# from sources using libcfgrpt.a
$ strings src/lib/process/cfgrpt/.libs/libcfgrpt.a | sed -n 's/;;;; //p'
+- ``-X`` - As of Kea 3.0, disables path and permissions restrictions.
+ The server will emit a warning at startup that sercurity restrctions
+ have been disabled. Do not use this mode of operation without careful
+ consideration and takng any necessary precautions. Falure to do so can
+ expose deployments to security vulnerabilities. For more information
+ please read section :ref:`securing-a-kea-deployment`.
+
The CA is started by running its binary and specifying the configuration
file it should use. For example:
flag is convenient for temporarily switching the server into maximum
verbosity, e.g. when debugging.
-- ``-v`` - displays the Kea version and exits.
-
-- ``-V`` - displays the extended Kea version and exits.
-
-- ``-W`` - displays the Kea configuration report and exits. The report
- is a copy of the ``config.report`` file produced by ``meson setup``;
- it is embedded in the executable binary.
-
- ``-t file`` - specifies the configuration file to be tested.
:iscman:`kea-dhcp-ddns` attempts to load it and conducts sanity checks.
Certain checks are possible only while running the actual
messages to standard output and errors to standard error when testing
the configuration.
+- ``-v`` - displays the Kea version and exits.
+
+- ``-V`` - displays the extended Kea version and exits.
+
+- ``-W`` - displays the Kea configuration report and exits. The report
+ is a copy of the ``config.report`` file produced by ``meson setup``;
+ it is embedded in the executable binary.
+
The contents of the ``config.report`` file may also be accessed by examining
certain libraries in the installation tree or in the source tree.
# from sources using libcfgrpt.a
$ strings src/lib/process/cfgrpt/.libs/libcfgrpt.a | sed -n 's/;;;; //p'
+- ``-X`` - As of Kea 3.0, disables path and permissions restrictions.
+ The server will emit a warning at startup that sercurity restrctions
+ have been disabled. Do not use this mode of operation without careful
+ consideration and takng any necessary precautions. Falure to do so can
+ expose deployments to security vulnerabilities. For more information
+ please read section :ref:`securing-a-kea-deployment`.
+
Upon startup, the module loads its configuration and begins listening
for NCRs based on that configuration.
# from sources using libcfgrpt.a
$ strings src/lib/process/cfgrpt/.libs/libcfgrpt.a | sed -n 's/;;;; //p'
+- ``-X`` - As of Kea 3.0, disables path and permissions restrictions.
+ The server will emit a warning at startup that sercurity restrctions
+ have been disabled. Do not use this mode of operation without careful
+ consideration and takng any necessary precautions. Falure to do so can
+ expose deployments to security vulnerabilities. For more information
+ please read section :ref:`securing-a-kea-deployment`.
+
On startup, the server detects available network interfaces and
attempts to open UDP sockets on all interfaces listed in the
configuration file. Since the DHCPv4 server opens privileged ports, it
# from sources using libcfgrpt.a
$ strings src/lib/process/cfgrpt/.libs/libcfgrpt.a | sed -n 's/;;;; //p'
+- ``-X`` - As of Kea 3.0, disables path and permissions restrictions.
+ The server will emit a warning at startup that sercurity restrctions
+ have been disabled. Do not use this mode of operation without careful
+ consideration and takng any necessary precautions. Falure to do so can
+ expose deployments to security vulnerabilities. For more information
+ please read section :ref:`securing-a-kea-deployment`.
+
On startup, the server detects available network interfaces and
attempts to open UDP sockets on all interfaces listed in the
configuration file. Since the DHCPv6 server opens privileged ports, it
The :iscman:`kea-shell` tool also supports TLS.
+.. _securing-a-kea-deployment:
+
Securing a Kea Deployment
=========================
| Unix Sockets | ``var/run/kea`` | ``KEA_CONTROL_SOCKET_DIR`` |
+-------------------------------------+---------------------------------------+-------------------------------+
+.. note:
+ As of Kea 3.0, the path and permissions restrictions may be disabled by adding ``-X``
+ to command line of the Kea servers. The server will emit a warning at startup that
+ sercurity restrctions have been disabled. Do not use this mode of operation without
+ careful consideration and takng any necessary precautions. Falure to do so may expose
+ deployments to security vulnerabilities. This command line option is supported by
+ all of the daemons: ``kea-dhcp4``, ``kea-dhcp6``, ``kea-dhcp-ddns``, and
+ ``kea-ctrl-agent``.
