aboutsummaryrefslogtreecommitdiff
path: root/spec
diff options
context:
space:
mode:
authorGabriel Nagy <gabriel.nagy@puppet.com>2019-08-13 12:41:03 +0300
committerGabriel Nagy <gabriel.nagy@puppet.com>2019-10-23 12:23:47 +0300
commitb2c153b6ff070d620d47c83265992f7226646ee8 (patch)
tree2754dfcb7d0b384a0c396f9c6bfd3a25c73d25e0 /spec
parent8fd51e76226ea0f2012dfad9e3e52156cccbe13d (diff)
downloadpuppet-sshkeys_core-b2c153b6ff070d620d47c83265992f7226646ee8.tar.gz
puppet-sshkeys_core-b2c153b6ff070d620d47c83265992f7226646ee8.tar.bz2
(MODULES-9578) Create authorized_key in root path
Previously, when the `target` property was set, the ssh_authorized_key resource could not create directories/files within root-owned paths. This behavior is due to the module switching context to the user, then attempting to create the directory/file as the specified user, ultimately failing because of insufficient permissions. This commit adds a new parameter, `drop_privileges` which when set to false allows the module to write a ssh_authorized_key file in a privileged path. Due to the possible security implications of this, the parameter must be manually specified in order to activate this functionality. A path is considered to be privileged/trusted if all of its ancestors: - do not contain any symlinks - have the same owner as the user who runs Puppet - are not world/group writable
Diffstat (limited to 'spec')
-rw-r--r--spec/acceptance/tests/resource/ssh_authorized_key/create_spec.rb58
-rw-r--r--spec/acceptance/tests/resource/ssh_authorized_key/destroy_spec.rb23
-rw-r--r--spec/acceptance/tests/resource/ssh_authorized_key/modify_spec.rb23
-rw-r--r--spec/unit/type/ssh_authorized_key_spec.rb24
4 files changed, 110 insertions, 18 deletions
diff --git a/spec/acceptance/tests/resource/ssh_authorized_key/create_spec.rb b/spec/acceptance/tests/resource/ssh_authorized_key/create_spec.rb
index 34154ee..bfc75a7 100644
--- a/spec/acceptance/tests/resource/ssh_authorized_key/create_spec.rb
+++ b/spec/acceptance/tests/resource/ssh_authorized_key/create_spec.rb
@@ -7,13 +7,11 @@ RSpec.context 'ssh_authorized_key: Create' do
let(:name) { "pl#{rand(999_999).to_i}" }
let(:custom_key_directory) { "/etc/ssh_authorized_keys_#{name}" }
let(:custom_key) { "#{custom_key_directory}/authorized_keys_#{name}" }
- let(:custom_name) { "custom_#{name}" }
before(:each) do
posix_agents.each do |agent|
- on(agent, "cp #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
+ on(agent, "cp -a #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
on(agent, "rm -f #{auth_keys}")
- on(agent, "mkdir #{custom_key_directory}")
end
end
@@ -21,7 +19,6 @@ RSpec.context 'ssh_authorized_key: Create' do
posix_agents.each do |agent|
# (teardown) restore the #{auth_keys} file
on(agent, "mv /tmp/auth_keys #{auth_keys}", acceptable_exit_codes: [0, 1])
- on(agent, "rm -rf #{custom_key_directory}")
end
end
@@ -37,17 +34,54 @@ RSpec.context 'ssh_authorized_key: Create' do
fail_test "didn't find the ssh_authorized_key for #{name}" unless stdout.include? name.to_s
end
end
- it "#{agent} should create an entry for an SSH authorized key in a custom location" do
- custom_args = ['ensure=present',
- 'user=$LOGNAME',
- "type='rsa'",
- "key='mykey'",
- "target='#{custom_key}'"]
- on(agent, puppet_resource('ssh_authorized_key', custom_name.to_s, custom_args))
+ it "#{agent} should create an entry for an SSH authorized key in a custom location" do
