From 34b491e735ad47c4805e63f3b83a659b8d10262b Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Nov 2016 19:15:01 +0100 Subject: reset HOME, USER(NAME), TMPDIR & SHELL in DropPrivileges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We can't cleanup the environment like e.g. sudo would do as you usually want the environment to "leak" into these helpers, but some variables like HOME should really not have still the value of the root user – it could confuse the helpers (USER) and HOME isn't accessible anyhow. Closes: 842877 --- test/integration/skip-apt-dropprivs | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100755 test/integration/skip-apt-dropprivs (limited to 'test/integration/skip-apt-dropprivs') diff --git a/test/integration/skip-apt-dropprivs b/test/integration/skip-apt-dropprivs new file mode 100755 index 000000000..e0dd741cd --- /dev/null +++ b/test/integration/skip-apt-dropprivs @@ -0,0 +1,32 @@ +#!/bin/sh +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" + +setupenvironment +configarchitecture 'amd64' + +aptdropprivs() { runapt "${APTTESTHELPERSBINDIR}/aptdropprivs" "$@"; } + +testsuccess aptdropprivs -- /bin/true +testsuccess aptdropprivs --user "$USER" -- /bin/true +testsuccess aptdropprivs --user 'nobody' -- /bin/true +testsuccess aptdropprivs --user '_apt' -- /bin/true + +IDBIN='/usr/bin/id' +testsuccessequal "$("$IDBIN")" aptdropprivs --user "$USER" -- "$IDBIN" + +SUDOBIN='/usr/bin/sudo' +testequal "sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?" aptdropprivs --user 'nobody' -- "$SUDOBIN" "$IDBIN" + +if [ "$(id -u)" = '0' ]; then + testsuccessequal '_apt' aptdropprivs --user '_apt' -- "$IDBIN" '-un' + testsuccess aptdropprivs --user '_apt' -- '/bin/sh' '-c' 'export' + cp rootdir/tmp/testsuccess.output apt.env + testsuccessequal "export HOME='/nonexistent'" grep '^export HOME' apt.env + testsuccessequal "export USER='_apt' +export USERNAME='_apt'" grep '^export USER' apt.env + testsuccessequal "export LOGNAME='_apt'" grep '^export LOGNAME' apt.env + testsuccessequal "export SHELL='/bin/sh'" grep '^export SHELL=' apt.env +fi -- cgit v1.2.3-70-g09d2