diff options
author | Maximilian Bosch <maximilian@mbosch.me> | 2022-02-01 12:39:00 +0100 |
---|---|---|
committer | Maximilian Bosch <maximilian@mbosch.me> | 2022-02-01 12:55:29 +0100 |
commit | f5b67f3b27bcd60a15a72384faaa93266d12fff9 (patch) | |
tree | bc3d898242330defe3088deb19b26e5bebe10d08 /nixos/tests/sudo.nix | |
parent | 2492da88ea018c067c2dee5b6eef5b65c5283597 (diff) |
nixos/sudo: fix test for 1.9.9
The test failed with > Test "test5 user should not be able to run commands under root" failed with > error: "invalid literal for int() with base 10: ''" since 2492da88ea018c067c2dee5b6eef5b65c5283597. The reason for this is that `sudo(8)` writes the lecture to the tty[1] and only as a fallback to stdout[2]. This means that the `base64 --wrap 0` executed by `machine.execute()` doesn't affect the text written to the terminal, however the lecture is part of the string that's read from the VM via `shell.recv()`. I confirmed the problem in an interactive test session[3]: >>> command = "sudo -u test5 sudo -n -u root true" >>> out_command = f"( set -euo pipefail; {command} ) | (base64 --wrap 0; echo)\n" >>> machine.shell.send(out_command.encode()) 84 >>> machine # [ 99.015512] sudo[877]: root : TTY=hvc0 ; PWD=/tmp ; USER=test5 ; COMMAND=/run/wrappers/bin/sudo -n -u root true machine # [ 99.019373] sudo[877]: pam_unix(sudo:session): session opened for user test5(uid=1005) by (uid=0) machine # [ 99.038692] sudo[879]: pam_unix(sudo:auth): conversation failed machine # sudo: a password is required machine # [ 99.041860] sudo[879]: pam_unix(sudo:auth): auth could not identify password for [test5] machine # [ 99.046901] sudo[877]: pam_unix(sudo:session): session closed for user test5 >>> >>> x=machine._next_newline_closed_block_from_shell() >>> print(x) <newline> We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: <newline> #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. <newline> <newline> <newline> >>> Since the lecture isn't strictly necessary to confirm that `security.sudo` works as expected, I decided to disable lecturing inside the test, however we may want to fix the underlying problem in the test-driver at some point. [1] https://github.com/sudo-project/sudo/blob/SUDO_1_9_9/plugins/sudoers/check.c#L275-L283 [2] https://github.com/sudo-project/sudo/blob/SUDO_1_9_9/src/conversation.c#L95-L120 [3] I replaced each empty line with `<newline>` to make sure these aren't swallowed by git.
Diffstat (limited to 'nixos/tests/sudo.nix')
-rw-r--r-- | nixos/tests/sudo.nix | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix index ae9362ca70da0..661fe9989e7a8 100644 --- a/nixos/tests/sudo.nix +++ b/nixos/tests/sudo.nix @@ -28,6 +28,10 @@ in enable = true; wheelNeedsPassword = false; + extraConfig = '' + Defaults lecture="never" + ''; + extraRules = [ # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output; # errors being detected by the visudo checks. |