JezK

Edit File: spawner_privilege_lowering_spec.rb

require 'support/config'
require 'etc'
require 'yaml'

shared_examples_for "a spawner that supports lowering of privileges" do
	before :each do
		@stub = setup_rails_stub('foobar')
		@environment_rb = @stub.environment_rb
		@original_uid = File.stat(@environment_rb).uid
		File.append(@environment_rb, %q{
			require 'yaml'
			info = {
				:username => `whoami`.strip,
				:user_id  => `id -u`.strip.to_i,
				:group_id => `id -g`.strip.to_i,
				:groups   => `groups "#{`whoami`.strip}"`.strip,
				:home     => ENV['HOME']
			}
			File.open("#{RAILS_ROOT}/dump.yml", 'w') do |f|
				YAML::dump(info, f)
			end
		})
	end
	
	after :each do
		@stub.destroy
	end
	
	it "lowers its privileges to the owner of environment.rb" do
		File.chown(uid_for('normal_user_1'), nil, @environment_rb)
		spawn_stub_application do |app|
			read_dumped_info[:username].should == CONFIG['normal_user_1']
		end
	end
	
	it "switches the group to environment.rb's owner's primary group, after lowering privileges" do
		File.chown(uid_for('normal_user_1'), nil, @environment_rb)
		spawn_stub_application do |app|
			expected_gid = Etc.getpwnam(CONFIG['normal_user_1']).gid
			read_dumped_info[:group_id].should == expected_gid
		end
	end
	
	it "switches supplementary groups to environment.rb's owner's default supplementary groups" do
		File.chown(uid_for('normal_user_1'), nil, @environment_rb)
		spawn_stub_application do |app|
			default_groups = `groups "#{CONFIG['normal_user_1']}"`.strip
			read_dumped_info[:groups].should == default_groups
		end
	end
	
	it "lowers its privileges to 'lowest_user' if environment.rb is owned by root" do
		File.chown(ApplicationSpawner::ROOT_UID, nil, @environment_rb)
		spawn_stub_application do |app|
			read_dumped_info[:username].should == CONFIG['lowest_user']
		end
	end
	
	it "lowers its privileges to 'lowest_user' if environment.rb is owned by a nonexistant user" do
		File.chown(CONFIG['nonexistant_uid'], nil, @environment_rb)
		spawn_stub_application do |app|
			read_dumped_info[:username].should == CONFIG['lowest_user']
		end
	end
	
	it "doesn't switch user if environment.rb is owned by a nonexistant user, and 'lowest_user' doesn't exist either" do
		File.chown(CONFIG['nonexistant_uid'], nil, @environment_rb)
		spawn_stub_application(:lowest_user => CONFIG['nonexistant_user']) do |app|
			read_dumped_info[:username].should == my_username
		end
	end
	
	it "doesn't switch user if 'lower_privilege' is set to false" do
		File.chown(uid_for('normal_user_2'), nil, @environment_rb)
		spawn_stub_application(:lower_privilege => false) do |app|
			read_dumped_info[:username].should == my_username
		end
	end
	
	it "sets $HOME to the user's home directory, after privilege lowering" do
		spawn_stub_application(:lowest_user => CONFIG['normal_user_1']) do |app|
			read_dumped_info[:home].should == Etc.getpwnam(CONFIG['normal_user_1']).dir
		end
	end
	
	def read_dumped_info
		return YAML.load_file("#{@stub.app_root}/dump.yml")
	end
	
	def my_username
		return `whoami`.strip
	end
	
	def uid_for(name)
		return Etc.getpwnam(CONFIG[name]).uid
	end
end

Anmeldung Newsletter | Fairnetzt-Hochrhein