security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

system: include more info in ACL Stringer
test / test (push) Successful in 24s Details 

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-10-25 16:23:22 +09:00
parent eb767e7642
commit 2a348c7f91
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
3 changed files with 35 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
acl/export.go
View File

@ -25,7 +25,25 @@ const (
Other = C.ACL_OTHER Other = C.ACL_OTHER
) )
type Perm C.acl_perm_t type (
Perm C.acl_perm_t
Perms []Perm
)
func (ps Perms) String() string {
var s = []byte("---")
for _, p := range ps {
switch p {
case Read:
s[0] = 'r'
case Write:
s[1] = 'w'
case Execute:
s[2] = 'x'
}
}
return string(s)
}
func UpdatePerm(path string, uid int, perms ...Perm) error { func UpdatePerm(path string, uid int, perms ...Perm) error {
// read acl from file // read acl from file

24
internal/system/acl.go
View File

@ -28,7 +28,7 @@ func (sys *I) UpdatePermType(et Enablement, path string, perms ...acl.Perm) *I {
type ACL struct { type ACL struct {
et Enablement et Enablement
path string path string
perms []acl.Perm perms acl.Perms
} }
func (a *ACL) Type() Enablement { func (a *ACL) Type() Enablement {
@ -36,20 +36,18 @@ func (a *ACL) Type() Enablement {
} }
func (a *ACL) apply(sys *I) error { func (a *ACL) apply(sys *I) error {
fmsg.VPrintf("applying ACL %s uid: %d type: %s path: %q", fmsg.VPrintln("applying ACL", a)
a, sys.uid, TypeString(a.et), a.path)
return fmsg.WrapErrorSuffix(acl.UpdatePerm(a.path, sys.uid, a.perms...), return fmsg.WrapErrorSuffix(acl.UpdatePerm(a.path, sys.uid, a.perms...),
fmt.Sprintf("cannot apply ACL entry to %q:", a.path)) fmt.Sprintf("cannot apply ACL entry to %q:", a.path))
} }
func (a *ACL) revert(sys *I, ec *Criteria) error { func (a *ACL) revert(sys *I, ec *Criteria) error {
if ec.hasType(a) { if ec.hasType(a) {
fmsg.VPrintf("stripping ACL %s uid: %d type: %s path: %q", fmsg.VPrintln("stripping ACL", a)
a, sys.uid, TypeString(a.et), a.path)
return fmsg.WrapErrorSuffix(acl.UpdatePerm(a.path, sys.uid), return fmsg.WrapErrorSuffix(acl.UpdatePerm(a.path, sys.uid),
fmt.Sprintf("cannot strip ACL entry from %q:", a.path)) fmt.Sprintf("cannot strip ACL entry from %q:", a.path))
} else { } else {
fmsg.VPrintln("skipping ACL", a, "uid:", sys.uid, "tag:", TypeString(a.et), "path:", a.path) fmsg.VPrintln("skipping ACL", a)
return nil return nil
} }
} }
@ -67,16 +65,6 @@ func (a *ACL) Path() string {
} }
func (a *ACL) String() string { func (a *ACL) String() string {
var s = []byte("---") return fmt.Sprintf("%s type: %s path: %q",
for _, p := range a.perms { a.perms, TypeString(a.et), a.path)
switch p {
case acl.Read:
s[0] = 'r'
case acl.Write:
s[1] = 'w'
case acl.Execute:
s[2] = 'x'
}
}
return string(s)
} }

19
internal/system/acl_test.go
View File

@ -49,21 +49,22 @@ func TestUpdatePermType(t *testing.T) {
func TestACL_String(t *testing.T) { func TestACL_String(t *testing.T) {
testCases := []struct { testCases := []struct {
want string want string
et Enablement
perms []acl.Perm perms []acl.Perm
}{ }{
{"---", []acl.Perm{}}, {`--- type: Process path: "/nonexistent"`, Process, []acl.Perm{}},
{"r--", []acl.Perm{acl.Read}}, {`r-- type: User path: "/nonexistent"`, User, []acl.Perm{acl.Read}},
{"-w-", []acl.Perm{acl.Write}}, {`-w- type: Wayland path: "/nonexistent"`, EWayland, []acl.Perm{acl.Write}},
{"--x", []acl.Perm{acl.Execute}}, {`--x type: X11 path: "/nonexistent"`, EX11, []acl.Perm{acl.Execute}},
{"rw-", []acl.Perm{acl.Read, acl.Write}}, {`rw- type: D-Bus path: "/nonexistent"`, EDBus, []acl.Perm{acl.Read, acl.Write}},
{"r-x", []acl.Perm{acl.Read, acl.Execute}}, {`r-x type: PulseAudio path: "/nonexistent"`, EPulse, []acl.Perm{acl.Read, acl.Execute}},
{"rwx", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, {`rwx type: User path: "/nonexistent"`, User, []acl.Perm{acl.Read, acl.Write, acl.Execute}},
{"rwx", []acl.Perm{acl.Read, acl.Write, acl.Write, acl.Execute}}, {`rwx type: Process path: "/nonexistent"`, Process, []acl.Perm{acl.Read, acl.Write, acl.Write, acl.Execute}},
} }
for _, tc := range testCases { for _, tc := range testCases {
t.Run(tc.want, func(t *testing.T) { t.Run(tc.want, func(t *testing.T) {
a := &ACL{perms: tc.perms} a := &ACL{et: tc.et, perms: tc.perms, path: "/nonexistent"}
if got := a.String(); got != tc.want { if got := a.String(); got != tc.want {
t.Errorf("String() = %v, want %v", t.Errorf("String() = %v, want %v",
got, tc.want) got, tc.want)