Cryptography Components
-----------------------
This informational message indicates that the Control Agent has
processed all configuration information and is ready to begin processing.
The version is also printed.
+
+% CTRL_AGENT_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
+This warning is emitted when internal security checks normally
+performed by kea-ctrl-agent have been disabled via command line opion '-X'.
+This means the server is not enforcing restrictions on resource
+paths or permissions. This mode of operation may expose your
+environment to ecurity vulnerabilities and should only be used
+after consideration.
#include <asiolink/io_error.h>
#include <cc/command_interpreter.h>
#include <config/timeouts.h>
+#include <util/filesystem.h>
#include <boost/pointer_cast.hpp>
using namespace isc::asiolink;
using namespace isc::data;
using namespace isc::http;
using namespace isc::process;
-
+using namespace isc::util::file;
namespace isc {
namespace agent {
CtrlAgentProcess::run() {
LOG_INFO(agent_logger, CTRL_AGENT_STARTED).arg(VERSION);
+ if (!PathChecker::shouldEnforceSecurity()) {
+ LOG_WARN(agent_logger, CTRL_AGENT_SECURITY_CHECKS_DISABLED);
+ }
+
try {
// Register commands.
CtrlAgentControllerPtr controller =
#include <d2srv/d2_tsig_key.h>
#include <hooks/hooks.h>
#include <hooks/hooks_manager.h>
+#include <util/filesystem.h>
using namespace isc::asiolink;
using namespace isc::config;
using namespace isc::data;
using namespace isc::hooks;
using namespace isc::process;
+using namespace isc::util::file;
namespace {
void
D2Process::run() {
LOG_INFO(d2_logger, DHCP_DDNS_STARTED).arg(VERSION);
+
+ if (!PathChecker::shouldEnforceSecurity()) {
+ LOG_WARN(d2_logger, DHCP_DDNS_SECURITY_CHECKS_DISABLED);
+ }
+
D2ControllerPtr controller =
boost::dynamic_pointer_cast<D2Controller>(D2Controller::instance());
try {
An DHCPOFFER for the 0.0.0.0 address was generated for a client requesting
the v6-only-preferred (108) option but the option is not in the response as
expected: the erroneous response is dropped, the discover query is displayed.
+
+% DHCP4_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
+This warning is emitted when internal security checks normally
+performed by kea-dhcp4 have been disabled via command line opion '-X'.
+This means the server is not enforcing restrictions on resource
+paths or permissions. This mode of operation may expose your
+environment to security vulnerabilities and should only be used
+after careful consideration.
using namespace isc::data;
using namespace isc::dhcp;
using namespace isc::process;
+using namespace isc::util::file;
using namespace std;
/// This file contains entry point (main() function) for standard DHCPv4 server
<< endl;
cerr << endl;
cerr << "Usage: " << DHCP4_NAME
- << " -[v|V|W] [-d] [-{c|t|T} cfgfile] [-p number] [-P number]" << endl;
+ << " -[v|V|W|X] [-d] [-{c|t|T} cfgfile] [-p number] [-P number]" << endl;
cerr << " -v: print version number and exit" << endl;
cerr << " -V: print extended version and exit" << endl;
cerr << " -W: display the configuration report and exit" << endl;
<< "(useful for testing only)" << endl;
cerr << " -P number: specify non-standard client port number 1-65535 "
<< "(useful for testing only)" << endl;
+ cerr << " -X: disables security restrictions" << endl;
exit(EXIT_FAILURE);
}
} // namespace
// This is the DHCPv4 server
CfgMgr::instance().setFamily(AF_INET);
- while ((ch = getopt(argc, argv, "dvVWc:p:P:t:T:")) != -1) {
+ while ((ch = getopt(argc, argv, "dvVWc:p:P:t:T:X")) != -1) {
switch (ch) {
case 'd':
verbose_mode = true;
}
break;
+ case 'X': // relax security checks
+ PathChecker::enableEnforcement(false);
+ break;
+
default:
usage();
}
LOG_WARN(dhcp4_logger, DHCP4_DEVELOPMENT_VERSION);
}
+ if (!PathChecker::shouldEnforceSecurity()) {
+ LOG_WARN(dhcp4_logger, DHCP4_SECURITY_CHECKS_DISABLED);
+ }
+
// Create the server instance.
