Only run system tests as root in developer mode

Running system tests with root privileges is potentially dangerous.
Only allow it when explicitly requested (by building with
--enable-developer).

diff --git a/bin/tests/system/run.sh.in b/bin/tests/system/run.sh.in
index cff35deaaa5a2b655e5db7d6575ce3c0f2552310..1a04a9ae0d3281db94a168dd3edb4cb158491bb2 100644 (file)
--- a/bin/tests/system/run.sh.in
+++ b/bin/tests/system/run.sh.in
@@ -20,6 +20,11 @@ srcdir=@abs_srcdir@
 # shellcheck source=conf.sh
 . ${builddir}/conf.sh
 
+if [ "$(id -u)" -eq "0" ] && [ "@DEVELOPER_MODE@" != "yes" ]; then
+       echofail "Refusing to run test as root. Build with --enable-developer to override." >&2
+       exit 1
+fi
+
 SYSTEMTESTTOP="$(cd -P -- "${builddir}" && pwd -P)"
 if [ "$CYGWIN" ]; then
        SYSTEMTESTTOP="$(cygpath -m "${SYSTEMTESTTOP}")"

diff --git a/configure.ac b/configure.ac
index a32fb68f188636f507a866aff2995881e5c4b26f..89b27b3119a52a2690d592dcc7140401bf47c2f1 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -159,7 +159,8 @@ AC_ARG_ENABLE([developer],
                              [enable developer build settings])])
 
 AS_IF([test "$enable_developer" = "yes"],
-      [STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
+      [DEVELOPER_MODE=yes
+       STD_CPPFLAGS="$STD_CPPFLAGS -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1"
        test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
        test "${enable_querytrace+set}" = set || enable_querytrace=yes
        test "${with_cmocka+set}" = set || with_cmocka=yes
@@ -168,6 +169,7 @@ AS_IF([test "$enable_developer" = "yes"],
        test "${enable_warn_error+set}" = set || enable_warn_error=yes
        ])
 
+AC_SUBST([DEVELOPER_MODE])
 AC_SUBST([STD_CFLAGS])
 AC_SUBST([STD_CPPFLAGS])
 

diff --git a/win32utils/Configure b/win32utils/Configure
index 4567fb39b7a329b8b4de7e6ba8252fc659361c18..63842294fb0da2561dbc058dcf24504ace0b041b 100644 (file)
--- a/win32utils/Configure
+++ b/win32utils/Configure
@@ -211,6 +211,7 @@ my @substdefp = ();
 my %configtest;
 
 my @substtest = ("CRYPTO",
+                 "DEVELOPER_MODE",
                  "DNSTAP",
                  "FSTRM_CAPTURE",
                  "JSONSTATS",
@@ -722,6 +723,7 @@ sub myenable {
 # enable-developer expansion now
 
 if ($enable_developer eq "yes") {
+    $configtest{"DEVELOPER_MODE"} = "yes";
     $configdefh{"ISC_LIST_CHECKINIT"} = 1;
     $enable_querytrace = "yes";
     # no atf on WIN32