mirror of
https://github.com/Rain-kl/OpenFlare.git
synced 2026-09-29 22:06:38 +08:00
ryan
d3777eac2d
Introduce the shared openflare service account for the agent process and OpenResty workers, normalize data_dir ownership on startup, and ensure managed paths are chowned with 0755/0644 during sync and apply. Docker entrypoint fixes volume ownership before dropping privileges; local systemd install runs the service as openflare with CAP_NET_BIND_SERVICE.
75 lines
2.5 KiB
Go
75 lines
2.5 KiB
Go
package nginx
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestEnsureWorkerReadableTreeFixesRestrictedPagesFiles(t *testing.T) {
|
|
tempDir := t.TempDir()
|
|
pagesDir := filepath.Join(tempDir, "data", "var", "lib", "openflare", "pages")
|
|
releaseDir := filepath.Join(pagesDir, "deployments", "1", "releases", "abc123")
|
|
if err := os.MkdirAll(releaseDir, 0o700); err != nil {
|
|
t.Fatalf("MkdirAll failed: %v", err)
|
|
}
|
|
indexPath := filepath.Join(releaseDir, "index.html")
|
|
if err := os.WriteFile(indexPath, []byte("<html></html>"), 0o600); err != nil {
|
|
t.Fatalf("WriteFile failed: %v", err)
|
|
}
|
|
|
|
if err := EnsureWorldTraversablePath(pagesDir); err != nil {
|
|
t.Fatalf("EnsureWorldTraversablePath failed: %v", err)
|
|
}
|
|
if err := EnsureWorkerReadableTree(pagesDir); err != nil {
|
|
t.Fatalf("EnsureWorkerReadableTree failed: %v", err)
|
|
}
|
|
|
|
info, err := os.Stat(indexPath)
|
|
if err != nil {
|
|
t.Fatalf("Stat failed: %v", err)
|
|
}
|
|
if info.Mode().Perm() != nginxConfigFilePerm {
|
|
t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, info.Mode().Perm())
|
|
}
|
|
etcInfo, err := os.Stat(filepath.Join(tempDir, "data", "var"))
|
|
if err != nil {
|
|
t.Fatalf("Stat var failed: %v", err)
|
|
}
|
|
if etcInfo.Mode().Perm()&0o005 == 0 {
|
|
t.Fatalf("expected var directory to be world-traversable, got %o", etcInfo.Mode().Perm())
|
|
}
|
|
}
|
|
|
|
func TestManagerEnsureWorkerReadAccessIncludesPagesDir(t *testing.T) {
|
|
tempDir := t.TempDir()
|
|
dataDir := filepath.Join(tempDir, "data")
|
|
pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
|
|
releaseDir := filepath.Join(pagesRoot, "deployments", "1", "releases", "abc123")
|
|
if err := os.MkdirAll(releaseDir, 0o700); err != nil {
|
|
t.Fatalf("MkdirAll failed: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil {
|
|
t.Fatalf("WriteFile failed: %v", err)
|
|
}
|
|
|
|
manager := &Manager{PagesDir: pagesRoot}
|
|
if err := manager.EnsureWorkerReadAccess(); err != nil {
|
|
t.Fatalf("EnsureWorkerReadAccess failed: %v", err)
|
|
}
|
|
|
|
info, err := os.Stat(filepath.Join(tempDir, "data"))
|
|
if err != nil {
|
|
t.Fatalf("Stat data failed: %v", err)
|
|
}
|
|
if info.Mode().Perm()&0o005 == 0 {
|
|
t.Fatalf("expected data directory to be world-traversable, got %o", info.Mode().Perm())
|
|
}
|
|
indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html"))
|
|
if err != nil {
|
|
t.Fatalf("Stat index failed: %v", err)
|
|
}
|
|
if indexInfo.Mode().Perm() != nginxConfigFilePerm {
|
|
t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, indexInfo.Mode().Perm())
|
|
}
|
|
} |