44 lines
2 KiB
Python
44 lines
2 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
import subprocess
|
|
import unittest
|
|
|
|
BASE = Path(__file__).parent
|
|
spec = importlib.util.spec_from_file_location('verify_guest', BASE/'verify-guest.py')
|
|
m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
|
|
|
|
|
|
class RecipeTests(unittest.TestCase):
|
|
def good(self):
|
|
return dict(distro='custodian-codex',uid=1001,gid=1001,home_mode=0o700,
|
|
state_mode=0o700,home_uid=1001,state_uid=1001,groups=[1001],
|
|
interop='false',automount='false',mount_fstab='false',
|
|
windows_mount=False,operator_home=False,interop_handler=False)
|
|
|
|
def test_partial_pass_is_never_admission(self):
|
|
r=m.check_snapshot(self.good())
|
|
self.assertTrue(r['partial_preflight_passed']); self.assertFalse(r['assignment_admitted'])
|
|
|
|
def test_each_missing_boundary_blocks(self):
|
|
for key,bad in dict(distro='Ubuntu-24.04',uid=1000,gid=0,home_mode=0o755,
|
|
state_mode=0o755,home_uid=0,state_uid=0,groups=[1001,27],
|
|
interop='true',automount='true',mount_fstab='true',
|
|
windows_mount=True,operator_home=True,interop_handler=True).items():
|
|
with self.subTest(key=key):
|
|
s=self.good();s[key]=bad
|
|
self.assertFalse(m.check_snapshot(s)['partial_preflight_passed'])
|
|
|
|
def test_script_lock_refuses_without_privileges(self):
|
|
r=subprocess.run(['bash',str(BASE/'guest-stage.sh')],capture_output=True,text=True)
|
|
self.assertEqual(r.returncode,78);self.assertIn('execution disabled',r.stderr)
|
|
|
|
def test_shell_syntax(self):
|
|
subprocess.run(['bash','-n',str(BASE/'guest-stage.sh')],check=True)
|
|
|
|
def test_import_remains_locked(self):
|
|
lines=[x for x in (BASE/'import-disabled.ps1').read_text().splitlines() if x and not x.startswith('#')]
|
|
self.assertTrue(lines[0].startswith("throw 'REFUSED:"))
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|