rpms
/
sssd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
sssd/0017-INTG-Add-session-recor...

1060 lines
37 KiB
Diff
Raw Blame History

From 53a4219e2f51cd0443931aa931505bf0b4bf5a45 Mon Sep 17 00:00:00 2001
From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Date: Thu, 11 Aug 2016 14:18:38 +0300
Subject: [PATCH 17/93] INTG: Add session recording tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add basic tests for all base combinations of session recording
configuration options.
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
contrib/ci/configure.sh | 1 +
src/tests/intg/Makefile.am | 2 +
src/tests/intg/config.py.m4 | 29 +-
src/tests/intg/test_session_recording.py | 961 +++++++++++++++++++++++++++++++
4 files changed, 979 insertions(+), 14 deletions(-)
create mode 100644 src/tests/intg/test_session_recording.py
diff --git a/contrib/ci/configure.sh b/contrib/ci/configure.sh
index 9d18d0c187561a2dc3bc47d3e8913626e7ff3046..4a219da7577ea6aab5c8f14679b9e603c6c35be3 100644
--- a/contrib/ci/configure.sh
+++ b/contrib/ci/configure.sh
@@ -29,6 +29,7 @@ declare -a CONFIGURE_ARG_LIST=(
"--enable-ldb-version-check"
"--with-syslog=journald"
"--enable-systemtap"
+ "--with-session-recording-shell=/bin/false"
)
diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am
index 8566106e9017a8d3c9e7a3898a3a886e2966e346..abf6237fcf45d75bc7b9dba835e33413cf2a48da 100644
--- a/src/tests/intg/Makefile.am
+++ b/src/tests/intg/Makefile.am
@@ -18,6 +18,7 @@ dist_noinst_DATA = \
test_enumeration.py \
test_ldap.py \
test_memory_cache.py \
+ test_session_recording.py \
test_ts_cache.py \
test_netgroup.py \
secrets.py \
@@ -42,6 +43,7 @@ config.py: config.py.m4
-D "libexecpath=\`$(libexecdir)'" \
-D "runstatedir=\`$(runstatedir)'" \
-D "abs_builddir=\`$(abs_builddir)'" \
+ -D "session_recording_shell=\`$(session_recording_shell)'" \
$< > $@
root:
diff --git a/src/tests/intg/config.py.m4 b/src/tests/intg/config.py.m4
index 841aae01f9f67f3a06656a580b84dfaa0a877c0f..bfbbf030fe5c6431ad3eec6c71d05e9138c82163 100644
--- a/src/tests/intg/config.py.m4
+++ b/src/tests/intg/config.py.m4
@@ -2,17 +2,18 @@
Build configuration variables.
"""
-PREFIX = "prefix"
-SYSCONFDIR = "sysconfdir"
-NSS_MODULE_DIR = PREFIX + "/lib"
-SSSDCONFDIR = SYSCONFDIR + "/sssd"
-CONF_PATH = SSSDCONFDIR + "/sssd.conf"
-DB_PATH = "dbpath"
-PID_PATH = "pidpath"
-PIDFILE_PATH = PID_PATH + "/sssd.pid"
-LOG_PATH = "logpath"
-MCACHE_PATH = "mcpath"
-SECDB_PATH = "secdbpath"
-LIBEXEC_PATH = "libexecpath"
-RUNSTATEDIR = "runstatedir"
-ABS_BUILDDIR = "abs_builddir"
+PREFIX = "prefix"
+SYSCONFDIR = "sysconfdir"
+NSS_MODULE_DIR = PREFIX + "/lib"
+SSSDCONFDIR = SYSCONFDIR + "/sssd"
+CONF_PATH = SSSDCONFDIR + "/sssd.conf"
+DB_PATH = "dbpath"
+PID_PATH = "pidpath"
+PIDFILE_PATH = PID_PATH + "/sssd.pid"
+LOG_PATH = "logpath"
+MCACHE_PATH = "mcpath"
+SECDB_PATH = "secdbpath"
+LIBEXEC_PATH = "libexecpath"
+RUNSTATEDIR = "runstatedir"
+ABS_BUILDDIR = "abs_builddir"
+SESSION_RECORDING_SHELL = "session_recording_shell"
diff --git a/src/tests/intg/test_session_recording.py b/src/tests/intg/test_session_recording.py
new file mode 100644
index 0000000000000000000000000000000000000000..56a056a156b5effe8b8afb7b5607cb60038eec4c
--- /dev/null
+++ b/src/tests/intg/test_session_recording.py
@@ -0,0 +1,961 @@
+#
+# Session Recording tests
+#
+# Copyright (c) 2016 Red Hat, Inc.
