whyno-cli 0.5.0

Linux permission debugger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

use whyno_core::checks::{run_checks, CheckReport};
use whyno_core::fix::{generate_fixes, FixPlan};
use whyno_core::operation::{MetadataParams, Operation};
use whyno_core::test_helpers::StateBuilder;

use crate::output::checklist;

fn setup_no_color() {
    owo_colors::set_override(false);
}

fn render_to_string(
    report: &CheckReport,
    plan: &FixPlan,
    state: &whyno_core::state::SystemState,
) -> String {
    let mut buf = Vec::new();
    checklist::render(report, plan, state, &mut buf).expect("render should succeed");
    String::from_utf8(buf).expect("output should be valid UTF-8")
}

#[test]
fn all_pass_scenario() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(1000, 1000, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component("/home", 0, 0, 0o755)
        .component_file("/home/file.txt", 1000, 1000, 0o644)
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}

#[test]
fn single_layer_failure_with_fix() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(33, 33, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component("/var", 0, 0, 0o755)
        .component_file("/var/log.txt", 0, 0, 0o640)
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}

#[test]
fn multi_layer_failure_with_fix_plan() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(33, 33, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component("/var", 0, 0, 0o700)
        .component_file("/var/secret.txt", 0, 0, 0o600)
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}

#[test]
fn degraded_layer_shows_skip() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(33, 33, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component_inaccessible("/secret")
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}

#[test]
fn nosuid_warning_on_execute_with_suid_target() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(1000, 1000, vec![])
        .operation(Operation::Execute)
        .component("/", 0, 0, 0o755)
        .component_file("/mnt/suid_bin", 0, 0, 0o4755)
        .mount("/mnt", "ext4", "nosuid")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}

#[test]
fn ro_mount_failure() {
    setup_no_color();
    let state = StateBuilder::new()
        .subject(1000, 1000, vec![])
        .operation(Operation::Write)
        .component("/", 0, 0, 0o755)
        .component_file("/mnt/data.txt", 1000, 1000, 0o644)
        .mount("/mnt", "ext4", "ro")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);
    insta::assert_snapshot!(output);
}