+ on(agent, "mkdir #{custom_key_directory}")
+ args = ['ensure=present',
+ 'user=$LOGNAME',
+ "type='rsa'",
+ "key='mykey'",
+ "target='#{custom_key}'"]
+ on(agent, puppet_resource('ssh_authorized_key', name.to_s, args))
on(agent, "cat #{custom_key}") do |_res|
- fail_test "didn't find the ssh_authorized_key for #{custom_name}" unless stdout.include? name.to_s
+ fail_test "didn't find the ssh_authorized_key for #{name}" unless stdout.include? name.to_s
+ end
+ on(agent, "rm -rf #{custom_key_directory}")
+ end
+
+ it "#{agent} should fail if target user doesn't have permissions for symlinked path" do
+ # create a dummy user
+ on(agent, puppet_resource('user', 'testuser', 'ensure=present', 'managehome=true'))
+
+ on(agent, "mkdir #{custom_key_directory}")
+
+ # as the user, symlink an owned directory to something inside /root
+ on(agent, puppet_resource('file', '/home/testuser/tmp', ['ensure=/etc', 'owner=testuser']))
+ args = ['ensure=present',
+ 'user=testuser',
+ "type='rsa'",
+ "key='mykey'",
+ 'drop_privileges=false',
+ "target=/home/testuser/tmp/ssh_authorized_keys_#{name}/authorized_keys_#{name}"]
+ on(agent, puppet_resource('ssh_authorized_key', name.to_s, args)) do |_res|
+ fail_test unless stderr =~ %r{the target path is not trusted}
+ end
+ on(agent, "rm -rf #{custom_key_directory}")
+
+ # purge the user
+ on(agent, puppet_resource('user', 'testuser', 'ensure=absent'))
+ end
+
+ it "#{agent} should not create directories for SSH authorized key in a custom location" do
+ args = ['ensure=present',
+ 'user=$LOGNAME',
+ "type='rsa'",
+ "key='mykey'",
+ 'drop_privileges=false',
+ "target='#{custom_key}'"]
+ on(agent, puppet_resource('ssh_authorized_key', name.to_s, args), acceptable_exit_codes: [0, 1]) do |_res|
+ fail_test unless stderr =~ %r{the target path is not trusted}
end
end
end
diff --git a/spec/acceptance/tests/resource/ssh_authorized_key/destroy_spec.rb b/spec/acceptance/tests/resource/ssh_authorized_key/destroy_spec.rb
index af160ce..a491eb6 100644
--- a/spec/acceptance/tests/resource/ssh_authorized_key/destroy_spec.rb
+++ b/spec/acceptance/tests/resource/ssh_authorized_key/destroy_spec.rb
@@ -5,13 +5,14 @@ RSpec.context 'sshkeys: Destroy' do
let(:auth_keys) { '~/.ssh/authorized_keys' }
let(:name) { "pl#{rand(999_999).to_i}" }
+ let(:custom_key_directory) { "/etc/ssh_authorized_keys_#{name}" }
+ let(:custom_key) { "#{custom_key_directory}/authorized_keys_#{name}" }
before(:each) do
posix_agents.each do |agent|
- on(agent, "cp #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
-
+ on(agent, "cp -a #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
+ on(agent, "rm -f #{auth_keys}")
on(agent, "echo '' >> #{auth_keys} && echo 'ssh-rsa mykey #{name}' >> #{auth_keys}")
- on(agent, "chown $LOGNAME #{auth_keys}")
end
end
@@ -34,5 +35,21 @@ RSpec.context 'sshkeys: Destroy' do
expect(stdout).not_to include(name.to_s)
end
end
+
+ it "#{agent} should delete an entry for an SSH authorized key in a custom location" do
+ on(agent, "mkdir #{custom_key_directory}")
+ on(agent, "echo '' >> #{custom_key} && echo 'ssh-rsa mykey #{name}' >> #{custom_key}")
+ args = ['ensure=absent',
+ 'user=$LOGNAME',
+ "type='rsa'",
+ "key='mykey'",
+ "target='#{custom_key}'"]
+ on(agent, puppet_resource('ssh_authorized_key', name.to_s, args))
+
+ on(agent, "cat #{custom_key}") do |_res|
