exit 1\nfor a; do case \"$a\" in *:/home/privatae/.claude) d=${a%:/home/privatae/.claude};; esac; done\n" +
|
|
"[ -n \"$d\" ] && stat -c '%a %u %g' \"$(dirname \"$d\")\" \"$d\" \"$d/.credentials.json\" > " + record + "\nexit 1\n"
|
|
if err := os.WriteFile(rt, []byte(script), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
spec := harnessSpec{HarnessID: "h1", Image: "harness:test", AgentCreds: `{"claudeAiOauth":{}}`}
|
|
if _, err := driveHarnessAgent(rt, t.TempDir(), spec, 1); err == nil {
|
|
t.Fatal("the stand-in runtime fails the start; the run must report it")
|
|
}
|
|
got, err := os.ReadFile(record)
|
|
if err != nil {
|
|
t.Fatalf("the credential folder was not mounted: %v", err)
|
|
}
|
|
self := strconv.Itoa(os.Geteuid()) + " " + strconv.Itoa(os.Getegid())
|
|
want := "700 " + self + "\n777 " + self + "\n666 " + self
|
|
if os.Geteuid() == 0 {
|
|
want = "700 " + self + "\n700 10005 10005\n600 10005 10005" // the harness image's user
|
|
}
|
|
if strings.TrimSpace(string(got)) != want {
|
|
t.Fatalf("enclosing folder, folder, then file: want %q, got %q", want, strings.TrimSpace(string(got)))
|
|
}
|
|
}
|