242 lines
9.0 KiB
TypeScript
242 lines
9.0 KiB
TypeScript
/**
|
|
* Tests for tree-permissions.ts.
|
|
*
|
|
* The load-bearing case is the one from the field report: a directory that came
|
|
* across without its search bit makes `tar` fail with `Cannot stat` on the files
|
|
* *inside* it, so the repair has to fix directory modes, not just ownership.
|
|
* These tests run unprivileged, so they exercise the mode axis for real and the
|
|
* ownership axis only as far as an unprivileged process can (target resolution +
|
|
* graceful EPERM), which is the same shape CI runs in.
|
|
*/
|
|
import assert from 'node:assert/strict';
|
|
import { chmodSync, mkdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { test } from 'node:test';
|
|
|
|
import {
|
|
didRepair,
|
|
manualRepairHint,
|
|
normalizeTreePermissions,
|
|
resolveWorkspaceOwner,
|
|
} from './tree-permissions';
|
|
|
|
function scratch(name: string): string {
|
|
const dir = join(tmpdir(), `tree-perms-${name}-${process.pid}`);
|
|
rmSync(dir, { recursive: true, force: true });
|
|
mkdirSync(dir, { recursive: true });
|
|
return dir;
|
|
}
|
|
|
|
test('restores the search bit on a directory that lost it', () => {
|
|
const root = scratch('searchbit');
|
|
const models = join(root, 'agent-output', 'app', 'models');
|
|
mkdirSync(models, { recursive: true });
|
|
writeFileSync(join(models, 'bill.rb'), 'class Bill; end\n');
|
|
// r-- : readdir works, so tar can NAME the file, but stat is refused.
|
|
chmodSync(models, 0o400);
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
assert.equal(statSync(models).mode & 0o700, 0o700, 'owner rwx restored on the directory');
|
|
assert.ok(report.modeFixed.some((p) => p === models));
|
|
assert.ok(didRepair(report));
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('recurses into a directory it had to widen first', () => {
|
|
const root = scratch('recurse');
|
|
const inner = join(root, 'locked', 'deeper');
|
|
mkdirSync(inner, { recursive: true });
|
|
const leaf = join(inner, 'leaf.rb');
|
|
writeFileSync(leaf, 'x\n');
|
|
chmodSync(leaf, 0o000);
|
|
chmodSync(inner, 0o400);
|
|
chmodSync(join(root, 'locked'), 0o400);
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
// Only reachable if the walk widened each parent before descending.
|
|
assert.equal(statSync(leaf).mode & 0o600, 0o600, 'leaf became owner-readable');
|
|
assert.ok(report.modeFixed.includes(leaf));
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('leaves already-correct trees untouched', () => {
|
|
const root = scratch('noop');
|
|
mkdirSync(join(root, 'sub'), { recursive: true });
|
|
writeFileSync(join(root, 'sub', 'f.txt'), 'hi\n');
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
assert.deepEqual(report.modeFixed, [], 'no mode changes');
|
|
assert.deepEqual(report.ownerFixed, [], 'no owner changes (already ours)');
|
|
assert.deepEqual(report.failures, []);
|
|
assert.equal(didRepair(report), false);
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('does not widen group/other beyond what was already there', () => {
|
|
const root = scratch('narrow');
|
|
const f = join(root, 'secret.txt');
|
|
writeFileSync(f, 'x\n');
|
|
chmodSync(f, 0o000);
|
|
|
|
normalizeTreePermissions(root);
|
|
|
|
const mode = statSync(f).mode & 0o777;
|
|
assert.equal(mode, 0o600, 'owner rw only — group/other stay closed');
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('ignores symlinks rather than following them out of the tree', () => {
|
|
const root = scratch('symlink');
|
|
const outside = scratch('symlink-outside');
|
|
const victim = join(outside, 'victim.txt');
|
|
writeFileSync(victim, 'x\n');
|
|
chmodSync(victim, 0o000);
|
|
symlinkSync(outside, join(root, 'link'));
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
assert.equal(statSync(victim).mode & 0o777, 0o000, 'target outside the tree untouched');
|
|
assert.deepEqual(report.failures, []);
|
|
rmSync(root, { recursive: true, force: true });
|
|
rmSync(outside, { recursive: true, force: true });
|
|
});
|
|
|
|
test('never throws on a missing root, and reports it', () => {
|
|
const report = normalizeTreePermissions(join(tmpdir(), 'definitely-not-here-xyz'));
|
|
assert.equal(report.failures.length, 1);
|
|
assert.equal(report.failures[0].reason, 'ENOENT');
|
|
});
|
|
|
|
test('resolveWorkspaceOwner reads the reference path, not the caller', () => {
|
|
const root = scratch('owner');
|
|
const owner = resolveWorkspaceOwner(root);
|
|
assert.ok(owner, 'resolved');
|
|
const st = statSync(root);
|
|
assert.equal(owner.uid, st.uid);
|
|
assert.equal(owner.gid, st.gid);
|
|
assert.equal(resolveWorkspaceOwner(join(tmpdir(), 'nope-xyz')), null);
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('never chowns TO root, even when the owner ref is root-owned', () => {
|
|
// The regression this guards: workspace root owned by root (unzipped with
|
|
// sudo) while the task files are correctly owned by the human. Chowning to the
|
|
// ref's owner would inflict the very lockout this module prevents. `/` is
|
|
// root-owned on every platform we run on, so it's a stable stand-in.
