1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
/*
* Basic tests for the pam-afs-session module.
*
* Written by Russ Allbery <eagle@eyrie.org>
* Copyright 2015 Russ Allbery <eagle@eyrie.org>
* Copyright 2010, 2011
* The Board of Trustees of the Leland Stanford Junior University
*
* See LICENSE for licensing terms.
*/
#include <config.h>
#include <portable/kafs.h>
#include <portable/system.h>
#include <errno.h>
#include <pwd.h>
#include <tests/fakepam/pam.h>
#include <tests/fakepam/script.h>
#include <tests/tap/basic.h>
#include <tests/tap/string.h>
int
main(void)
{
struct script_config config;
struct passwd *user;
char *aklog, *uid, *script;
size_t i;
const char *const session_types[] = {
"establish", "establish-debug", "refresh", "refresh-debug",
"reinit", "reinit-debug", "open-session", "open-session-debug"
};
/* Skip the entire test if AFS isn't available. */
if (!k_hasafs())
skip_all("AFS not available");
plan_lazy();
/*
* Clear KRB5CCNAME out of the environment to avoid running aklog when we
* don't expect to.
*/
if (putenv((char *) "KRB5CCNAME") < 0)
sysbail("cannot clear KRB5CCNAME from the environment");
/* Determine the user so that setuid will work. */
user = getpwuid(getuid());
if (user == NULL)
bail("cannot find username of current user");
pam_set_pwd(user);
/* Configure the path to aklog. */
memset(&config, 0, sizeof(config));
aklog = test_file_path("data/fake-aklog");
config.extra[0] = aklog;
/* Initial no-op tests. */
config.user = "testuser";
run_script("data/scripts/basic/noop", &config);
run_script("data/scripts/basic/noop-debug", &config);
/*
* Test behavior without a Kerberos ticket. This doesn't test actual
* creation of a PAG.
*/
unlink("aklog-args");
run_script("data/scripts/basic/no-ticket", &config);
run_script("data/scripts/basic/no-ticket-debug", &config);
ok(access("aklog-args", F_OK) < 0, "aklog was not run");
/*
* Remaining tests run with the module fooled into thinking we have a
* Kerberos ticket cache.
*/
if (putenv((char *) "KRB5CCNAME=krb5cc_test") < 0)
sysbail("cannot set KRB5CCNAME in the environment");
/* Unknown user. Be sure to get the strerror message. */
config.user = "pam-afs-session-unknown-user";
config.extra[1] = strerror(0);
run_script("data/scripts/basic/unknown", &config);
run_script("data/scripts/basic/unknown-debug", &config);
config.extra[1] = NULL;
/* Check that aklog runs in various ways of opening a session. */
config.user = user->pw_name;
basprintf(&uid, "%lu", (unsigned long) getuid());
config.extra[1] = uid;
for (i = 0; i < ARRAY_SIZE(session_types); i++) {
unlink("aklog-args");
basprintf(&script, "data/scripts/basic/%s", session_types[i]);
run_script(script, &config);
free(script);
ok(access("aklog-args", F_OK) == 0, "aklog was run");
}
unlink("aklog-args");
config.extra[1] = NULL;
free(uid);
/* Clean up. */
test_file_path_free(aklog);
return 0;
}
|
