a7n-platform 0.26.2

Native desktop backends for the Apeirogon software KVM
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

// SPDX-License-Identifier: GPL-3.0-or-later

use std::os::unix::{
    fs::{PermissionsExt, symlink},
    net::UnixListener,
};

use super::*;

#[tokio::test]
async fn bind_user_only_wide_directory_is_refused() {
    // Arrange
    let directory = tempfile::tempdir().unwrap();
    fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o755)).unwrap();
    let location = SocketLocation::new(directory.path().join("ipc.sock"));

    // Act
    let result = bind_user_only(&location).await;

    // Assert
    assert!(matches!(result, Err(SocketError::InsecureDirectory(_))));
    assert!(!location.as_path().exists());
}

#[tokio::test]
async fn bind_user_only_private_directory_sets_socket_permissions() {
    // Arrange
    let directory = tempfile::tempdir().unwrap();
    let location = SocketLocation::new(directory.path().join("private/ipc.sock"));

    // Act
    let listener = bind_user_only(&location).await.unwrap();

    // Assert
    assert_eq!(
        fs::symlink_metadata(location.as_path().parent().unwrap())
            .unwrap()
            .mode()
            & PERMISSION_BITS,
        DIRECTORY_MODE
    );
    assert_eq!(
        Mode::from_raw_mode(rustix::fs::stat(location.as_path()).unwrap().st_mode).as_raw_mode(),
        SOCKET_MODE
    );
    drop(listener);
}

#[tokio::test]
async fn bind_user_only_symlink_directory_is_refused() {
    // Arrange
    let directory = tempfile::tempdir().unwrap();
    let target = directory.path().join("target");
    fs::DirBuilder::new()
        .mode(DIRECTORY_MODE)
        .create(&target)
        .unwrap();
    let link = directory.path().join("link");
    symlink(target, &link).unwrap();
    let location = SocketLocation::new(link.join("ipc.sock"));

    // Act
    let result = bind_user_only(&location).await;

    // Assert
    assert!(matches!(result, Err(SocketError::InsecureDirectory(_))));
}

#[tokio::test]
async fn bind_user_only_existing_non_socket_is_preserved() {
    // Arrange
    let directory = tempfile::tempdir().unwrap();
    fs::set_permissions(directory.path(), fs::Permissions::from_mode(DIRECTORY_MODE)).unwrap();
    let location = SocketLocation::new(directory.path().join("ipc.sock"));
    fs::write(location.as_path(), b"keep").unwrap();

    // Act
    let result = bind_user_only(&location).await;

    // Assert
    assert!(matches!(result, Err(SocketError::InsecureSocket(_))));
    assert_eq!(fs::read(location.as_path()).unwrap(), b"keep");
}

#[tokio::test]
async fn connect_insecure_directory_is_refused_before_sending_secrets() {
    // Arrange
    let directory = tempfile::tempdir().unwrap();
    fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o755)).unwrap();
    let location = SocketLocation::new(directory.path().join("ipc.sock"));
    let _listener = UnixListener::bind(location.as_path()).unwrap();

    // Act
    let result = connect(&location).await;

    // Assert
    assert!(matches!(result, Err(SocketError::InsecureDirectory(_))));
}