Skip to content

Commit cfccb80

Browse files
jakub-vavra-czjakub-vavra-cz
committed
Add split/move basic tests to standalone suite
Add new tests for basic sudo functionality. Move/refactor basic tests from test_sudo suite.
1 parent 998cc3e commit cfccb80

File tree

2 files changed

+296
-81
lines changed

2 files changed

+296
-81
lines changed

‎pytest/tests/test_basic.py‎

Lines changed: 296 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,296 @@
1+
"""
2+
SUDO Responder Tests.
3+
4+
:requirement: sudo
5+
"""
6+
7+
from __future__ import annotations
8+
9+
from sssd_test_framework.roles.ad import AD
10+
from sssd_test_framework.roles.client import Client
11+
from sssd_test_framework.roles.generic import GenericProvider
12+
from sssd_test_framework.topology import KnownTopology
13+
14+
import pytest
15+
16+
17+
@pytest.mark.importance("critical")
18+
@pytest.mark.topology(KnownTopology.BareAD)
19+
@pytest.mark.topology(KnownTopology.BareIPA)
20+
@pytest.mark.topology(KnownTopology.BareLDAP)
21+
@pytest.mark.topology(KnownTopology.BareClient)
22+
def test_basic__single_user(client: Client, provider: GenericProvider):
23+
"""
24+
:title: One user is allowed to run command, other user is not
25+
:setup:
26+
1. Create users "user-1" and "user-2"
27+
2. Create sudorule to allow "user-1" run "/bin/ls on all hosts
28+
3. Enable SSSD sudo responder and start SSSD
29+
:steps:
30+
1. List sudo rules for "user-1"
31+
2. Run "sudo /bin/ls root" as user-1
32+
3. List sudo rules for "user-2"
33+
4. Run "sudo /bin/ls root" as user-2
34+
:expectedresults:
35+
1. User is able to run /bin/ls as root
36+
2. Command is successful
37+
3. User is not able to run /bin/ls as root
38+
4. Command failed
39+
:customerscenario: False
40+
"""
41+
if isinstance(provider, Client):
42+
client.sssd.common.local()
43+
client.sssd.common.sudo()
44+
client.sssd.start()
45+
u = provider.user("user-1").add()
46+
provider.user("user-2").add()
47+
provider.sudorule("test").add(user=u, host="ALL", command="/bin/ls")
48+
49+
assert client.auth.sudo.list("user-1", "Secret123", expected=["(root) /bin/ls"]), "Sudo list failed!"
50+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command failed!"
51+
52+
assert not client.auth.sudo.list("user-2", "Secret123"), "Sudo list successful!"
53+
assert not client.auth.sudo.run("user-2", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
54+
55+
56+
@pytest.mark.importance("critical")
57+
@pytest.mark.topology(KnownTopology.BareAD)
58+
@pytest.mark.topology(KnownTopology.BareIPA)
59+
@pytest.mark.topology(KnownTopology.BareLDAP)
60+
@pytest.mark.topology(KnownTopology.BareClient)
61+
def test_basic__multiple_users(client: Client, provider: GenericProvider):
62+
"""
63+
:title: User fro list are allowed to run a command
64+
:setup:
65+
1. Create users "user-1", "user-2" and "user-deny"
66+
2. Create sudorule to allow "user-1" and "user-2" run "/bin/ls on all hosts
67+
3. Enable SSSD sudo responder and start SSSD
68+
:steps:
69+
1. Run "sudo /bin/ls root" as user-1
70+
2. Run "sudo /bin/ls root" as user-2
71+
3. Run "sudo /bin/ls root" as user-deny
72+
:expectedresults:
73+
1. User "user-1" is able to run /bin/ls as root
74+
2. User "user-2" is able to run /bin/ls as root
75+
3. User "user-demy" is not able to run /bin/ls as root
76+
:customerscenario: False
77+
"""
78+
if isinstance(provider, Client):
79+
client.sssd.common.local()
80+
client.sssd.common.sudo()
81+
client.sssd.start()
82+
provider.user("user-1").add()
83+
provider.user("user-2").add()
84+
provider.user("user-deny").add()
85+
provider.sudorule("userlist").add(user=["user-1", "user-2"], host="ALL", command="/bin/ls")
86+
87+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command failed!"
88+
assert client.auth.sudo.run("user-2", "Secret123", command="/bin/ls /root"), "Sudo command failed!"
89+
assert not client.auth.sudo.run("user-deny", "Secret123", command="/bin/ls /root"), "Sudo command passed!"
90+
91+
92+
@pytest.mark.importance("critical")
93+
@pytest.mark.ticket(bz=1372440, gh=4236)
94+
@pytest.mark.contains_workaround_for(gh=4483)
