1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
summary: Ensure create-user functionality
details: |
Check the command `snap create-user` succeeds when run as non-root user with sudo.
Ensure the ssh keys are imported for the user and that it can be created as a sudoer.
environment:
USER_EMAIL: mvo@ubuntu.com
USER_NAME: mvo
restore: |
if [ -e managed.device ]; then
exit 0
fi
# Check if the user exists before remove it
if id "$USER_NAME" >/dev/null 2>&1; then
snap remove-user "$USER_NAME"
fi
debug: |
if [ -e managed.device ]; then
ls -al /home/"$USER_NAME" || true
cat /var/lib/extrausers/passwd || true
fi
execute: |
echo "snap create-user -- ensure failure when run as non-root user without sudo"
expected="error: while creating user: access denied"
if obtained=$(su - test /bin/sh -c "snap create-user $USER_EMAIL 2>&1"); then
echo "create-user command should have failed"
fi
[[ "$obtained" =~ $expected ]]
if [ "$(snap managed)" = "true" ]; then
# Leave a file indicating the device was initially managed
touch managed.device
echo "snap create-user -- not success when run as non-root user with sudo on managed device"
if su - test /bin/sh -c "sudo snap create-user --sudoer $USER_EMAIL" 2>create.error; then
echo "Did not get expected error creating user in managed device"
exit 1
fi
MATCH "cannot create user: device already managed" < create.error
exit 0
fi
echo "snap create-user -- ensure success when run as non-root user with sudo"
expected="created user \"$USER_NAME\""
obtained=$(su - test /bin/sh -c "sudo snap create-user --sudoer $USER_EMAIL 2>&1")
[[ "$obtained" =~ $expected ]]
echo "ensure user exists in /etc/passwd"
MATCH "^$USER_NAME:x:[0-9]+:[0-9]+:$USER_EMAIL" < /var/lib/extrausers/passwd
echo "ensure proper sudoers.d file"
MATCH "$USER_NAME ALL=\\(ALL\\) NOPASSWD:ALL" < "/etc/sudoers.d/create-user-$USER_NAME"
echo "ensure the user's home directory exists"
test -d "/home/$USER_NAME"
echo "ensure ~/.snap/auth.json was created"
test -f "/home/$USER_NAME/.snap/auth.json"
echo "ensure user's email was stored in ~/.snap/auth.json"
MATCH "\"email\":\"$USER_EMAIL\"" < "/home/$USER_NAME/.snap/auth.json"
|
