tests/t0302-home-access.sh


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

#!/bin/sh

# Guards the promise that cgit reads nothing out of the home directory of
# whichever account the web server happens to run as. Every page is fetched
# under strace with HOME pointed at a path that is known not to exist, and
# the run fails if any call taking a path names it, which is how a stray
# read of a personal gitconfig would show up. The whole file class is traced
# rather than access alone, which is no syscall of its own on arm64.

test_description='Ensure that git does not access $HOME'
. ./setup.sh

# strace needs ptrace, which containers and hardened kernels refuse even
# where the binary is installed, so a working run is checked as well as a
# present binary.
command -v strace >/dev/null 2>&1 || {
	skip_all='Skipping access validation tests: strace not found'
	test_done
}

strace true 2>/dev/null || {
	skip_all='Skipping access validation tests: strace not functional'
	test_done
}

test_no_home_access() {
	missing_home=/path/to/some/place/that/does/not/possibly/exist &&
	strace \
		-E HOME="$missing_home" \
		-E CGIT_CONFIG="$PWD/cgitrc" \
		-E QUERY_STRING="url=$1" \
		-e trace=%file -f -o strace.out cgit &&
	! grep "$missing_home" strace.out
}

test_no_home_access_success() {
	test_expect_success "do not access \$HOME: $1" "
		test_no_home_access '$1'
	"
}

test_no_home_access_success
test_no_home_access_success foo
test_no_home_access_success foo/refs
test_no_home_access_success foo/log
test_no_home_access_success foo/tree
test_no_home_access_success foo/tree/file-1
test_no_home_access_success foo/commit
test_no_home_access_success foo/diff
test_no_home_access_success foo/patch
test_no_home_access_success foo/snapshot/master.tar.gz

test_done