tests/t0302-home-access.sh


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

#!/bin/sh

# Guards the promise that cgit reads nothing out of the home directory of
# whichever account the web server happens to run as. Every page is fetched
# under strace with HOME pointed at a path that is known not to exist, and
# the run fails if any call taking a path names it, which is how a stray
# read of a personal gitconfig would show up. The whole file class is traced
# rather than access alone, which is not a syscall of its own everywhere.

test_description='Ensure that git does not access $HOME'
. ./setup.sh

# strace needs ptrace, which a system can refuse even where the binary is
# installed, and a release that knows the file class of calls, so the probe
# traces that class.
test_lazy_prereq STRACE '
	strace -o /dev/null -e trace=%file true
'

test_have_prereq STRACE || {
	skip_all='Skipping access validation tests: no strace that can trace here'
	test_done
}

# Valgrind reads a .valgrindrc from the home directory itself, and strace
# would follow it there.
test -z "$CGIT_TEST_VALGRIND" || {
	skip_all='Skipping access validation tests: strace would trace valgrind'
	test_done
}

# cgit unsets HOME before git starts, so a read that fell back on the home
# directory in the password database would name that one instead.
passwd_home=$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6)

# The page has to render, as a request that fails early opens fewer files, and
# the config cgit was handed shows that its calls made it into the trace.
test_no_home_access() {
	missing_home=/path/to/some/place/that/does/not/possibly/exist &&
	strace \
		-E HOME="$missing_home" \
		-E CGIT_CONFIG="$PWD/cgitrc" \
		-E QUERY_STRING="url=$1" \
		-e trace=%file -f -o strace.out cgit >page &&
	grep "^Status: 200" page &&
	grep -F "\"$PWD/cgitrc\"" strace.out &&
	! grep "$missing_home" strace.out &&
	{ test -z "$passwd_home" || ! grep -F "\"$passwd_home/." strace.out; }
}

test_no_home_access_success() {
	test_expect_success "do not access \$HOME: $1" "
		test_no_home_access '$1'
	"
}

test_no_home_access_success
test_no_home_access_success foo
test_no_home_access_success foo/refs
test_no_home_access_success foo/log
test_no_home_access_success foo/tree
test_no_home_access_success foo/tree/file-1
test_no_home_access_success foo/commit
test_no_home_access_success foo/diff
test_no_home_access_success foo/patch
test_no_home_access_success foo/snapshot/master.tar.gz

test_done