|
|
const root = scratch('root-ref');
|
|
const f = join(root, 'mine.txt');
|
|
writeFileSync(f, 'x\n');
|
|
const beforeUid = statSync(f).uid;
|
|
|
|
const report = normalizeTreePermissions(root, { ownerRef: '/' });
|
|
|
|
assert.equal(report.target?.uid, 0, 'resolved a root target');
|
|
assert.deepEqual(report.ownerFixed, [], 'declined to chown anything to root');
|
|
assert.deepEqual(report.failures, [], 'and did not fail trying');
|
|
assert.equal(statSync(f).uid, beforeUid, 'owner untouched');
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('still normalizes modes when the chown target is root', () => {
|
|
const root = scratch('root-ref-modes');
|
|
const sub = join(root, 'sub');
|
|
mkdirSync(sub, { recursive: true });
|
|
writeFileSync(join(sub, 'f.txt'), 'x\n');
|
|
chmodSync(sub, 0o400);
|
|
|
|
const report = normalizeTreePermissions(root, { ownerRef: '/' });
|
|
|
|
assert.equal(statSync(sub).mode & 0o700, 0o700, 'mode axis still applied');
|
|
assert.ok(report.modeFixed.includes(sub));
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('walks a tree as deep as the filesystem allows', () => {
|
|
const root = scratch('deep');
|
|
// PATH_MAX caps how deep a tree can physically get (~300 levels at these name
|
|
// lengths — building deeper fails with ENAMETOOLONG), which is well inside any
|
|
// call-stack limit. So this isn't a stack test; it just pins that a deep,
|
|
// narrow tree walks cleanly end to end.
|
|
let path = root;
|
|
for (let i = 0; i < 250; i++) {
|
|
path = join(path, `d${i}`);
|
|
}
|
|
mkdirSync(path, { recursive: true });
|
|
writeFileSync(join(path, 'leaf.txt'), 'x\n');
|
|
chmodSync(join(path, 'leaf.txt'), 0o000);
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
assert.deepEqual(report.failures, [], 'walked the whole depth cleanly');
|
|
assert.equal(statSync(join(path, 'leaf.txt')).mode & 0o600, 0o600, 'reached the deepest leaf');
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('a failure in one subtree does not abandon the rest', () => {
|
|
const root = scratch('partial');
|
|
const good = join(root, 'good');
|
|
mkdirSync(good, { recursive: true });
|
|
const goodFile = join(good, 'f.txt');
|
|
writeFileSync(goodFile, 'x\n');
|
|
chmodSync(goodFile, 0o000);
|
|
// A dangling symlink and a vanished path both produce per-entry trouble.
|
|
symlinkSync(join(root, 'nowhere'), join(root, 'dangling'));
|
|
|
|
const report = normalizeTreePermissions(root);
|
|
|
|
assert.equal(statSync(goodFile).mode & 0o600, 0o600, 'the healthy subtree was still repaired');
|
|
assert.ok(report.modeFixed.includes(goodFile));
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('reports rather than throws when the root is a file, not a directory', () => {
|
|
const root = scratch('file-root');
|
|
const f = join(root, 'lonely.txt');
|
|
writeFileSync(f, 'x\n');
|
|
chmodSync(f, 0o000);
|
|
|
|
const report = normalizeTreePermissions(f);
|
|
|
|
assert.equal(statSync(f).mode & 0o600, 0o600);
|
|
assert.deepEqual(report.failures, []);
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('RACCOON_SKIP_PERMISSION_REPAIR=1 makes it a total no-op', () => {
|
|
const root = scratch('killswitch');
|
|
const sub = join(root, 'sub');
|
|
mkdirSync(sub, { recursive: true });
|
|
const f = join(sub, 'f.txt');
|
|
writeFileSync(f, 'x\n');
|
|
chmodSync(f, 0o000);
|
|
chmodSync(sub, 0o400);
|
|
|
|
const prev = process.env.RACCOON_SKIP_PERMISSION_REPAIR;
|
|
process.env.RACCOON_SKIP_PERMISSION_REPAIR = '1';
|
|
try {
|
|
const report = normalizeTreePermissions(root);
|
|
assert.equal(report.skipped, true);
|
|
assert.deepEqual(report.modeFixed, []);
|
|
assert.deepEqual(report.ownerFixed, []);
|
|
assert.deepEqual(report.failures, []);
|
|
assert.equal(didRepair(report), false);
|
|
assert.equal(statSync(sub).mode & 0o777, 0o400, 'directory left exactly as it was');
|
|
} finally {
|
|
if (prev === undefined) delete process.env.RACCOON_SKIP_PERMISSION_REPAIR;
|
|
else process.env.RACCOON_SKIP_PERMISSION_REPAIR = prev;
|
|
}
|
|
chmodSync(sub, 0o700);
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
test('manual hint repairs both axes, ownership first', () => {
|
|
const hint = manualRepairHint('harbor-tasks/my-slug');
|
|
assert.match(hint, /chown -R/);
|
|
assert.match(hint, /chmod -R u\+rwX/);
|
|
assert.ok(hint.indexOf('chown') < hint.indexOf('chmod'), 'chown before chmod');
|
|
});
|