95+
@pytest.mark.topology(KnownTopology.BareAD)
96+
@pytest.mark.topology(KnownTopology.BareIPA)
97+
@pytest.mark.topology(KnownTopology.BareLDAP)
98+
@pytest.mark.topology(KnownTopology.BareClient)
99+
def test_basic__user_is_group(client: Client, provider: GenericProvider):
100+
"""
101+
:title: POSIX groups can be set in sudoUser attribute
102+
:setup:
103+
1. Create user "user-1"
104+
2. Create group "group-1" with "user-1" as a member
105+
3. Create sudorule to allow "group-1" run "/bin/ls on all hosts
106+
4. Enable SSSD sudo responder
107+
5. Start SSSD
108+
:steps:
109+
1. List sudo rules for "user-1"
110+
2. Run "sudo /bin/ls" as "user-1"
111+
:expectedresults:
112+
1. User is able to run only /bin/ls
113+
2. Command is successful
114+
:customerscenario: False
115+
"""
116+
if isinstance(provider, Client):
117+
client.sssd.common.local()
118+
client.sssd.common.sudo()
119+
client.sssd.start()
120+
u = provider.user("user-1").add()
121+
g = provider.group("group-1").add().add_member(u)
122+
provider.sudorule("test").add(user=g, host="ALL", command="/bin/ls")
123+
124+
client.sssd.common.sudo()
125+
client.sssd.start()
126+
127+
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
128+
# Running 'id user-1' will resolve SIDs into group names
129+
if isinstance(provider, AD):
130+
client.tools.id("user-1")
131+
132+
assert client.auth.sudo.list("user-1", "Secret123", expected=["(root) /bin/ls"]), "Sudo list failed!"
133+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
134+
135+
136+
@pytest.mark.importance("critical")
137+
@pytest.mark.contains_workaround_for(gh=4483)
138+
@pytest.mark.topology(KnownTopology.BareAD)
139+
@pytest.mark.topology(KnownTopology.BareIPA)
140+
@pytest.mark.topology(KnownTopology.BareLDAP)
141+
@pytest.mark.topology(KnownTopology.BareClient)
142+
def test_basic__user_is_groups(client: Client, provider: GenericProvider):
143+
"""
144+
:title: Multiple POSIX groups can be set in sudoUser attribute
145+
:setup:
146+
1. Create users "user-1", "user-2" and "user-deny"
147+
2. Create group "group-1" with "user-1" as a member
148+
3. Create group "group-2" with "user-2" as a member
149+
3. Create sudorule to allow "group-1", "group-2" run "/bin/ls on all hosts
150+
4. Enable SSSD sudo responder and start SSSD
151+
:steps:
152+
1. Run "sudo /bin/ls" as "user-1"
153+
2. Run "sudo /bin/ls" as "user-2"
154+
2. Run "sudo /bin/ls" as "user-deny"
155+
:expectedresults:
156+
1. User "user-1" is able to run /bin/ls
157+
2. User "user-2" is able to run /bin/ls
158+
2. User "user-deny" is not able to run /bin/ls
159+
:customerscenario: False
160+
"""
161+
if isinstance(provider, Client):
162+
client.sssd.common.local()
163+
client.sssd.common.sudo()
164+
client.sssd.start()
165+
u1 = provider.user("user-1").add()
166+
g1 = provider.group("group-1").add().add_member(u1)
167+
u2 = provider.user("user-2").add()
168+
g2 = provider.group("group-2").add().add_member(u2)
169+
provider.user("user-deny").add()
170+
provider.sudorule("test").add(user=[g1, g2], host="ALL", command="/bin/ls")
171+
172+
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
173+
# Running 'id user-1' will resolve SIDs into group names
174+
if isinstance(provider, AD):
175+
client.tools.id("user-1")
176+
client.tools.id("user-2")
177+
178+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
179+
assert client.auth.sudo.run("user-2", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
180+
assert not client.auth.sudo.run("user-deny", "Secret123", command="/bin/ls /root"), "Sudo command passed!"
181+
182+
183+
@pytest.mark.importance("critical")
184+
@pytest.mark.contains_workaround_for(gh=4483)
185+
@pytest.mark.topology(KnownTopology.BareAD)
186+
@pytest.mark.topology(KnownTopology.BareIPA)
187+
@pytest.mark.topology(KnownTopology.BareLDAP)
188+
@pytest.mark.topology(KnownTopology.BareClient)
189+
def test_basic__user_and_group(client: Client, provider: GenericProvider):
190+
"""
191+
:title: POSIX groups and users can be mixed in user
192+
:setup:
193+
1. Create user "user-1" and "user-2"