+# Author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
+#
+# This is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+import os
+import stat
+import ent
+import config
+import signal
+import subprocess
+import time
+import ldap
+import pytest
+import ds_openldap
+import ldap_ent
+from util import *
+
+LDAP_BASE_DN = "dc=example,dc=com"
+INTERACTIVE_TIMEOUT = 4
+
+
+def stop_sssd():
+ """Stop sssd"""
+ pid_file = open(config.PIDFILE_PATH, "r")
+ pid = int(pid_file.read())
+ os.kill(pid, signal.SIGTERM)
+ while True:
+ try:
+ os.kill(pid, signal.SIGCONT)
+ except:
+ break
+ time.sleep(1)
+
+
+def start_sssd():
+ """Start sssd"""
+ if subprocess.call(["sssd", "-D", "-f"]) != 0:
+ raise Exception("sssd start failed")
+
+
+def restart_sssd():
+ """Restart sssd"""
+ stop_sssd()
+ start_sssd()
+
+
+@pytest.fixture(scope="module")
+def ds_inst(request):
+ """LDAP server instance fixture"""
+ ds_inst = ds_openldap.DSOpenLDAP(
+ config.PREFIX, 10389, LDAP_BASE_DN,
+ "cn=admin", "Secret123"
+ )
+
+ try:
+ ds_inst.setup()
+ except:
+ ds_inst.teardown()
+ raise
+ request.addfinalizer(lambda: ds_inst.teardown())
+ return ds_inst
+
+
+@pytest.fixture(scope="module")
+def ldap_conn(request, ds_inst):
+ """LDAP server connection fixture"""
+ ldap_conn = ds_inst.bind()
+ ldap_conn.ds_inst = ds_inst
+ request.addfinalizer(lambda: ldap_conn.unbind_s())
+ return ldap_conn
+
+
+def create_ldap_entries(ldap_conn, ent_list=None):
+ """Add LDAP entries from ent_list"""
+ if ent_list is not None:
+ for entry in ent_list:
+ ldap_conn.add_s(entry[0], entry[1])
+
+
+def cleanup_ldap_entries(ldap_conn, ent_list=None):
+ """Remove LDAP entries added by create_ldap_entries"""
+ if ent_list is None:
+ for ou in ("Users", "Groups", "Netgroups", "Services", "Policies"):
+ for entry in ldap_conn.search_s("ou=" + ou + "," +
+ ldap_conn.ds_inst.base_dn,
+ ldap.SCOPE_ONELEVEL,
+ attrlist=[]):
+ ldap_conn.delete_s(entry[0])
+ else:
+ for entry in ent_list:
+ ldap_conn.delete_s(entry[0])
+
+
+def create_ldap_cleanup(request, ldap_conn, ent_list=None):
+ """Add teardown for removing all user/group LDAP entries"""
+ request.addfinalizer(lambda: cleanup_ldap_entries(ldap_conn, ent_list))
+
+
+def create_ldap_fixture(request, ldap_conn, ent_list=None):
+ """Add LDAP entries and add teardown for removing them"""
+ create_ldap_entries(ldap_conn, ent_list)
+ create_ldap_cleanup(request, ldap_conn, ent_list)
+
+
+SCHEMA_RFC2307 = "rfc2307"
+SCHEMA_RFC2307_BIS = "rfc2307bis"
+
+
+def format_basic_conf(ldap_conn, schema):
+ """
+ Format a basic SSSD configuration.
+
+ The files domain is defined but not enabled in order to avoid enumerating
+ users from the files domain that would otherwise by implicitly enabled.
