Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
COMPONENTS: (1)bash sudo codes ported to python codes, (2)expectsudo.py
Explanation - This MR contains 2 components: (I) Ported python codes of the following sudo bash scripts: 1. defaults ported as test_defaults() :description: Add 2 sudo rules, first one with 'sudoOption: !authenticate' and second one without it. Change order of sudo rules and test sudo command with 2 users. 2. order ported as test_order() :description: Add 2 sudo rules, first one with 'sudoOption: !authenticate' and second one without it. Change order of sudo rules and test sudo command with 2 users. 3. offline ported as test_offline() :description: Add a sudo rule that authenticates user to perform sudo then go offline by adding a jump rule in iptables and testing user again to confirm that user is able to sudo with cached credentials then making change to sudoCommand:!ALL to check if user is denied and then constantly make calls to SSSD to come online and then verify it. 4. refresh ported as test_refresh() :description: Check sudo with sudo user and sudo group after OVERLAP_INTERVAL and SMART_INTERVAL with modifying values of sudoUser, sudoHost, sudoCommand, sudoRunAsUser, sudoRunAsGroup and sudoOption. 5. host_filter ported as test_host_filter() :description: Value of host_filter can be true or false, ldap_sudo_hostnames, ldap_sudo_ip, ldap_sudo_include_netgroups and ldap_sudo_include_regexp. 6. full_refresh ported as test_full_refresh() :description: Check sudo with a full refresh of sudo rules. 7. stress_refresh ported as test_stress_refresh() :description: Check sudo by stressing attribute refreshes and test rule-matching/non-rule-matching attributes. 8. attrs_command ported as test_attrs_command() :description: Check sudo by changing 'sudoCommand' with several attributes. 9. attrs ported as test_attrs() :description: Test sudo with empty attributes and attributes with value. --- BELOW TESTS CODES ARE FROM misc WHICH HAVE BEEN PORTED INDIVIDUALLY--- 10. test_bz996020() :description: sssd fails instead of skipping when a sudo ldap filter returns entries with multiple CN. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=996020 11. test_bz1003567() :description: large number of sudo rules results in error. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1003567 12. test_bz995737() :description: sudo backed by sssd ldap denies all access. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=995737 13. test_bz1042922() :description: Add fallback to sudoRunAs when sudoRunasUser is not defined. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1042922 14. test_bz1422183() :description: Duplicate usernames with difference of upper and lower case. bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1422183 15. test_bz1590603() :description: information leak from sssd sudo responder. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1590603 16. test_bz1607313() :description: private pipe ownership when sssd is running as non root user. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1607313 17. test_bz1132264() :description: allow sssd to retrieve sudo rules of local users whose sudo rules stored in ldap server. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1132264 18. test_bz1208507() :description: sysdb sudo search does not escape special characters. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1208507 19. test_bz1084532() :description: sssd sudo process segfaults. :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1084532 (II) expectsudo.py code for automating insertion of sudo password. - This utility is built using pexpect library: https://pexpect.readthedocs.io/en/stable/api/pexpect.html - Intended to automatate insertion of sudo passwords during test case execution. - It uses regexes to search for a particular line/set of lines for asserting whether: (1) sudo permissed is granted -> sudo_permission_granted() (2) sudo permission is denied -> sudo_permission_denied() (3) if sudo password is incorrect -> sudo_incorrect_password() (4) if sudo authentication is required -> sudo_requires_auth()
- Loading branch information