194+
2. Create group "group-1" with "user-1" as a member
195+
3. Create sudorule to allow "group-1" and "user-2" run "/bin/ls on all hosts
196+
4. Enable SSSD sudo responder and start SSSD
197+
:steps:
198+
1. Run "sudo /bin/ls" as "user-1"
199+
2. Run "sudo /bin/ls" as "user-2"
200+
:expectedresults:
201+
1. User "user-1" is able to run only /bin/ls
202+
2. User "user-2" is able to run only /bin/ls
203+
:customerscenario: False
204+
"""
205+
if isinstance(provider, Client):
206+
client.sssd.common.local()
207+
client.sssd.common.sudo()
208+
client.sssd.start()
209+
u1 = provider.user("user-1").add()
210+
u2 = provider.user("user-2").add()
211+
g = provider.group("group-1").add().add_member(u1)
212+
provider.sudorule("test").add(user=[g, u2], host="ALL", command="/bin/ls")
213+
214+
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
215+
# Running 'id user-1' will resolve SIDs into group names
216+
if isinstance(provider, AD):
217+
client.tools.id("user-1")
218+
219+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
220+
assert client.auth.sudo.run("user-2", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
221+
222+
223+
@pytest.mark.importance("critical")
224+
@pytest.mark.contains_workaround_for(gh=4483)
225+
@pytest.mark.topology(KnownTopology.BareAD)
226+
@pytest.mark.topology(KnownTopology.BareIPA)
227+
@pytest.mark.topology(KnownTopology.BareLDAP)
228+
@pytest.mark.topology(KnownTopology.BareClient)
229+
def test_basic__multiple_commands(client: Client, provider: GenericProvider):
230+
"""
231+
:title: Multiple commands can be set in sudo rule
232+
:setup:
233+
1. Create user "user-1"
234+
2. Create sudorule to allow "user-1" run "/bin/ls and /bin/df
235+
3. Enable SSSD sudo responder and start SSSD
236+
:steps:
237+
1. Run "sudo /bin/ls" as "user-1"
238+
2. Run "sudo /bin/df" as "user-1"
239+
:expectedresults:
240+
1. User "user-1" is able to run /bin/ls
241+
2. User "user-1" is able to run /bin/df
242+
:customerscenario: False
243+
"""
244+
if isinstance(provider, Client):
245+
client.sssd.common.local()
246+
client.sssd.common.sudo()
247+
client.sssd.start()
248+
u = provider.user("user-1").add()
249+
250+
provider.sudorule("test").add(user=u, host="ALL", command=["/bin/ls", "/bin/df"])
251+
252+
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
253+
# Running 'id user-1' will resolve SIDs into group names
254+
if isinstance(provider, AD):
255+
client.tools.id("user-1")
256+
257+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
258+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/df"), "Sudo command successful!"
259+
260+
261+
@pytest.mark.importance("critical")
262+
@pytest.mark.contains_workaround_for(gh=4483)
263+
@pytest.mark.topology(KnownTopology.BareAD)
264+
@pytest.mark.topology(KnownTopology.BareIPA)
265+
@pytest.mark.topology(KnownTopology.BareLDAP)
266+
@pytest.mark.topology(KnownTopology.BareClient)
267+
def test_basic__blacklisted_command(client: Client, provider: GenericProvider):
268+
"""
269+
:title: Excluded command can be set in sudo rule
270+
:setup:
271+
1. Create user "user-1"
272+
2. Create sudorule to allow "user-1" run ALL excluding /bin/df
273+
3. Enable SSSD sudo responder and start SSSD
274+
:steps:
275+
1. Run "sudo /bin/ls" as "user-1"
276+
2. Run "sudo /bin/df" as "user-1"
277+
:expectedresults:
278+
1. User "user-1" is able to run /bin/ls
279+
2. User "user-1" is not able to run /bin/df
280+
:customerscenario: False
281+
"""
282+
if isinstance(provider, Client):
283+
client.sssd.common.local()
284+
client.sssd.common.sudo()
285+
client.sssd.start()
286+
u = provider.user("user-1").add()
287+
288+
provider.sudorule("test").add(user=u, host="ALL", command=["ALL", "!/bin/df"])
289+
290+
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
291+
# Running 'id user-1' will resolve SIDs into group names
292+
if isinstance(provider, AD):
293+
client.tools.id("user-1")
294+
295+
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
296+
assert not client.auth.sudo.run("user-1", "Secret123", command="/bin/df"), "Sudo command successful!"

