mirror of
https://github.com/morluto/rea.git
synced 2026-11-12 09:52:27 +00:00
3345019fe1
* fix(process): recognize permission-denied user namespace peers * fix(process): fall back to UID maps when namespace links are denied --------- Co-authored-by: dhruvac29 <dhruvac29@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
87 lines
2.4 KiB
TypeScript
87 lines
2.4 KiB
TypeScript
import { expect, it } from "vitest";
|
|
|
|
import {
|
|
linuxEnvironmentRestriction,
|
|
linuxUidMapsDiffer,
|
|
parseLinuxProcessIds,
|
|
} from "./LinuxProcessStatus.js";
|
|
|
|
it("parses the single native status Uid and Gid rows", () => {
|
|
const status =
|
|
"Name:\tworker\nUid:\t1000\t1001\t1002\t1003\nGid:\t20\t21\t22\t23\n";
|
|
expect(parseLinuxProcessIds(status, "Uid")).toEqual([1000, 1001, 1002, 1003]);
|
|
expect(parseLinuxProcessIds(status, "Gid")).toEqual([20, 21, 22, 23]);
|
|
});
|
|
|
|
it.each([
|
|
"Name:\tworker\n",
|
|
"Uid:\t1000\t1001\t1002\n",
|
|
"Uid:\t1000\t1001\t1002\t1003\nUid:\t1000\t1001\t1002\t1003\n",
|
|
"Uid:\t1000\t-1\t1002\t1003\n",
|
|
"Uid:\t1000\t9007199254740992\t1002\t1003\n",
|
|
"Uid:\t1000\t1001\t1002\t1003 extra\n",
|
|
])("does not infer IDs from malformed status: %s", (status) => {
|
|
expect(parseLinuxProcessIds(status, "Uid")).toBeUndefined();
|
|
});
|
|
|
|
const caller = { callerUid: 1000, callerGid: 1000 } as const;
|
|
const matching = [1000, 1000, 1000, 1000] as const;
|
|
|
|
it.each([
|
|
[
|
|
"a setgid program",
|
|
{ uids: matching, gids: [1000, 2, 2, 2], procfsOwnerUid: 1000 },
|
|
"credentials",
|
|
],
|
|
[
|
|
"a saved UID from another account",
|
|
{ uids: [1000, 1000, 0, 1000], gids: matching, procfsOwnerUid: 1000 },
|
|
"credentials",
|
|
],
|
|
[
|
|
"a non-dumpable process",
|
|
{ uids: matching, gids: matching, procfsOwnerUid: 0 },
|
|
"non-dumpable",
|
|
],
|
|
[
|
|
"an inspectable process",
|
|
{ uids: matching, gids: matching, procfsOwnerUid: 1000 },
|
|
undefined,
|
|
],
|
|
[
|
|
"a process with unknown procfs ownership and GIDs",
|
|
{ uids: matching, gids: undefined, procfsOwnerUid: undefined },
|
|
undefined,
|
|
],
|
|
] as const)(
|
|
"derives the kernel environment restriction for %s",
|
|
(_name, facts, expected) => {
|
|
expect(linuxEnvironmentRestriction({ ...caller, ...facts })).toBe(expected);
|
|
},
|
|
);
|
|
|
|
it("does not derive a credential restriction without caller credentials", () => {
|
|
expect(
|
|
linuxEnvironmentRestriction({
|
|
uids: [0, 0, 0, 0],
|
|
gids: [0, 0, 0, 0],
|
|
procfsOwnerUid: 0,
|
|
callerUid: undefined,
|
|
callerGid: undefined,
|
|
}),
|
|
).toBeUndefined();
|
|
});
|
|
|
|
it.each([
|
|
["0 1000 1\n", "0 0 1\n", true],
|
|
[" 0\t0 1\n", "0 0 1\n", false],
|
|
["", "0 0 1\n", undefined],
|
|
["0 0 1\n", undefined, undefined],
|
|
["0 0 1 extra\n", "0 0 1\n", undefined],
|
|
] as const)(
|
|
"compares readable UID maps conservatively",
|
|
(target, caller, expected) => {
|
|
expect(linuxUidMapsDiffer(target, caller)).toBe(expected);
|
|
},
|
|
);
|