openstack
/
oslo.rootwrap
Code Issues Proposed changes

Add coreutils as valid value to fix KillFilter test 

In containerized RHEL 9 environment the KillFilter test started to fail
because `os.readlink("/proc/<pid-of-cat/exe>")` return /usr/bin/coreutils.

Indeed cat is part of the coreutils package and the symlink of
this file point toward coreutils. Fixing this bug by adding
coreutils as a possible returned value for our tests.

Closes-Bug: #2037383
Change-Id: I141eb15efa30c7df3ca5419b594097f4b683663c
(cherry picked from commit 43ab5ad7a7)
(cherry picked from commit 206151c732)
This commit is contained in:
Hervé Beraud 2023-09-26 10:18:31 +02:00 committed by Hervé Beraud
parent 8dc0d41bed
commit b187d6b185
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
oslo_rootwrap/tests/test_rootwrap.py
View File

@ -200,6 +200,7 @@ class RootwrapTestCase(testtools.TestCase):
try:
f = filters.KillFilter("root", "/bin/cat", "-9", "-HUP")
f2 = filters.KillFilter("root", "/usr/bin/cat", "-9", "-HUP")
f3 = filters.KillFilter("root", "/usr/bin/coreutils", "-9", "-HUP")
usercmd = ['kill', '-ALRM', p.pid]
# Incorrect signal should fail
self.assertFalse(f.match(usercmd) or f2.match(usercmd))
@ -208,10 +209,13 @@ class RootwrapTestCase(testtools.TestCase):
self.assertFalse(f.match(usercmd) or f2.match(usercmd))
# Providing matching signal should be allowed
usercmd = ['kill', '-9', p.pid]
self.assertTrue(f.match(usercmd) or f2.match(usercmd))
self.assertTrue(f.match(usercmd) or
f2.match(usercmd) or
f3.match(usercmd))
f = filters.KillFilter("root", "/bin/cat")
f2 = filters.KillFilter("root", "/usr/bin/cat")
f3 = filters.KillFilter("root", "/usr/bin/coreutils")
usercmd = ['kill', os.getpid()]
# Our own PID does not match /bin/sleep, so it should fail
self.assertFalse(f.match(usercmd) or f2.match(usercmd))
@ -220,16 +224,19 @@ class RootwrapTestCase(testtools.TestCase):
self.assertFalse(f.match(usercmd) or f2.match(usercmd))
usercmd = ['kill', p.pid]
# Providing no signal should work
self.assertTrue(f.match(usercmd) or f2.match(usercmd))
self.assertTrue(f.match(usercmd) or
f2.match(usercmd) or
f3.match(usercmd))
# verify that relative paths are matched against $PATH
f = filters.KillFilter("root", "cat")
f2 = filters.KillFilter("root", "coreutils")
# Our own PID does not match so it should fail
usercmd = ['kill', os.getpid()]
self.assertFalse(f.match(usercmd))
# Filter should find cat in /bin or /usr/bin
usercmd = ['kill', p.pid]
self.assertTrue(f.match(usercmd))
self.assertTrue(f.match(usercmd) or f2.match(usercmd))
# Filter shouldn't be able to find binary in $PATH, so fail
with fixtures.EnvironmentVariable("PATH", "/foo:/bar"):
self.assertFalse(f.match(usercmd))