ControlledDhcpv4Srv server(server_port_number, client_port_number);
use it to extend their leases. As a result, they will have to go through
a rebinding phase to re-acquire their leases and associate them with a
new server id.
+
+% DHCP6_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
+This warning is emitted when internal security checks normally
+performed by kea-dhcp6 have been disabled via command line opion '-X'.
+This means the server is not enforcing restrictions on resource
+paths or permissions. This mode of operation may expose your
+environment to security vulnerabilities and should only be used
+after careful consideration.
using namespace isc::data;
using namespace isc::dhcp;
using namespace isc::process;
+using namespace isc::util::file;
using namespace std;
/// This file contains entry point (main() function) for standard DHCPv6 server
<< endl;
cerr << endl;
cerr << "Usage: " << DHCP6_NAME
- << " -[v|V|W] [-d] [-{c|t|T} cfgfile] [-p number] [-P number]" << endl;
+ << " -[v|V|W|X] [-d] [-{c|t|T} cfgfile] [-p number] [-P number]" << endl;
cerr << " -v: print version number and exit" << endl;
cerr << " -V: print extended version and exit" << endl;
cerr << " -W: display the configuration report and exit" << endl;
<< "(useful for testing only)" << endl;
cerr << " -P number: specify non-standard client port number 1-65535 "
<< "(useful for testing only)" << endl;
+ cerr << " -X: disables security restrictions" << endl;
exit(EXIT_FAILURE);
}
} // namespace
// This is the DHCPv6 server
CfgMgr::instance().setFamily(AF_INET6);
- while ((ch = getopt(argc, argv, "dvVWc:p:P:t:T:")) != -1) {
+ while ((ch = getopt(argc, argv, "dvVWc:p:P:t:T:X")) != -1) {
switch (ch) {
case 'd':
verbose_mode = true;
}
break;
+ case 'X': // relax security checks
+ PathChecker::enableEnforcement(false);
+ break;
+
default:
usage();
}
LOG_WARN(dhcp6_logger, DHCP6_DEVELOPMENT_VERSION);
}
+ if (!PathChecker::shouldEnforceSecurity()) {
+ LOG_WARN(dhcp6_logger, DHCP6_SECURITY_CHECKS_DISABLED);
+ }
+
// Create the server instance.
ControlledDhcpv6Srv server(server_port_number, client_port_number);
}
std::string
-UnixCommandConfig::validatePath(const std::string socket_path,
- bool enforce /* = true */) {
+UnixCommandConfig::validatePath(const std::string socket_path) {
if (!socket_path_checker_) {
getSocketPath();
}
- auto valid_path = socket_path_checker_->validatePath(socket_path, enforce);
- if (enforce && !(socket_path_checker_->pathHasPermissions(socket_path_perms_))) {
+ auto valid_path = socket_path_checker_->validatePath(socket_path);
+ if (!socket_path_checker_->pathHasPermissions(socket_path_perms_)) {
isc_throw (DhcpConfigError,
"socket path:" << socket_path_checker_->getPath()
<< " does not exist or does not have permssions = "
#include <asiolink/unix_domain_socket_acceptor.h>
#include <cc/cfg_to_element.h>
#include <cc/user_context.h>
+#include <util/filesystem.h>
namespace isc {
namespace config {
/// sockets.
///
/// @param socket_path path to validate.
- /// @param enforce enables validation against the supported path and
- /// permissions.
- /// If false simply returns the input path.
///
/// @return validated path
- static std::string validatePath(const std::string socket_path,
- bool enforce = true);
+ static std::string validatePath(const std::string socket_path);
/// @brief Fetches the required socket path permissions mask
///
Logged at debug log level 50.
This is a debug message issued when DHCP_DDNS receives sends a DNS update
response from a DNS server.
+
+% DHCP_DDNS_SECURITY_CHECKS_DISABLED Invoked with command line option -X, Security checks are disabled!!
+This warning is emitted when internal security checks normally
+performed by kea-dhcp-ddns have been disabled via command line opion '-X'.
+This means the server is not enforcing restrictions on resource
+paths or permissions. This mode of operation may expose your
+environment to ecurity vulnerabilities and should only be used
+after consideration.
}
std::string
-CfgMgr::validatePath(const std::string data_path, bool enforce_path /* = true */) const {
- return (data_dir_checker_->validatePath(data_path, enforce_path));
+CfgMgr::validatePath(const std::string data_path) const {
+ return (data_dir_checker_->validatePath(data_path));
}
void
/// @brief Validates a file path against the supported directory for DHDP data.
