94 lines
3.4 KiB
Python
94 lines
3.4 KiB
Python
"""Test perms"""
|
|
|
|
import os
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.parametrize("autoperms", ["notest", "unset", "true", "false"])
|
|
@pytest.mark.usefixtures("ds1_copy")
|
|
def test_perms(runner, yadm_cmd, paths, ds1, autoperms):
|
|
"""Test perms"""
|
|
# set the value of auto-perms
|
|
if autoperms != "notest":
|
|
if autoperms != "unset":
|
|
os.system(" ".join(yadm_cmd("config", "yadm.auto-perms", autoperms)))
|
|
|
|
# privatepaths will hold all paths that should become secured
|
|
privatepaths = [paths.work.join(".ssh"), paths.work.join(".gnupg")]
|
|
privatepaths += [paths.work.join(private.path) for private in ds1.private]
|
|
|
|
# create an archive file
|
|
os.system(f'touch "{str(paths.archive)}"')
|
|
privatepaths.append(paths.archive)
|
|
|
|
# create encrypted file test data
|
|
efile1 = paths.work.join("efile1")
|
|
efile1.write("efile1")
|
|
efile2 = paths.work.join("efile2")
|
|
efile2.write("efile2")
|
|
paths.encrypt.write("efile1\nefile2\n!efile1\n")
|
|
insecurepaths = [efile1]
|
|
privatepaths.append(efile2)
|
|
|
|
# assert these paths begin unsecured
|
|
for private in privatepaths + insecurepaths:
|
|
assert not oct(private.stat().mode).endswith("00"), "Path started secured"
|
|
|
|
cmd = "perms"
|
|
if autoperms != "notest":
|
|
cmd = "status"
|
|
run = runner(yadm_cmd(cmd), env={"HOME": paths.work})
|
|
assert run.success
|
|
assert run.err == ""
|
|
if cmd == "perms":
|
|
assert run.out == ""
|
|
|
|
# these paths should be secured if processing perms
|
|
for private in privatepaths:
|
|
if autoperms == "false":
|
|
assert not oct(private.stat().mode).endswith("00"), "Path should not be secured"
|
|
else:
|
|
assert oct(private.stat().mode).endswith("00"), "Path has not been secured"
|
|
|
|
# these paths should never be secured
|
|
for private in insecurepaths:
|
|
assert not oct(private.stat().mode).endswith("00"), "Path should not be secured"
|
|
|
|
|
|
@pytest.mark.parametrize("sshperms", [None, "true", "false"])
|
|
@pytest.mark.parametrize("gpgperms", [None, "true", "false"])
|
|
@pytest.mark.usefixtures("ds1_copy")
|
|
def test_perms_control(runner, yadm_cmd, paths, ds1, sshperms, gpgperms):
|
|
"""Test fine control of perms"""
|
|
# set the value of ssh-perms
|
|
if sshperms:
|
|
os.system(" ".join(yadm_cmd("config", "yadm.ssh-perms", sshperms)))
|
|
|
|
# set the value of gpg-perms
|
|
if gpgperms:
|
|
os.system(" ".join(yadm_cmd("config", "yadm.gpg-perms", gpgperms)))
|
|
|
|
# privatepaths will hold all paths that should become secured
|
|
privatepaths = [paths.work.join(".ssh"), paths.work.join(".gnupg")]
|
|
privatepaths += [paths.work.join(private.path) for private in ds1.private]
|
|
|
|
# assert these paths begin unsecured
|
|
for private in privatepaths:
|
|
assert not oct(private.stat().mode).endswith("00"), "Path started secured"
|
|
|
|
run = runner(yadm_cmd("perms"), env={"HOME": paths.work})
|
|
assert run.success
|
|
assert run.err == ""
|
|
assert run.out == ""
|
|
|
|
# these paths should be secured if processing perms
|
|
for private in privatepaths:
|
|
if (sshperms == "false" and "ssh" in str(private)) or (gpgperms == "false" and "gnupg" in str(private)):
|
|
assert not oct(private.stat().mode).endswith("00"), "Path should not be secured"
|
|
else:
|
|
assert oct(private.stat().mode).endswith("00"), "Path has not been secured"
|
|
|
|
# verify permissions aren't changed for the worktree
|
|
assert oct(paths.work.stat().mode).endswith("0755")
|