‎pytest/tests/test_sudo.py‎

Lines changed: 0 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import time
1111
from datetime import datetime, timedelta
1212

13-
from sssd_test_framework.roles.ad import AD
1413
from sssd_test_framework.roles.client import Client
1514
from sssd_test_framework.roles.generic import GenericADProvider, GenericProvider
1615
from sssd_test_framework.roles.ldap import LDAP
@@ -19,48 +18,6 @@
1918
import pytest
2019

2120

22-
@pytest.mark.importance("critical")
23-
@pytest.mark.topology(KnownTopology.BareAD)
24-
@pytest.mark.topology(KnownTopology.BareIPA)
25-
@pytest.mark.topology(KnownTopology.BareLDAP)
26-
@pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
27-
@pytest.mark.require(
28-
lambda client, sssd_service_user: ((sssd_service_user == "root") or client.features["non-privileged"]),
29-
"SSSD was built without support for running under non-root",
30-
)
31-
def test_sudo__user_allowed(client: Client, provider: GenericProvider, sssd_service_user: str):
32-
"""
33-
:title: One user is allowed to run command, other user is not
34-
:setup:
35-
1. Create users "user-1" and "user-2"
36-
2. Create sudorule to allow "user-1" run "/bin/ls on all hosts
37-
3. Enable SSSD sudo responder and start SSSD
38-
:steps:
39-
1. List sudo rules for "user-1"
40-
2. Run "sudo /bin/ls root" as user-1
41-
3. List sudo rules for "user-2"
42-
4. Run "sudo /bin/ls root" as user-2
43-
:expectedresults:
44-
1. User is able to run /bin/ls as root
45-
2. Command is successful
46-
3. User is not able to run /bin/ls as root
47-
4. Command failed
48-
:customerscenario: False
49-
"""
50-
u = provider.user("user-1").add()
51-
provider.user("user-2").add()
52-
provider.sudorule("test").add(user=u, host="ALL", command="/bin/ls")
53-
54-
client.sssd.common.sudo()
55-
client.sssd.start(service_user=sssd_service_user)
56-
57-
assert client.auth.sudo.list("user-1", "Secret123", expected=["(root) /bin/ls"]), "Sudo list failed!"
58-
assert client.auth.sudo.run("user-1", "Secret123", command="/bin/ls /root"), "Sudo command failed!"
59-
60-
assert not client.auth.sudo.list("user-2", "Secret123"), "Sudo list successful!"
61-
assert not client.auth.sudo.run("user-2", "Secret123", command="/bin/ls /root"), "Sudo command successful!"
62-
63-
6421
@pytest.mark.importance("critical")
6522
@pytest.mark.topology(KnownTopology.BareAD)
6623
@pytest.mark.topology(KnownTopology.BareLDAP)
@@ -186,44 +143,6 @@ def test_sudo__rules_refresh(client: Client, provider: GenericProvider, sssd_ser
186143
assert client.auth.sudo.list("user-1", "Secret123", expected=["(root) /bin/less"]), "Sudo command failed!"
187144

188145

189-
@pytest.mark.importance("critical")
190-
@pytest.mark.ticket(bz=1372440, gh=4236)
191-
@pytest.mark.contains_workaround_for(gh=4483)
192-
@pytest.mark.topology(KnownTopology.BareAD)
193-
@pytest.mark.topology(KnownTopology.BareIPA)
194-
@pytest.mark.topology(KnownTopology.BareLDAP)
195-
def test_sudo__user_is_group(client: Client, provider: GenericProvider):
196-
"""
197-
:title: POSIX groups can be set in sudoUser attribute
198-
:setup:
199-
1. Create user "user-1"
200-
2. Create group "group-1" with "user-1" as a member
201-
3. Create sudorule to allow "group-1" run "/bin/ls on all hosts
202-
4. Enable SSSD sudo responder
203-
5. Start SSSD
204-
:steps:
205-
1. List sudo rules for "user-1"
206-
2. Run "sudo /bin/ls" as "user-1"
207-
:expectedresults:
208-
1. User is able to run only /bin/ls
209-
2. Command is successful
210-
:customerscenario: False
211-
"""
212-
u = provider.user("user-1").add()
213-
g = provider.group("group-1").add().add_member(u)
214-
provider.sudorule("test").add(user=g, host="ALL", command="/bin/ls")
215-
216-
client.sssd.common.sudo()
217-
client.sssd.start()
218-
219-
# Until https://github.com/SSSD/sssd/issues/4483 is resolved
220-
# Running 'id user-1' will resolve SIDs into group names
221-
if isinstance(provider, AD):
222-
client.tools.id("user-1")
223-
224-
assert client.auth.sudo.list("user-1", "Secret123", expected=["(root) /bin/ls"]), "Sudo list failed!"
225-
226-
227146
@pytest.mark.importance("critical")
228147
@pytest.mark.ticket(bz=1826272, gh=5119)
229148
@pytest.mark.topology(KnownTopology.BareAD)

0 commit comments

Comments
 (0)