|
| 1 | +############################################################################## |
| 2 | +# |
| 3 | +# Test that agent can override the immutable bit when using acl attribute |
| 4 | +# |
| 5 | +############################################################################## |
| 6 | + |
| 7 | +body common control |
| 8 | +{ |
| 9 | + inputs => { "../../default.cf.sub" }; |
| 10 | + bundlesequence => { default("$(this.promise_filename)") }; |
| 11 | + version => "1.0"; |
| 12 | +} |
| 13 | + |
| 14 | +body fsattrs set_immutable |
| 15 | +{ |
| 16 | + immutable => "true"; |
| 17 | +} |
| 18 | + |
| 19 | +body acl acl_user_root_rw |
| 20 | +{ |
| 21 | + acl_method => "append"; |
| 22 | + aces => { "user:root:rw" }; |
| 23 | +} |
| 24 | + |
| 25 | +body acl acl_user_root_rwx |
| 26 | +{ |
| 27 | + acl_method => "append"; |
| 28 | + aces => { "user:root:rwx" }; |
| 29 | +} |
| 30 | + |
| 31 | +bundle agent init |
| 32 | +{ |
| 33 | + files: |
| 34 | + "/tmp/immutable_10.txt" |
| 35 | + create => "true", |
| 36 | + acl => acl_user_root_rw; |
| 37 | + |
| 38 | + commands: |
| 39 | + "chattr +i /tmp/immutable_10.txt" |
| 40 | + contain => in_shell; |
| 41 | +} |
| 42 | + |
| 43 | +bundle agent test |
| 44 | +{ |
| 45 | + meta: |
| 46 | + "description" -> { "CFE-1840", "ENT-10961" } |
| 47 | + string => "Test that agent can override the immutable bit on a file while using the acl attribute"; |
| 48 | + |
| 49 | + "test_soft_fail" |
| 50 | + string => "hpux|aix|windows", |
| 51 | + meta => { "CFE-1840", "ENT-10961" }; |
| 52 | + |
| 53 | + files: |
| 54 | + "/tmp/immutable_10.txt" |
| 55 | + fsattrs => set_immutable, |
| 56 | + acl => acl_user_root_rwx; |
| 57 | + |
| 58 | +} |
| 59 | + |
| 60 | +bundle agent check |
| 61 | +{ |
| 62 | + vars: |
| 63 | + "getfacl" |
| 64 | + string => ifelse( |
| 65 | + fileexists("/var/cfengine/bin/getfacl"), # if |
| 66 | + "/var/cfengine/bin/getfacl", # then |
| 67 | + "/usr/bin/getfacl" # else |
| 68 | + ); |
| 69 | + |
| 70 | + "expected" |
| 71 | + string => ".*user:root:rwx.*"; |
| 72 | + "actual" |
| 73 | + string => execresult("$(getfacl) /tmp/immutable_10.txt", "noshell"); |
| 74 | + |
| 75 | + classes: |
| 76 | + "ok" |
| 77 | + expression => regcmp("$(expected)", "$(actual)"); |
| 78 | + |
| 79 | + reports: |
| 80 | + ok:: |
| 81 | + "$(this.promise_filename) Pass"; |
| 82 | + !ok:: |
| 83 | + "$(this.promise_filename) FAIL"; |
| 84 | + any:: |
| 85 | + "Expecting ouput matching '$(expected)', got '$(actual)'"; |
| 86 | +} |
| 87 | + |
| 88 | +bundle agent destroy |
| 89 | +{ |
| 90 | + commands: |
| 91 | + "chattr -i /tmp/immutable_10.txt" |
| 92 | + contain => in_shell, |
| 93 | + handle => "is mutable"; |
| 94 | + |
| 95 | + files: |
| 96 | + "/tmp/immutable_10.txt" |
| 97 | + delete => tidy, |
| 98 | + depends_on => { "is mutable" }; |
| 99 | +} |
0 commit comments