+ """
+ schema_conf = "ldap_schema = " + schema + "\n"
+ if schema == SCHEMA_RFC2307_BIS:
+ schema_conf += "ldap_group_object_class = groupOfNames\n"
+ return unindent("""\
+ [sssd]
+ debug_level = 0xffff
+ domains = LDAP
+ services = nss, pam
+
+ [nss]
+ debug_level = 0xffff
+ memcache_timeout = 0
+
+ [pam]
+ debug_level = 0xffff
+
+ [domain/files]
+ id_provider = files
+
+ [domain/LDAP]
+ ldap_auth_disable_tls_never_use_in_production = true
+ debug_level = 0xffff
+ enumerate = true
+ {schema_conf}
+ id_provider = ldap
+ auth_provider = ldap
+ ldap_uri = {ldap_conn.ds_inst.ldap_url}
+ ldap_search_base = {ldap_conn.ds_inst.base_dn}
+ """).format(**locals())
+
+
+def create_conf_file(contents):
+ """Create sssd.conf with specified contents"""
+ conf = open(config.CONF_PATH, "w")
+ conf.write(contents)
+ conf.close()
+ os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR)
+
+
+def cleanup_conf_file():
+ """Remove sssd.conf, if it exists"""
+ if os.path.lexists(config.CONF_PATH):
+ os.unlink(config.CONF_PATH)
+
+
+def create_conf_cleanup(request):
+ """Add teardown for removing sssd.conf"""
+ request.addfinalizer(cleanup_conf_file)
+
+
+def create_conf_fixture(request, contents):
+ """
+ Create sssd.conf with specified contents and add teardown for removing it.
+ """
+ create_conf_file(contents)
+ create_conf_cleanup(request)
+
+
+def create_sssd_process():
+ """Start the SSSD process"""
+ if subprocess.call(["sssd", "-D", "-f"]) != 0:
+ raise Exception("sssd start failed")
+
+
+def cleanup_sssd_process():
+ """Stop the SSSD process and remove its state"""
+ try:
+ pid_file = open(config.PIDFILE_PATH, "r")
+ pid = int(pid_file.read())
+ os.kill(pid, signal.SIGTERM)
+ while True:
+ try:
+ os.kill(pid, signal.SIGCONT)
+ except:
+ break
+ time.sleep(1)
+ except:
+ pass
+ for path in os.listdir(config.DB_PATH):
+ os.unlink(config.DB_PATH + "/" + path)
+ for path in os.listdir(config.MCACHE_PATH):
+ os.unlink(config.MCACHE_PATH + "/" + path)
+
+
+def create_sssd_cleanup(request):
+ """Add teardown for stopping SSSD and removing its state"""
+ request.addfinalizer(cleanup_sssd_process)
+
+
+def create_sssd_fixture(request):
+ """Start SSSD and add teardown for stopping it and removing its state"""
+ create_sssd_process()
+ create_sssd_cleanup(request)
+
+
+@pytest.fixture
+def users_and_groups(request, ldap_conn):
+ ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
+ ent_list.add_user("user1", 1001, 2001, loginShell="/bin/sh1")
+ ent_list.add_user("user2", 1002, 2002, loginShell="/bin/sh2")
+ ent_list.add_user("user3", 1003, 2003, loginShell="/bin/sh3")
+ # User without primary group
+ ent_list.add_user("user4", 1004, 2004, loginShell="/bin/sh4")
+ ent_list.add_group("group1", 2001)
+ ent_list.add_group("group2", 2002)
+ ent_list.add_group("group3", 2003)
+ ent_list.add_group("empty_group", 2010)
+ ent_list.add_group("one_user_group", 2011, ["user1"])
+ ent_list.add_group("two_user_group", 2012, ["user1", "user2"])
+ ent_list.add_group("three_user_group", 2013, ["user1", "user2", "user3"])
+ # Supplementary group for a user without primary group
+ ent_list.add_group("groupless_user_group", 2014, ["user4"])
+ create_ldap_fixture(request, ldap_conn, ent_list)
+
+
+@pytest.fixture
+def none(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "none".