+ expect(stdout).not_to include(name.to_s)
+ end
+ on(agent, "rm -rf #{custom_key_directory}")
+ end
end
end
diff --git a/spec/acceptance/tests/resource/ssh_authorized_key/modify_spec.rb b/spec/acceptance/tests/resource/ssh_authorized_key/modify_spec.rb
index 3a46374..711d2fc 100644
--- a/spec/acceptance/tests/resource/ssh_authorized_key/modify_spec.rb
+++ b/spec/acceptance/tests/resource/ssh_authorized_key/modify_spec.rb
@@ -3,12 +3,14 @@ require 'spec_helper_acceptance'
RSpec.context 'sshkeys: Modify' do
let(:auth_keys) { '~/.ssh/authorized_keys' }
let(:name) { "pl#{rand(999_999).to_i}" }
+ let(:custom_key_directory) { "/etc/ssh_authorized_keys_#{name}" }
+ let(:custom_key) { "#{custom_key_directory}/authorized_keys_#{name}" }
before(:each) do
posix_agents.each do |agent|
- on(agent, "cp #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
+ on(agent, "cp -a #{auth_keys} /tmp/auth_keys", acceptable_exit_codes: [0, 1])
+ on(agent, "rm -f #{auth_keys}")
on(agent, "echo '' >> #{auth_keys} && echo 'ssh-rsa mykey #{name}' >> #{auth_keys}")
- on(agent, "chown $LOGNAME #{auth_keys}")
end
end
@@ -32,5 +34,22 @@ RSpec.context 'sshkeys: Modify' do
expect(stdout).not_to include("mykey #{name}")
end
end
+
+ it "#{agent} should update an entry for an SSH authorized key in a custom location" do
+ on(agent, "mkdir #{custom_key_directory}")
+ on(agent, "echo '' >> #{custom_key} && echo 'ssh-rsa mykey #{name}' >> #{custom_key}")
+ args = ['ensure=present',
+ 'user=$LOGNAME',
+ "type='rsa'",
+ "key='mynewshinykey'",
+ "target='#{custom_key}'"]
+ on(agent, puppet_resource('ssh_authorized_key', name.to_s, args))
+
+ on(agent, "cat #{custom_key}") do |_res|
+ expect(stdout).to include("mynewshinykey #{name}")
+ expect(stdout).not_to include("mykey #{name}")
+ end
+ on(agent, "rm -rf #{custom_key_directory}")
+ end
end
end
diff --git a/spec/unit/type/ssh_authorized_key_spec.rb b/spec/unit/type/ssh_authorized_key_spec.rb
index 866c688..457537c 100644
--- a/spec/unit/type/ssh_authorized_key_spec.rb
+++ b/spec/unit/type/ssh_authorized_key_spec.rb
@@ -17,7 +17,7 @@ describe Puppet::Type.type(:ssh_authorized_key), unless: Puppet.features.microso
end
describe 'when validating attributes' do
- [:name, :provider].each do |param|
+ [:name, :provider, :drop_privileges].each do |param|
it "has a #{param} parameter" do
expect(described_class.attrtype(param)).to eq :param
end
@@ -56,6 +56,28 @@ describe Puppet::Type.type(:ssh_authorized_key), unless: Puppet.features.microso
end
end
+ describe 'for drop_privileges' do
+ it 'uses true as a default value' do
+ expect(described_class.new(name: 'whev', user: 'nobody')[:drop_privileges]).to eq true
+ end
+
+ [true, :true, 'true', :yes, 'yes'].each do |value|
+ it "supports #{value} and returns a boolean true" do
+ expect(described_class.new(name: 'whev', user: 'nobody', drop_privileges: value)[:drop_privileges]).to eq true
+ end
+ end
+
+ [false, :false, 'false', :no, 'no'].each do |value|
+ it "supports #{value} and returns a boolean false" do
+ expect(described_class.new(name: 'whev', user: 'nobody', drop_privileges: value)[:drop_privileges]).to eq false
+ end
+ end
+
+ it 'raises an exception on something else' do
+ expect { described_class.new(name: 'whev', user: 'nobody', drop_privileges: 'nope') }.to raise_error(Puppet::Error, %r{Invalid value})
+ end
+ end
+
describe 'for type' do
[
:'ssh-dss', :dsa,