///
/// @param data_path data path to validate.
- /// @param enforce_path enables validation against the supported path.
- /// If false verifies only that the path contains a file name.
///
/// @return validated path
- std::string validatePath(const std::string data_path,
- bool enforce_path = true) const;
+ std::string validatePath(const std::string data_path) const;
/// @brief Updates the DHCP-DDNS client configuration to the given value.
///
}
std::string
-LegalLogMgr::validatePath(const std::string logpath,
- bool enforce_path /* = true */) {
+LegalLogMgr::validatePath(const std::string logpath) {
if (!legal_log_path_checker_) {
getLogPath();
}
- return (legal_log_path_checker_->validateDirectory(logpath, enforce_path));
+ return (legal_log_path_checker_->validateDirectory(logpath));
}
} // namespace dhcp
/// log files.
///
/// @param logpath path to validate.
- /// @param enforce_path enables validation against the supported path.
- /// If false simply returns the input path.
///
/// @return validated path
- static std::string validatePath(const std::string logpath,
- bool enforce_path = true);
+ static std::string validatePath(const std::string logpath);
/// @brief Parse database specification.
///
}
std::string
-HooksLibrariesParser::validatePath(const std::string libpath,
- bool enforce_path /* = true */) {
+HooksLibrariesParser::validatePath(const std::string libpath) {
if (!hooks_path_checker_) {
getHooksPath();
}
- return (hooks_path_checker_->validatePath(libpath, enforce_path));
+ return (hooks_path_checker_->validatePath(libpath));
}
// @todo use the flat style, split into list and item
/// @brief Validates a library path against the supported path for hooks libraries.
///
/// @param libpath library path to validate.
- /// @param enforce_path enables validation against the supported path.
- /// If false verifies only that the path contains a file name.
///
/// @return validated path
- static std::string validatePath(const std::string libpath,
- bool enforce_path = true);
+ static std::string validatePath(const std::string libpath);
/// @brief Fetches the supported Hooks path.
///
#include <hooks/hooks_manager.h>
#include <hooks/hooks_parser.h>
#include <hooks/server_hooks.h>
+#include <util/filesystem.h>
#include <testutils/gtest_utils.h>
#include <hooks/tests/common_test_class.h>
using namespace isc;
using namespace isc::hooks;
using namespace isc::data;
+using namespace isc::util::file;
using namespace std;
namespace {
}
};
+ PathChecker::enableEnforcement(false);
for (auto scenario : scenarios) {
std::ostringstream oss;
oss << " Scenario at line: " << scenario.line_;
std::string validated_path;
if (scenario.exp_error_.empty()) {
ASSERT_NO_THROW_LOG(validated_path =
- HooksLibrariesParser::validatePath(scenario.lib_path_, false));
+ HooksLibrariesParser::validatePath(scenario.lib_path_));
EXPECT_EQ(validated_path, scenario.exp_path_);
} else {
ASSERT_THROW_MSG(validated_path =
- HooksLibrariesParser::validatePath(scenario.lib_path_, false),
+ HooksLibrariesParser::validatePath(scenario.lib_path_),
BadValue, scenario.exp_error_);
}
}
#include <log/logger.h>
#include <log/logger_support.h>
#include <util/encode/encode.h>
+#include <util/filesystem.h>
#include <process/daemon.h>
#include <process/d_log.h>
#include <process/d_controller.h>
optarg = 0;
opterr = 0;
optind = 1;
- std::string opts("dvVWc:t:" + getCustomOpts());
+ std::string opts("dvVWc:t:X" + getCustomOpts());
// Defer exhausting of arguments to the end.
ExhaustOptions e(argc, argv, opts);
}
break;
+ case 'X': // relax security checks
+ file::PathChecker::enableEnforcement(false);
+ break;
+
case '?': {
char const saved_optopt(optopt);
std::string const saved_optarg(optarg ? optarg : std::string());
<< " -c <config file name> : mandatory,"
<< " specify name of configuration file" << std::endl
<< " -t <config file name> : check the"
- << " configuration file and exit" << std::endl;
+ << " configuration file and exit" << std::endl
+ << " -X: disables security restrictions" << std::endl;
// add any derivation specific usage
std::cerr << getUsageText() << std::endl;
}
std::string
-LogConfigParser::validatePath(const std::string logpath,
- bool enforce_path /* = true */) {
+LogConfigParser::validatePath(const std::string logpath) {
if (!log_path_checker_) {
getLogPath();
}
- return (log_path_checker_->validatePath(logpath, enforce_path));
+ return (log_path_checker_->validatePath(logpath));
}
void LogConfigParser::parseOutputOptions(std::vector<LoggingDestination>& destination,
/// @brief Validates a library path against the supported path for log files.