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = none
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_none(none):
+ """Test "none" scope"""
+ ent.assert_passwd(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell="/bin/sh1"),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def all(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "all".
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = all
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_all_nam(all):
+ """Test "all" scope with getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ user3=dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ user4=dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ ))
+
+
+def test_all_uid(all):
+ """Test "all" scope with getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ 1003:dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ 1004:dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ })
+
+
+def test_all_ent(all):
+ """Test "all" scope with getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ )
+ )
+
+
+@pytest.fixture
+def some_empty(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", but no users or groups listed.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_some_empty(some_empty):
+ """Test "some" scope with no users or groups"""
+ ent.assert_passwd(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell="/bin/sh1"),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_users(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", and some users listed.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ users = user1, user2
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_some_users_nam(some_users):
+ """Test "some" scope with user list and getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_users_uid(some_users):
+ """Test "some" scope with user list and getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_users_ent(some_users):
+ """Test "some" scope with user list and getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_users_overridden(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying two users with
+ overridden names, but one listed with the original name.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ users = overridden_user1, user2
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+ subprocess.check_call(["sss_override", "user-add", "user1",
+ "-n", "overridden_user1"])
+ subprocess.check_call(["sss_override", "user-add", "user2",
+ "-n", "overridden_user2"])
+ restart_sssd()
+
+
+def test_some_users_overridden_nam(some_users_overridden):
+ """
+ Test "some" scope with user list containing some
+ overridden users, requested with getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ overridden_user1=dict(name="overridden_user1", uid=1001,
+ shell=config.SESSION_RECORDING_SHELL),
+ overridden_user2=dict(name="overridden_user2", uid=1002,
+ shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_users_overridden_uid(some_users_overridden):
+ """
+ Test "some" scope with user list containing some
+ overridden users, requested with getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="overridden_user1", uid=1001,
+ shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="overridden_user2", uid=1002,
+ shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_users_overridden_ent(some_users_overridden):
+ """
+ Test "some" scope with user list containing some
+ overridden users, requested with getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="overridden_user1", uid=1001,
+ shell=config.SESSION_RECORDING_SHELL),
+ dict(name="overridden_user2", uid=1002,
+ shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_groups1(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying a single-user supplementary group,
+ and a two-user supplementary group intersecting with the first one.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = one_user_group, two_user_group
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+@pytest.fixture
+def some_groups2(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying a three-user supplementary group.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = three_user_group
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+@pytest.fixture
+def some_groups3(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying a group with a user with
+ non-existent primary group.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = groupless_user_group
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+@pytest.fixture
+def some_groups4(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying two primary groups.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = group1, group3
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_some_groups1_nam(some_groups1):
+ """Test "some" scope with group list and getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups1_uid(some_groups1):
+ """Test "some" scope with group list and getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups1_ent(some_groups1):
+ """Test "some" scope with group list and getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+def test_some_groups2_nam(some_groups2):
+ """Test "some" scope with group list and getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ user3=dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups2_uid(some_groups2):
+ """Test "some" scope with group list and getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ 1003:dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups2_ent(some_groups2):
+ """Test "some" scope with group list and getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+def test_some_groups3_nam(some_groups3):
+ """Test "some" scope with group list and getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell="/bin/sh1"),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ ))
+
+
+def test_some_groups3_uid(some_groups3):
+ """Test "some" scope with group list and getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell="/bin/sh1"),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ })
+
+
+def test_some_groups3_ent(some_groups3):
+ """Test "some" scope with group list and getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell="/bin/sh1"),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell=config.SESSION_RECORDING_SHELL),
+ )
+ )
+
+
+def test_some_groups4_nam(some_groups4):
+ """Test "some" scope with group list and getpwnam"""
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups4_uid(some_groups4):
+ """Test "some" scope with group list and getpwuid"""
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups4_ent(some_groups4):
+ """Test "some" scope with group list and getpwent"""
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_groups_overridden1(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying two primary groups with
+ overridden names, but one listed with the original name.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = overridden_group1, group2
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+ subprocess.check_call(["sss_override", "group-add", "group1",
+ "-n", "overridden_group1"])
+ subprocess.check_call(["sss_override", "group-add", "group2",
+ "-n", "overridden_group2"])
+ restart_sssd()
+
+
+def test_some_groups_overridden1_nam(some_groups_overridden1):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups_overridden1_uid(some_groups_overridden1):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups_overridden1_ent(some_groups_overridden1):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_groups_overridden2(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", specifying two supplementary groups with
+ overridden names, but one listed with the original name.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = one_user_group_overridden, two_user_group
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+ subprocess.check_call(["sss_override", "group-add", "one_user_group",
+ "-n", "one_user_group_overridden"])
+ subprocess.check_call(["sss_override", "group-add", "two_user_group",
+ "-n", "two_user_group_overridden"])
+ restart_sssd()
+
+
+def test_some_groups_overridden2_nam(some_groups_overridden2):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups_overridden2_uid(some_groups_overridden2):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups_overridden2_ent(some_groups_overridden2):
+ """
+ Test "some" scope with group list containing some
+ overridden groups, and users requested with getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_groups_overridden3(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", having two primary groups with
+ IDs swapped via overriding, but only one of them listed.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = group2
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+ subprocess.check_call(["sss_override", "group-add", "group1",
+ "-g", "2002"])
+ subprocess.check_call(["sss_override", "group-add", "group2",
+ "-g", "2001"])
+ restart_sssd()
+
+
+def test_some_groups_overridden3_nam(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups_overridden3_uid(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups_overridden3_ent(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_groups_overridden4(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", two users with GIDs swapped via overridding,
+ and one of their primary groups listed.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ groups = group2
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+ subprocess.check_call(["sss_override", "user-add", "user1",
+ "-g", "2002"])
+ subprocess.check_call(["sss_override", "user-add", "user2",
+ "-g", "2001"])
+ restart_sssd()
+
+
+def test_some_groups_overridden4_nam(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell="/bin/sh3"),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_groups_overridden4_uid(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell="/bin/sh3"),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_groups_overridden4_ent(some_groups_overridden3):
+ """
+ Test "some" scope with group list containing some
+ overridden group, and users requested with getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell="/bin/sh3"),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
+
+
+@pytest.fixture
+def some_users_and_groups(request, ldap_conn, users_and_groups):
+ """
+ Fixture with scope "some", listing some users and groups.
+ """
+ conf = \
+ format_basic_conf(ldap_conn, SCHEMA_RFC2307) + \
+ unindent("""\
+ [session_recording]
+ scope = some
+ users = user3
+ groups = one_user_group
+ """).format(**locals())
+ create_conf_fixture(request, conf)
+ create_sssd_fixture(request)
+
+
+def test_some_users_and_groups_nam(some_users_and_groups):
+ """
+ Test "some" scope with user and group lists and getpwnam.
+ """
+ ent.assert_each_passwd_by_name(dict(
+ user1=dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ user2=dict(name="user2", uid=1002, shell="/bin/sh2"),
+ user3=dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ user4=dict(name="user4", uid=1004, shell="/bin/sh4"),
+ ))
+
+
+def test_some_users_and_groups_uid(some_users_and_groups):
+ """
+ Test "some" scope with user and group lists and getpwuid.
+ """
+ ent.assert_each_passwd_by_uid({
+ 1001:dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ 1002:dict(name="user2", uid=1002, shell="/bin/sh2"),
+ 1003:dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ 1004:dict(name="user4", uid=1004, shell="/bin/sh4"),
+ })
+
+
+def test_some_users_and_groups_ent(some_users_and_groups):
+ """
+ Test "some" scope with user and group lists and getpwent.
+ """
+ ent.assert_passwd_list(
+ ent.contains_only(
+ dict(name="user1", uid=1001, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user2", uid=1002, shell="/bin/sh2"),
+ dict(name="user3", uid=1003, shell=config.SESSION_RECORDING_SHELL),
+ dict(name="user4", uid=1004, shell="/bin/sh4"),
+ )
+ )
--
2.14.1
Reference in New Issue View Git Blame Copy Permalink