Privatae
92 lines
2.9 KiB
Go
92 lines
2.9 KiB
Go
//go:build !windows
|
|
|
|
package main
|
|
|
|
// Tagged !windows for the reason singleton_test.go states: syscall.Umask does
|
|
// not exist on that target. The rest of the machine store's tests are portable
|
|
// and stay in machinestore_test.go.
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// A day-file that ALREADY EXISTS with a loose mode is tightened before the
|
|
// machine's findings are appended to it.
|
|
//
|
|
// THIS IS THE TEST THE FIRST VERSION GOT WRONG, and the mutation sweep is what
|
|
// said so. That version set the umask to 0 and asserted 0600 — but a umask only
|
|
// ever clears bits, so an O_CREATE of 0600 comes out 0600 under every umask
|
|
// there is, and deleting the chmod under test left it green. What the chmod
|
|
// really guards is the file it did NOT create: O_APPEND|O_CREATE does not touch
|
|
// the mode of an existing file, so a day-file restored from a backup or copied
|
|
// in with `cp -p` keeps whatever mode it arrived with while this process writes
|
|
// the machine's findings into it.
|
|
//
|
|
// The umask is still set to 0, for a different and now-honest reason: it proves
|
|
// the 0644 below is the mode the file really has rather than one the umask
|
|
// happened to allow.
|
|
func TestAnExistingLooseDayFileIsTightenedBeforeItIsAppendedTo(t *testing.T) {
|
|
isolateConfigDir(t)
|
|
old := syscall.Umask(0)
|
|
defer syscall.Umask(old)
|
|
|
|
at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
|
|
p, err := storeDayPath(storeFindings, at)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Arrives world-readable, the way a restored or copied file does.
|
|
if err := os.WriteFile(p, []byte("{}\n"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi, err := os.Stat(p); err != nil || fi.Mode().Perm() != 0o644 {
|
|
t.Fatalf("the fixture is not loose to begin with, so this test cannot fail: %v %v", fi, err)
|
|
}
|
|
|
|
if _, err := storeRecordPass(storeReport("base-a", storeFinding("aaa", deltaHigh)), at); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
fi, err := os.Stat(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi.Mode().Perm() != 0o600 {
|
|
t.Fatalf("journal file is %v, want 0600 — the machine's own record stayed world-readable", fi.Mode().Perm())
|
|
}
|
|
}
|
|
|
|
// The writer's own state file is bookkeeping the host must not be able to
|
|
// reach: a file the host could write is a file that could suppress a finding by
|
|
// pre-declaring it open.
|
|
func TestTheWritersStateFileIsOwnerOnly(t *testing.T) {
|
|
isolateConfigDir(t)
|
|
old := syscall.Umask(0)
|
|
defer syscall.Umask(old)
|
|
|
|
at := time.Date(2026, 9, 19, 10, 0, 0, 0, time.UTC)
|
|
sp, err := storeStatePath()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(sp), 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(sp, []byte("{}"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := storeRecordPass(storeReport("base-a", storeFinding("aaa", deltaHigh)), at); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
fi, err := os.Stat(sp)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi.Mode().Perm() != 0o600 {
|
|
t.Fatalf("store state is %v, want 0600", fi.Mode().Perm())
|
|
}
|
|
}
|