|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Test: Password File Permissions |
| 3 | +# |
| 4 | +# Verifies that puremyhad refuses to start when a configured password_file |
| 5 | +# is world- or group-accessible, or owned by an untrusted user. A password |
| 6 | +# file holds MySQL credentials; the daemon must fail loudly at startup |
| 7 | +# rather than silently accept a misconfigured (e.g. 0644) deployment. |
| 8 | +set -euo pipefail |
| 9 | +source "$(dirname "$0")/../lib/helpers.sh" |
| 10 | +echo "=== Test 28: Password File Permissions ===" |
| 11 | + |
| 12 | +# --------------------------------------------------------------------------- |
| 13 | +# 1. Happy path: the image-baked password files must have the strict mode |
| 14 | +# and ownership that the validator requires. This doubles as a regression |
| 15 | +# guard against future Dockerfile changes. |
| 16 | +# --------------------------------------------------------------------------- |
| 17 | +wait_for_health "Healthy" 60 |
| 18 | + |
| 19 | +for pass in mysql.pass repl.pass; do |
| 20 | + mode=$($COMPOSE exec -T puremyhad stat -c '%a' /etc/puremyha-secrets/$pass | tr -d '\r') |
| 21 | + assert_eq "$pass mode is 0600" "600" "$mode" |
| 22 | + |
| 23 | + owner=$($COMPOSE exec -T puremyhad stat -c '%U:%G' /etc/puremyha-secrets/$pass | tr -d '\r') |
| 24 | + assert_eq "$pass owned by root:root" "root:root" "$owner" |
| 25 | +done |
| 26 | + |
| 27 | +# --------------------------------------------------------------------------- |
| 28 | +# 2. Negative: daemon must refuse to start with a 0644 password file. |
| 29 | +# We spawn a one-shot puremyhad against a throwaway config rather than |
| 30 | +# restarting the long-running daemon container. |
| 31 | +# --------------------------------------------------------------------------- |
| 32 | +$COMPOSE exec -T puremyhad sh -c ' |
| 33 | + set -e |
| 34 | + mkdir -p /tmp/pwtest |
| 35 | + echo "pw" > /tmp/pwtest/bad.pass |
| 36 | + chmod 0644 /tmp/pwtest/bad.pass |
| 37 | + cat > /tmp/pwtest/bad.yaml <<EOF |
| 38 | +clusters: |
| 39 | + - name: perm-test |
| 40 | + nodes: |
| 41 | + - host: mysql-source |
| 42 | + port: 3306 |
| 43 | + credentials: |
| 44 | + user: puremyha |
| 45 | + password_file: /tmp/pwtest/bad.pass |
| 46 | +
|
| 47 | +global: |
| 48 | + monitoring: |
| 49 | + interval: 1s |
| 50 | + connect_timeout: 2s |
| 51 | + replication_lag_warning: 5s |
| 52 | + replication_lag_critical: 10s |
| 53 | + failure_detection: |
| 54 | + recovery_block_period: 30s |
| 55 | + failover: |
| 56 | + auto_failover: false |
| 57 | +EOF |
| 58 | +' |
| 59 | + |
| 60 | +exit_code=0 |
| 61 | +output=$($COMPOSE exec -T puremyhad puremyhad \ |
| 62 | + --config /tmp/pwtest/bad.yaml \ |
| 63 | + --socket /tmp/pwtest/sock 2>&1) || exit_code=$? |
| 64 | + |
| 65 | +assert_neq "daemon exits non-zero with 0644 password file" "0" "$exit_code" |
| 66 | +assert_contains "daemon error mentions group/other access" "group or other" "$output" |
| 67 | +assert_contains "daemon error names the offending path" "/tmp/pwtest/bad.pass" "$output" |
| 68 | + |
| 69 | +# --------------------------------------------------------------------------- |
| 70 | +# 3. Negative: daemon must also refuse a 0640 (group-readable) file. |
| 71 | +# --------------------------------------------------------------------------- |
| 72 | +$COMPOSE exec -T puremyhad chmod 0640 /tmp/pwtest/bad.pass |
| 73 | + |
| 74 | +exit_code=0 |
| 75 | +output=$($COMPOSE exec -T puremyhad puremyhad \ |
| 76 | + --config /tmp/pwtest/bad.yaml \ |
| 77 | + --socket /tmp/pwtest/sock 2>&1) || exit_code=$? |
| 78 | + |
| 79 | +assert_neq "daemon exits non-zero with 0640 password file" "0" "$exit_code" |
| 80 | +assert_contains "daemon error mentions group/other access (0640)" "group or other" "$output" |
| 81 | + |
| 82 | +# --------------------------------------------------------------------------- |
| 83 | +# 4. Positive control: flipping the same file to 0600 lets the daemon |
| 84 | +# advance past password loading. It will still fail afterwards (the yaml |
| 85 | +# has no such MySQL user), but the failure must NOT be the permission |
| 86 | +# rejection. We assert that "group or other" does not appear. |
| 87 | +# --------------------------------------------------------------------------- |
| 88 | +$COMPOSE exec -T puremyhad chmod 0600 /tmp/pwtest/bad.pass |
| 89 | + |
| 90 | +exit_code=0 |
| 91 | +output=$($COMPOSE exec -T puremyhad timeout 3 puremyhad \ |
| 92 | + --config /tmp/pwtest/bad.yaml \ |
| 93 | + --socket /tmp/pwtest/sock 2>&1) || exit_code=$? |
| 94 | + |
| 95 | +if echo "$output" | grep -qF "group or other"; then |
| 96 | + echo " FAIL: 0600 password file still triggered the permission rejection" |
| 97 | + echo " ACTUAL: $output" |
| 98 | + ((FAIL_COUNT++)) || true |
| 99 | +else |
| 100 | + echo " PASS: 0600 password file bypasses the permission check" |
| 101 | + ((PASS_COUNT++)) || true |
| 102 | +fi |
| 103 | + |
| 104 | +# Clean up test artefacts so re-runs start fresh |
| 105 | +$COMPOSE exec -T puremyhad rm -rf /tmp/pwtest 2>/dev/null || true |
| 106 | + |
| 107 | +test_summary |
0 commit comments