///
/// @param logpath path to validate.
- /// @param enforce_path enables validation against the supported path.
- /// If false verifies only that the path contains a file name.
///
/// @return validated path
- static std::string validatePath(const std::string logpath, bool enforce_path = true);
+ static std::string validatePath(const std::string logpath);
private:
namespace util {
namespace file {
+
string
getContent(string const& file_name) {
if (!exists(file_name)) {
PathChecker::PathChecker(const std::string default_path,
const std::string env_name /* = "" */)
- : default_path_(default_path), env_name_(env_name) {
+ : default_path_(default_path), env_name_(env_name),
+ default_overridden_(false) {
getPath(true);
}
while (!path_.empty() && path_.back() == '/') {
path_.pop_back();
}
+
+ default_overridden_ = (path_ != default_path_);
}
return (path_);
std::string
PathChecker::validatePath(const std::string input_path_str,
- bool enforce_path /* = true */) const {
+ bool enforce_path /* = PathChecker::shouldEnforceSecurity() */) const {
Path input_path(trim(input_path_str));
auto filename = input_path.filename();
if (filename.empty()) {
return (input_path_str);
}
-
// We only allow absolute path equal to default. Catch an invalid path.
if (parent_path != path_) {
isc_throw(BadValue, "invalid path specified: '"
std::string
PathChecker::validateDirectory(const std::string input_path_str,
- bool enforce_path /* = true */) const {
+ bool enforce_path /* = PathChecker::shouldEnforceSecurity() */) const {
std::string input_copy = trim(input_path_str);
if (!enforce_path) {
return(input_copy);
}
bool
-PathChecker::pathHasPermissions(mode_t permissions) {
- return(hasPermissions(path_, permissions));
+PathChecker::pathHasPermissions(mode_t permissions, bool enforce_perms
+ /* = PathChecker::shouldEnforceSecurity() */) const {
+ return((!enforce_perms) || hasPermissions(path_, permissions));
+}
+
+bool
+PathChecker::isDefaultOverridden() {
+ return (default_overridden_);
}
+bool PathChecker::shouldEnforceSecurity() {
+ return (enforce_security_);
+}
+
+void PathChecker::enableEnforcement(bool enable) {
+ enforce_security_ = enable;
+}
+
+bool PathChecker::enforce_security_ = true;
+
} // namespace file
} // namespace util
} // namespace isc
/// @throw BadValue if the input path does not include a file name or if the
/// it the parent path does not path the supported path.
std::string validatePath(const std::string input_path_str,
- bool enforce_path = true) const;
+ bool enforce_path = shouldEnforceSecurity()) const;
/// @brief Validates a directory against a supported path.
///
/// @throw BadValue if the input directory does not match the supported
/// path.
std::string validateDirectory(const std::string input_path_str,
- bool enforce_path = true) const;
+ bool enforce_path = shouldEnforceSecurity()) const;
- /// @brief Tests that the supported path has the given permissions.
+ /// @param enforce_perms Enables permsissions check. If false the function
+ /// simply returns true.
///
- /// @param permissions mode_t mask of required permissions.
- /// @return True if the path's permissions exactly match the permissions
- /// parameter.
- bool pathHasPermissions(mode_t permissions);
+ /// @return True if the path points to a file or a directory, false otherwise.
+ bool pathHasPermissions(mode_t permissions,
+ bool enforce_perms = shouldEnforceSecurity()) const;
/// @brief Fetches the default path.
std::string getDefaultPath() const {
return (env_name_);
}
+ /// @brief Indicates if the default path has been overridden.
+ bool isDefaultOverridden();
+
+ /// @brief Indicates security checks should be enforced.
+ static bool shouldEnforceSecurity();
+
+ /// @brief Enables or disables security enforcment checks.
+ ///
+ /// @param enable true to enable security checks, false to disable.
+ static void enableEnforcement(bool enable);
+
private:
/// @brief Default supported path.
std::string default_path_;
/// @brief The supported path currently in effect.
std::string path_;
+
+ /// @brief Tracks if default has been overridden.
