test_session_recording.py revision b4c08cb3249cd270e38e9b74a83c00c38ec16c19
#
# Session Recording tests
#
# Copyright (c) 2016 Red Hat, Inc.
# Author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
#
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import os
import stat
import ent
import config
import signal
import subprocess
import time
import ldap
import pytest
import ds_openldap
import ldap_ent
from util import *
LDAP_BASE_DN = "dc=example,dc=com"
def stop_sssd():
"""Stop sssd"""
while True:
try:
except:
break
def start_sssd():
"""Start sssd"""
raise Exception("sssd start failed")
def restart_sssd():
"""Restart sssd"""
"""LDAP server instance fixture"""
"cn=admin", "Secret123"
)
try:
except:
raise
return ds_inst
"""LDAP server connection fixture"""
return ldap_conn
"""Add LDAP entries from ent_list"""
if ent_list is not None:
"""Remove LDAP entries added by create_ldap_entries"""
if ent_list is None:
attrlist=[]):
else:
"""Add LDAP entries and add teardown for removing them"""
SCHEMA_RFC2307 = "rfc2307"
SCHEMA_RFC2307_BIS = "rfc2307bis"
"""
Format a basic SSSD configuration.
The files domain is defined but not enabled in order to avoid enumerating
users from the files domain that would otherwise by implicitly enabled.
"""
if schema == SCHEMA_RFC2307_BIS:
schema_conf += "ldap_group_object_class = groupOfNames\n"
return unindent("""\
[sssd]
debug_level = 0xffff
domains = LDAP
services = nss, pam
[nss]
debug_level = 0xffff
memcache_timeout = 0
[pam]
debug_level = 0xffff
id_provider = files
ldap_auth_disable_tls_never_use_in_production = true
debug_level = 0xffff
enumerate = true
{schema_conf}
id_provider = ldap
auth_provider = ldap
ldap_uri = {ldap_conn.ds_inst.ldap_url}
ldap_search_base = {ldap_conn.ds_inst.base_dn}
def create_conf_file(contents):
"""Create sssd.conf with specified contents"""
def cleanup_conf_file():
"""Remove sssd.conf, if it exists"""
def create_conf_cleanup(request):
"""Add teardown for removing sssd.conf"""
"""
Create sssd.conf with specified contents and add teardown for removing it.
"""
def create_sssd_process():
"""Start the SSSD process"""
raise Exception("sssd start failed")
def cleanup_sssd_process():
"""Stop the SSSD process and remove its state"""
try:
while True:
try:
except:
break
except:
pass
def create_sssd_cleanup(request):
"""Add teardown for stopping SSSD and removing its state"""
def create_sssd_fixture(request):
"""Start SSSD and add teardown for stopping it and removing its state"""
# User without primary group
# Supplementary group for a user without primary group
"""
Fixture with scope "none".
"""
conf = \
unindent("""\
[session_recording]
scope = none
"""Test "none" scope"""
)
)
"""
Fixture with scope "all".
"""
conf = \
unindent("""\
[session_recording]
scope = all
def test_all_nam(all):
"""Test "all" scope with getpwnam"""
))
def test_all_uid(all):
"""Test "all" scope with getpwuid"""
})
def test_all_ent(all):
"""Test "all" scope with getpwent"""
)
)
"""
Fixture with scope "some", but no users or groups listed.
"""
conf = \
unindent("""\
[session_recording]
scope = some
def test_some_empty(some_empty):
"""Test "some" scope with no users or groups"""
)
)
"""
Fixture with scope "some", and some users listed.
"""
conf = \
unindent("""\
[session_recording]
scope = some
users = user1, user2
"""Test "some" scope with user list and getpwnam"""
))
"""Test "some" scope with user list and getpwuid"""
})
"""Test "some" scope with user list and getpwent"""
)
)
"""
Fixture with scope "some", specifying two users with
overridden names, but one listed with the original name.
"""
conf = \
unindent("""\
[session_recording]
scope = some
users = overridden_user1, user2
"-n", "overridden_user1"])
"-n", "overridden_user2"])
"""
Test "some" scope with user list containing some
overridden users, requested with getpwnam.
"""
))
"""
Test "some" scope with user list containing some
overridden users, requested with getpwuid.
"""
})
"""
Test "some" scope with user list containing some
overridden users, requested with getpwent.
"""
)
)
"""
Fixture with scope "some", specifying a single-user supplementary group,
and a two-user supplementary group intersecting with the first one.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = one_user_group, two_user_group
"""
Fixture with scope "some", specifying a three-user supplementary group.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = three_user_group
"""
Fixture with scope "some", specifying a group with a user with
non-existent primary group.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = groupless_user_group
"""
Fixture with scope "some", specifying two primary groups.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = group1, group3
"""Test "some" scope with group list and getpwnam"""
))
"""Test "some" scope with group list and getpwuid"""
})
"""Test "some" scope with group list and getpwent"""
)
)
"""Test "some" scope with group list and getpwnam"""
))
"""Test "some" scope with group list and getpwuid"""
})
"""Test "some" scope with group list and getpwent"""
)
)
"""Test "some" scope with group list and getpwnam"""
))
"""Test "some" scope with group list and getpwuid"""
})
"""Test "some" scope with group list and getpwent"""
)
)
"""Test "some" scope with group list and getpwnam"""
))
"""Test "some" scope with group list and getpwuid"""
})
"""Test "some" scope with group list and getpwent"""
)
)
"""
Fixture with scope "some", specifying two primary groups with
overridden names, but one listed with the original name.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = overridden_group1, group2
"-n", "overridden_group1"])
"-n", "overridden_group2"])
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwnam.
"""
))
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwuid.
"""
})
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwent.
"""
)
)
"""
Fixture with scope "some", specifying two supplementary groups with
overridden names, but one listed with the original name.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = one_user_group_overridden, two_user_group
"-n", "one_user_group_overridden"])
"-n", "two_user_group_overridden"])
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwnam.
"""
))
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwuid.
"""
})
"""
Test "some" scope with group list containing some
overridden groups, and users requested with getpwent.
"""
)
)
"""
Fixture with scope "some", having two primary groups with
IDs swapped via overriding, but only one of them listed.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = group2
"-g", "2002"])
"-g", "2001"])
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwnam.
"""
))
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwuid.
"""
})
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwent.
"""
)
)
"""
Fixture with scope "some", two users with GIDs swapped via overridding,
and one of their primary groups listed.
"""
conf = \
unindent("""\
[session_recording]
scope = some
groups = group2
"-g", "2002"])
"-g", "2001"])
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwnam.
"""
))
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwuid.
"""
})
"""
Test "some" scope with group list containing some
overridden group, and users requested with getpwent.
"""
)
)
"""
Fixture with scope "some", listing some users and groups.
"""
conf = \
unindent("""\
[session_recording]
scope = some
users = user3
groups = one_user_group
"""
Test "some" scope with user and group lists and getpwnam.
"""
))
"""
Test "some" scope with user and group lists and getpwuid.
"""
})
"""
Test "some" scope with user and group lists and getpwent.
"""
)
)