whyno-cli 0.5.0

Linux permission debugger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use whyno_core::checks::{run_checks, CheckReport};
use whyno_core::fix::{generate_fixes, FixPlan};
use whyno_core::operation::{MetadataParams, Operation};
use whyno_core::test_helpers::StateBuilder;

use crate::output::json;

fn render_to_string(
    report: &CheckReport,
    plan: &FixPlan,
    state: &whyno_core::state::SystemState,
) -> String {
    let mut buf = Vec::new();
    json::render(report, plan, state, &mut buf).expect("render should succeed");
    String::from_utf8(buf).expect("output should be valid UTF-8")
}

#[test]
fn all_pass_json() {
    let state = StateBuilder::new()
        .subject(1000, 1000, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component_file("/home/file.txt", 1000, 1000, 0o644)
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);

    // verify it parses as valid JSON.
    let _: serde_json::Value = serde_json::from_str(&output).expect("output must be valid JSON");

    insta::assert_snapshot!(output);
}

#[test]
fn failure_with_fixes_json() {
    let state = StateBuilder::new()
        .subject(33, 33, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component("/var", 0, 0, 0o755)
        .component_file("/var/log.txt", 0, 0, 0o640)
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);

    let parsed: serde_json::Value =
        serde_json::from_str(&output).expect("output must be valid JSON");
    assert_eq!(parsed["version"], 1);
    assert_eq!(parsed["result"], "denied");

    insta::assert_snapshot!(output);
}

#[test]
fn nosuid_warning_in_json() {
    let state = StateBuilder::new()
        .subject(1000, 1000, vec![])
        .operation(Operation::Execute)
        .component("/", 0, 0, 0o755)
        .component_file("/mnt/suid_bin", 0, 0, 0o4755)
        .mount("/mnt", "ext4", "nosuid")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);

    let parsed: serde_json::Value =
        serde_json::from_str(&output).expect("output must be valid JSON");
    let mount_layer = &parsed["layers"][0];
    assert_eq!(mount_layer["result"], "pass");
    assert!(
        mount_layer["warnings"]
            .as_array()
            .expect("warnings must be array")
            .len()
            == 1
    );

    insta::assert_snapshot!(output);
}

#[test]
fn schema_output_is_stable() {
    let schema = json::generate_schema();
    let output = serde_json::to_string_pretty(&schema).expect("schema should serialize");
    insta::assert_snapshot!(output);
}

#[test]
fn degraded_layers_in_json() {
    let state = StateBuilder::new()
        .subject(33, 33, vec![])
        .operation(Operation::Read)
        .component("/", 0, 0, 0o755)
        .component_inaccessible("/secret")
        .mount("/", "ext4", "rw")
        .build();
    let report = run_checks(&state, &MetadataParams::default());
    let plan = generate_fixes(&report, &state, &MetadataParams::default());
    let output = render_to_string(&report, &plan, &state);

    let parsed: serde_json::Value =
        serde_json::from_str(&output).expect("output must be valid JSON");
    assert!(!parsed["degraded"]
        .as_array()
        .expect("degraded must be array")
        .is_empty());

    insta::assert_snapshot!(output);
}