+ bool default_overridden_;
+
+ /// @brief True if security checks should be enforced, false if not.
+ static bool enforce_security_;
};
/// @brief Defines a pointer to a PathChecker.
// Clear the environment path.
unsetenv(env_name_.c_str());
+ PathChecker::enableEnforcement(true);
}
/// @brief Destructor
} else {
unsetenv(env_name_.c_str());
}
+
+ PathChecker::enableEnforcement(true);
}
/// @brief Name of env variable for overriding default path.
}
// Verifies PathChecker::validatePath() when enforce_path is true.
-TEST(PathChecker, validatePathEnforcePath) {
+TEST_F(PathCheckerTest, validatePathEnforcePath) {
std::string def_path(TEST_DATA_BUILDDIR);
struct Scenario {
int line_;
}
// Verifies PathChecker::validatePath() when enforce_path is false.
-TEST(PathChecker, validatePathEnforcePathFalse) {
+TEST_F(PathCheckerTest, validatePathEnforcePathFalse) {
std::string def_path(TEST_DATA_BUILDDIR);
struct Scenario {
int line_;
}
};
+ ASSERT_TRUE(PathChecker::shouldEnforceSecurity());
+ PathChecker::enableEnforcement(false);
+ ASSERT_FALSE(PathChecker::shouldEnforceSecurity());
+
// Create a PathChecker with a supported path of def_path.
PathChecker checker(def_path);
for (auto scenario : scenarios) {
std::string validated_path;
if (scenario.exp_error_.empty()) {
ASSERT_NO_THROW_LOG(validated_path =
- checker.validatePath(scenario.lib_path_, false));
+ checker.validatePath(scenario.lib_path_));
EXPECT_EQ(validated_path, scenario.exp_path_);
} else {
ASSERT_THROW_MSG(validated_path =
- checker.validatePath(scenario.lib_path_, false),
+ checker.validatePath(scenario.lib_path_),
BadValue, scenario.exp_error_);
}
}
}
// Verifies PathChecker::validateDirectory() when enforce_path is true.
-TEST(PathChecker, validateDirectoryEnforcePath) {
+TEST_F(PathCheckerTest, validateDirectoryEnforcePath) {
std::string def_path(TEST_DATA_BUILDDIR);
struct Scenario {
int line_;
}
// Verifies PathChecker::validateDirectory() when enforce_path is false.
-TEST(PathChecker, validateDirectoryEnforcePathFalse) {
+TEST_F(PathCheckerTest, validateDirectoryEnforcePathFalse) {
std::string def_path(TEST_DATA_BUILDDIR);
struct Scenario {
int line_;
}
};
+ ASSERT_TRUE(PathChecker::shouldEnforceSecurity());
+ PathChecker::enableEnforcement(false);
+ ASSERT_FALSE(PathChecker::shouldEnforceSecurity());
+
// Create a PathChecker with a supported path of def_path.
PathChecker checker(def_path);
for (auto scenario : scenarios) {
std::string validated_path;
if (scenario.exp_error_.empty()) {
ASSERT_NO_THROW_LOG(validated_path =
- checker.validateDirectory(scenario.lib_path_, false));
+ checker.validateDirectory(scenario.lib_path_));
EXPECT_EQ(validated_path, scenario.exp_path_);
} else {
ASSERT_THROW_MSG(validated_path =
- checker.validateDirectory(scenario.lib_path_, false),
+ checker.validateDirectory(scenario.lib_path_),
BadValue, scenario.exp_error_);
}
}
}
+/// @brief Check pathHasPermissions.
+TEST_F(PathCheckerTest, pathHasPermissions) {
+ PathChecker checker(TEST_DATA_BUILDDIR);
+
+ ASSERT_TRUE(PathChecker::shouldEnforceSecurity());
+ mode_t current_permissions = getPermissions(TEST_DATA_BUILDDIR);
+ EXPECT_TRUE(checker.pathHasPermissions(current_permissions));
+
+ current_permissions = ~current_permissions;
+ EXPECT_FALSE(checker.pathHasPermissions(current_permissions));
+
+ PathChecker::enableEnforcement(false);
+ ASSERT_FALSE(PathChecker::shouldEnforceSecurity());
+ EXPECT_TRUE(checker.pathHasPermissions(current_permissions));
+}
+
} // namespace
projects / thirdparty / kea.git / commitdiff
