mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 19:56:48 +00:00
7286ba079d
- Hash the root password with a random SHA-512 salt instead of the fixed "$6$kgPoiREy". - Talk to gstfsd through one helper with a 120 s socket timeout; an unreachable daemon or a bad reply is an error message, not a 500. - gstfsd refuses to listen on a non-loopback address unless GSTFSD_ALLOW_REMOTE=1: it is an unauthenticated root service. - gstfsd: encode replies (sendall(str) raised TypeError on Python 3, so the success path never worked) and use octal chmod modes. - README: what gstfsd does and how to allow it on a remote compute.
31 lines
1 KiB
Python
31 lines
1 KiB
Python
import os
|
|
import signal
|
|
import subprocess
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
GSTFSD = Path(__file__).resolve().parent.parent / "conf" / "daemon" / "gstfsd"
|
|
|
|
|
|
class GstfsdBindTestCase(unittest.TestCase):
|
|
"""ROADMAP S-08: gstfsd is an unauthenticated root service; no remote bind by default."""
|
|
|
|
def _run(self, **env):
|
|
# novncd (imported by other tests) sets SIGCHLD to SIG_IGN, which hides exit codes.
|
|
previous = signal.signal(signal.SIGCHLD, signal.SIG_DFL)
|
|
try:
|
|
return subprocess.run(
|
|
[sys.executable, str(GSTFSD)],
|
|
env=dict(os.environ, **env),
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=20,
|
|
)
|
|
finally:
|
|
signal.signal(signal.SIGCHLD, previous)
|
|
|
|
def test_refuses_non_loopback_bind_without_opt_in(self):
|
|
result = self._run(GSTFSD_BIND_HOST="0.0.0.0")
|
|
self.assertNotEqual(result.returncode, 0)
|
|
self.assertIn("GSTFSD_ALLOW_REMOTE", result.stderr)
|