75 lines
4.0 KiB
Diff
75 lines
4.0 KiB
Diff
From a2ef19e48a53cc83b3a6f433013d8ff4e8f5d618 Mon Sep 17 00:00:00 2001
|
|
From: Brian Coca <brian.coca+git@gmail.com>
|
|
Date: Thu, 2 Apr 2020 11:07:51 -0400
|
|
Subject: [PATCH] stricter permissions on atomic_move when creating new file
|
|
|
|
---
|
|
test/units/module_utils/basic/test_atomic_move.py | 13 ++++++++-----
|
|
1 file changed, 8 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/test/units/module_utils/basic/test_atomic_move.py b/test/units/module_utils/basic/test_atomic_move.py
|
|
index d1dc4d7..a44ebc5 100644
|
|
--- a/test/units/module_utils/basic/test_atomic_move.py
|
|
+++ b/test/units/module_utils/basic/test_atomic_move.py
|
|
@@ -59,7 +59,7 @@ def atomic_mocks(mocker):
|
|
@pytest.fixture
|
|
def fake_stat(mocker):
|
|
stat1 = mocker.MagicMock()
|
|
- stat1.st_mode = 0o0644
|
|
+ stat1.st_mode = 0o0640
|
|
stat1.st_uid = 0
|
|
stat1.st_gid = 0
|
|
yield stat1
|
|
@@ -75,7 +75,8 @@ def test_new_file(atomic_am, atomic_mocks, mocker, selinux):
|
|
atomic_am.atomic_move('/path/to/src', '/path/to/dest')
|
|
|
|
atomic_mocks['rename'].assert_called_with(b'/path/to/src', b'/path/to/dest')
|
|
- assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/dest', basic.DEFAULT_PERM & ~18)]
|
|
+ # 416 is what we expect with default perms set to 0640
|
|
+ assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/dest', 416)]
|
|
|
|
if selinux:
|
|
assert atomic_am.selinux_default_context.call_args_list == [mocker.call('/path/to/dest')]
|
|
@@ -96,7 +97,7 @@ def test_existing_file(atomic_am, atomic_mocks, fake_stat, mocker, selinux):
|
|
atomic_am.atomic_move('/path/to/src', '/path/to/dest')
|
|
|
|
atomic_mocks['rename'].assert_called_with(b'/path/to/src', b'/path/to/dest')
|
|
- assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/src', basic.DEFAULT_PERM & ~18)]
|
|
+ assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/src', 416)]
|
|
|
|
if selinux:
|
|
assert atomic_am.set_context_if_different.call_args_list == [mocker.call('/path/to/dest', mock_context, False)]
|
|
@@ -119,10 +120,10 @@ def test_no_tty_fallback(atomic_am, atomic_mocks, fake_stat, mocker):
|
|
atomic_am.atomic_move('/path/to/src', '/path/to/dest')
|
|
|
|
atomic_mocks['rename'].assert_called_with(b'/path/to/src', b'/path/to/dest')
|
|
- assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/src', basic.DEFAULT_PERM & ~18)]
|
|
|
|
assert atomic_am.set_context_if_different.call_args_list == [mocker.call('/path/to/dest', mock_context, False)]
|
|
assert atomic_am.selinux_context.call_args_list == [mocker.call('/path/to/dest')]
|
|
+ atomic_am.atomic_move('/path/to/src', '/path/to/dest')
|
|
|
|
|
|
@pytest.mark.parametrize('stdin', [{}], indirect=['stdin'])
|
|
@@ -150,6 +151,8 @@ def test_existing_file_stat_perms_failure(atomic_am, atomic_mocks, mocker):
|
|
# FIXME: Should atomic_move() set a default permission value when it cannot retrieve the
|
|
# existing file's permissions? (Right now it's up to the calling code.
|
|
# assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/src', basic.DEFAULT_PERM & ~18)]
|
|
+ # atomic_move() will set a default permission value whenit cannot retrieve the
|
|
+ # existing file's permissions.
|
|
assert atomic_am.set_context_if_different.call_args_list == [mocker.call('/path/to/dest', mock_context, False)]
|
|
assert atomic_am.selinux_context.call_args_list == [mocker.call('/path/to/dest')]
|
|
|
|
@@ -206,7 +209,7 @@ def test_rename_perms_fail_temp_succeeds(atomic_am, atomic_mocks, fake_stat, moc
|
|
atomic_am.atomic_move('/path/to/src', '/path/to/dest')
|
|
assert atomic_mocks['rename'].call_args_list == [mocker.call(b'/path/to/src', b'/path/to/dest'),
|
|
mocker.call(b'/path/to/tempfile', b'/path/to/dest')]
|
|
- assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/dest', basic.DEFAULT_PERM & ~18)]
|
|
+ assert atomic_mocks['chmod'].call_args_list == [mocker.call(b'/path/to/dest', 416)]
|
|
|
|
if selinux:
|
|
assert atomic_am.selinux_default_context.call_args_list == [mocker.call('/path/to/dest')]
|
|
--
|
|
2.23.0
|
|
|