4ce97555e4
The script was correctly opening the `truth` file by piping `echo` to it, but then it tried to deny another operation on it. But since pipes are opened by the script process, the permission was given to the script. And since the permissions are preserved for the entire runtime of a process, and child processes inherit permissions of their parents, any command executed later would also have the necessary permissions to open `truth` (which was the case for the second operation). Now the second operation is performed on a different file.
98 lines
3.5 KiB
Bash
Executable File
98 lines
3.5 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# clean what was left from previous tests
|
|
|
|
rm -rf ./protected
|
|
mkdir protected
|
|
touch ./protected/do-not-remove ./protected/should-be-removed ./protected/truth ./protected/perm000 ./protected/perm777 ./protected/should-be-renamed ./protected/do-not-rename
|
|
chmod 777 ./protected/perm777 ./protected/perm000
|
|
echo "Free code, free world." >./protected/motto
|
|
|
|
# set up the fake-zenity
|
|
|
|
PATH="$(realpath ./mock/):$PATH"
|
|
|
|
# mount the filesystem
|
|
|
|
echo "Run $(date -u +%Y-%m-%dT%H:%M:%S) "
|
|
valgrind -s ../build/icfs -o default_permissions ./protected &
|
|
|
|
sleep 1
|
|
|
|
# create files
|
|
|
|
zenity --set-fake-response no
|
|
touch ./protected/should-not-exist 2>/dev/null &&
|
|
echo "[ICFS-TEST]: touch can create protected/should-not-exist despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
|
|
zenity --set-fake-response yes_tmp
|
|
touch ./protected/should-exist 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: touch cannot create protected/should-exist despite access being permitted!" # OK
|
|
|
|
# write to files
|
|
|
|
zenity --set-fake-response no
|
|
echo "Linux is a cancer that attaches itself in an intellectual property sense to everything it touches." >./protected/truth 2>/dev/null &&
|
|
echo "[ICFS-TEST]: echo can write to protected/lie despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
|
|
zenity --set-fake-response yes_tmp
|
|
echo "Sharing knowledge is the most fundamental act of friendship. Because it is a way you can give something without loosing something." >./protected/truth 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: echo cannot write to protected/truth despite access being permitted!" # OK
|
|
|
|
# Read files
|
|
|
|
zenity --set-fake-response no
|
|
cat ./protected/motto >/dev/null 2>/dev/null &&
|
|
echo "[ICFS-TEST]: cat can read protected/this-only despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
|
|
zenity --set-fake-response yes_tmp
|
|
cat ./protected/motto >/dev/null 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: echo cannot create protected/this-only despite access being permitted!" # "Free code, free world."
|
|
|
|
# remove files
|
|
|
|
zenity --set-fake-response no
|
|
rm ./protected/do-not-remove >/dev/null 2>/dev/null &&
|
|
echo "[ICFS-TEST]: rm can unlink protected/do-not-remove despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
|
|
zenity --set-fake-response yes_tmp
|
|
rm ./protected/should-be-removed >/dev/null 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: rm cannot unlink protected/should-be-removed despite access being permitted!" # OK
|
|
|
|
# rename files
|
|
|
|
zenity --set-fake-response no
|
|
mv ./protected/do-not-rename ./protected/terrible-name 2>/dev/null &&
|
|
echo "[ICFS-TEST]: mv can rename protected/truth despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
zenity --set-fake-response yes_tmp
|
|
mv ./protected/should-be-renamed ./protected/great-name 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: mv cannot rename should-be-removed to renamed-file despite access being permitted!" # OK
|
|
|
|
# change permissions
|
|
|
|
zenity --set-fake-response no
|
|
chmod 000 ./protected/perm777 2>/dev/null &&
|
|
echo "[ICFS-TEST]: chmod can change permissions of protected/perm777 despite access being denied!" ||
|
|
echo "[ICFS-TEST]: OK" # EACCESS
|
|
zenity --set-fake-response yes_tmp
|
|
chmod 000 ./protected/perm000 2>/dev/null &&
|
|
echo "[ICFS-TEST]: OK" ||
|
|
echo "[ICFS-TEST]: chmod cannot change permissions of protected/perm000 despite access being permitted!" # OK
|
|
|
|
# unmount
|
|
|
|
sleep 0.5
|
|
#lsof +f -- $(realpath ./protected)
|
|
umount $(realpath ./protected)
|
|
sleep 0.5
|