NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

support/testing: add polkit tests

Browse Source 
This test script tests polkit with and without systemd.

The Systemd test does the following:
  - The brtest user attempts to restart the systemd-timesyncd service and is
    denied.

  - A systemd-timesyncd-restart.rules file provided by polkit-rules-test
    is copied from /root/ to /etc/polkit-1/rules.d

  - The brtest user attempts to restart the systemd-timesyncd service and should
    now succeed.

The initd test does the following:
- The brtest user attempts to run the test application "hello-polkit" with the
  command "pkexec hello-polkit" and is denied.

- A hello-polkit.rules file provided by polkit-rules-test is copied from /root/
  to /etc/polkit-1/rules.d

- The brtest user attempts to re-run the test hello-polkit binary with
  "pkexec hello-polkit" and succeeds.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Adam Duskett 2021-07-21 14:45:17 -07:00 committed by Thomas Petazzoni
parent 82712c5862
commit db1ded1084
10 changed files with 150 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
support/testing/tests/package/br2-external/polkit/Config.in Normal file
View File

@ -0,0 +1 @@
source "$BR2_EXTERNAL_POLKIT_PATH/package/polkit-rules-test/Config.in"

1
support/testing/tests/package/br2-external/polkit/external.desc Normal file
View File

@ -0,0 +1 @@
name: POLKIT

1
support/testing/tests/package/br2-external/polkit/external.mk Normal file
View File

@ -0,0 +1 @@
include $(sort $(wildcard $(BR2_EXTERNAL_POLKIT_PATH)/package/*/*.mk))

6
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/Config.in Normal file
View File

@ -0,0 +1,6 @@
config BR2_PACKAGE_POLKIT_RULES_TEST
bool "polkit rules test"
depends on BR2_PACKAGE_POLKIT
help
Simple test to ensure polkit is loading and enforcing rules
correctly.

6
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/initd/hello-polkit.c Normal file
View File

@ -0,0 +1,6 @@
#include <stdio.h>
int main(void){
printf("Hello polkit!\n");
return 0;
}

14
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/initd/hello-polkit.policy Normal file
View File

@ -0,0 +1,14 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
<policyconfig>
<action id="org.freedesktop.policykit.pkexec.hello-polkit">
<message>Authentication is required to run the hello world test program</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>no</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.exec.path">/usr/bin/hello-polkit</annotate>
</action>
</policyconfig>

6
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/initd/hello-polkit.rules Normal file
View File

@ -0,0 +1,6 @@
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.policykit.pkexec.hello-polkit" &&
subject.user == "brtest") {
return polkit.Result.YES;
}
});

38
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/polkit-rules-test.mk Normal file
View File

@ -0,0 +1,38 @@
################################################################################
#
# polkit-rules-test
#
################################################################################
POLKIT_RULES_TEST_DEPENDENCIES = polkit
define POLKIT_RULES_TEST_USERS
brtest -1 brtest -1 =password /home/brtest /bin/sh brtest
endef
define POLKIT_RULES_TEST_BUILD_CMDS
$(INSTALL) -D $(POLKIT_RULES_TEST_PKGDIR)/initd/hello-polkit.c $(@D)/hello-polkit.c
$(TARGET_CC) $(@D)/hello-polkit.c -o $(@D)/hello-polkit
endef
# Install the rules file to /root. Test_polkit.py first tests that restarting
# timesyncd as a user fails, then moves the rules file and confirmes restarting
# timesyncd as a user succeeds.
define POLKIT_RULES_TEST_INSTALL_INIT_SYSTEMD
mkdir -p $(TARGET_DIR)/etc/polkit-1/rules.d
$(INSTALL) -D $(POLKIT_RULES_TEST_PKGDIR)/systemd/systemd-timesyncd-restart.rules \
$(TARGET_DIR)/root/systemd-timesyncd-restart.rules
endef
define POLKIT_RULES_TEST_INSTALL_INIT_SYSV
mkdir -p $(TARGET_DIR)/usr/share/polkit-1/actions/
$(INSTALL) -D $(@D)/hello-polkit $(TARGET_DIR)/usr/bin/hello-polkit
$(INSTALL) -D $(POLKIT_RULES_TEST_PKGDIR)/initd/hello-polkit.policy \
$(TARGET_DIR)/usr/share/polkit-1/actions/hello-polkit.policy
$(INSTALL) -D $(POLKIT_RULES_TEST_PKGDIR)/initd/hello-polkit.rules \
$(TARGET_DIR)/root/hello-polkit.rules
endef
$(eval $(generic-package))

7
support/testing/tests/package/br2-external/polkit/package/polkit-rules-test/systemd/systemd-timesyncd-restart.rules Normal file
View File

@ -0,0 +1,7 @@
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units" &&
action.lookup("unit") == "systemd-timesyncd.service" &&
subject.user == "brtest") {
return polkit.Result.YES;
}
});

70
support/testing/tests/package/test_polkit.py Normal file
View File

@ -0,0 +1,70 @@
import os
import infra.basetest
class TestPolkitInfra(infra.basetest.BRTest):
br2_external = [infra.filepath("tests/package/br2-external/polkit")]
config = \
"""
BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TARGET_ROOTFS_CPIO=y
BR2_PACKAGE_POLKIT=y
BR2_PACKAGE_POLKIT_RULES_TEST=y
"""
def base_test_run(self):
cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
self.emulator.boot(arch="armv7", kernel="builtin",
options=["-initrd", cpio_file])
self.emulator.login()
class TestPolkitSystemd(TestPolkitInfra):
config = \
"""
{}
BR2_INIT_SYSTEMD=y
BR2_PACKAGE_SYSTEMD_POLKIT=y
BR2_TARGET_GENERIC_GETTY_PORT="ttyAMA0"
# BR2_TARGET_ROOTFS_TAR is not set
""".format(TestPolkitInfra.config)
def test_run(self):
TestPolkitInfra.base_test_run(self)
cmd = "su brtest -c '/bin/systemctl restart systemd-timesyncd.service'"
_, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 1)
cmd = "mv /root/systemd-timesyncd-restart.rules /etc/polkit-1/rules.d"
_, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 0)
cmd = "su brtest -c '/bin/systemctl restart systemd-timesyncd.service'"
_, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 0)
class TestPolkitInitd(TestPolkitInfra):
config = TestPolkitInfra.config
def test_run(self):
TestPolkitInfra.base_test_run(self)
cmd = "su brtest -c 'pkexec hello-polkit'"
output, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 127)
self.assertEqual(output[0], "Error executing command as another user: Not authorized")
cmd = "mv /root/hello-polkit.rules /etc/polkit-1/rules.d/hello-polkit.rules"
_, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 0)
cmd = "su brtest -c 'pkexec hello-polkit'"
output, exit_code = self.emulator.run(cmd, 10)
self.assertEqual(exit_code, 0)
self.assertEqual(output[0], "Hello polkit!")