33 lines
1.5 KiB
Bash
33 lines
1.5 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
||
|
|
|
||
|
|
sudoers_file="$ROOT/stappmus-activity-monitor.sudoers"
|
||
|
|
launcher="$ROOT/activity-power-reader"
|
||
|
|
expected='%wheel ALL=(root) NOPASSWD: /usr/lib/stappmus-activity-monitor/activity-sampler --activity-process-power-reader'
|
||
|
|
|
||
|
|
[[ -f $sudoers_file ]] ||
|
||
|
|
fail "activity process power installs its narrow sudoers rule"
|
||
|
|
[[ $(<"$sudoers_file") == "$expected" ]] ||
|
||
|
|
fail "activity process power sudoers rule permits only the exact collector command"
|
||
|
|
[[ $(wc -l <"$sudoers_file") -eq 1 ]] ||
|
||
|
|
fail "activity process power sudoers rule contains only one allowance"
|
||
|
|
if command -v visudo >/dev/null 2>&1; then
|
||
|
|
visudo -cf "$sudoers_file" >/dev/null ||
|
||
|
|
fail "activity process power sudoers rule is not valid sudoers syntax"
|
||
|
|
fi
|
||
|
|
pass "activity process power sudoers rule permits only the exact collector command"
|
||
|
|
|
||
|
|
[[ -x $launcher ]] ||
|
||
|
|
fail "activity process power launcher is not executable"
|
||
|
|
grep -Fxq 'exec sudo -n /usr/lib/stappmus-activity-monitor/activity-sampler --activity-process-power-reader' "$launcher" ||
|
||
|
|
fail "activity process power launcher does not invoke the exact guarded command"
|
||
|
|
if grep -Eq '\$@|\$\*' "$launcher"; then
|
||
|
|
fail "activity process power launcher forwards arbitrary command arguments"
|
||
|
|
fi
|
||
|
|
if "$launcher" unexpected >/dev/null 2>&1; then
|
||
|
|
fail "activity process power launcher accepts command arguments"
|
||
|
|
fi
|
||
|
|
pass "activity process power launcher preserves the exact sudoers command"
|