cmd/hakurei/testsuite: compare command output

This is much more precise than just simply checking the exit code.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 72 insertions, 18 deletions

diff --git a/cmd/hakurei/testsuite/sandbox/main.go b/cmd/hakurei/testsuite/sandbox/main.go
index 11c87857..bd36d1b8 100644
--- a/cmd/hakurei/testsuite/sandbox/main.go
+++ b/cmd/hakurei/testsuite/sandbox/main.go
@@ -188,28 +188,82 @@ func main() {
 	var wg sync.WaitGroup
 	defer wg.Wait()
 
-	testsuite.MustRun(
-		&cred, nil,
-		"hakurei", "exec", "capsh", "--print",
-	)
 	wg.Go(func() {
 		defer log.Println("validated capabilities/securebits in user namespace")
 
-		testsuite.MustRun(
-			&cred, nil,
+		testsuite.AssertOutput(
+			"validating prevailing capability and related state",
+			"Current: =\n"+
+				"Bounding set =\n"+
+				"Ambient set =\n"+
+				"Current IAB: !cap_chown,!cap_dac_override,"+
+				"!cap_dac_read_search,!cap_fowner,!cap_fsetid,!cap_kill,"+
+				"!cap_setgid,!cap_setuid,!cap_setpcap,!cap_linux_immutable,"+
+				"!cap_net_bind_service,!cap_net_broadcast,!cap_net_admin,"+
+				"!cap_net_raw,!cap_ipc_lock,!cap_ipc_owner,!cap_sys_module,"+
+				"!cap_sys_rawio,!cap_sys_chroot,!cap_sys_ptrace,"+
+				"!cap_sys_pacct,!cap_sys_admin,!cap_sys_boot,!cap_sys_nice,"+
+				"!cap_sys_resource,!cap_sys_time,!cap_sys_tty_config,"+
+				"!cap_mknod,!cap_lease,!cap_audit_write,!cap_audit_control,"+
+				"!cap_setfcap,!cap_mac_override,!cap_mac_admin,!cap_syslog,"+
+				"!cap_wake_alarm,!cap_block_suspend,!cap_audit_read,"+
+				"!cap_perfmon,!cap_bpf,!cap_checkpoint_restore\n"+
+				"Securebits: 00/0x0/1'b0 (no-new-privs=1)\n"+
+				" secure-noroot: no (unlocked)\n"+
+				" secure-no-suid-fixup: no (unlocked)\n"+
+				" secure-keep-caps: no (unlocked)\n"+
+				" secure-no-ambient-raise: no (unlocked)\n"+
+				"uid=65534(chronos) euid=65534(chronos)\n"+
+				"gid=65534(hakurei)\n"+
+				"groups=65534(hakurei)\n"+
+				"Guessed mode: HYBRID (4)\n", "",
+		)(testsuite.MustOutput(
+			ctx, &cred, nil, 0, "capsh",
+			"hakurei", "exec", "capsh", "--print",
+		))
+
+		testsuite.AssertOutput(
+			"validating host no-new-privs",
+			"", "no-new-privs not set\n",
+		)(testsuite.MustOutput(
+			ctx, &cred, nil, 1, "host no-new-privs",
+			"capsh", "--has-no-new-privs",
+		))
+
+		testsuite.AssertOutput(
+			"validating no-new-privs",
+			"", "",
+		)(testsuite.MustOutput(
+			ctx, &cred, nil, 0, "no-new-privs",
 			"hakurei", "exec", "capsh", "--has-no-new-privs",
-		)
+		))
 
-		for _, p := range []byte{'a', 'b', 'i', 'p'} {
-			testsuite.MustFail(
-				&cred, nil, false,
-				"hakurei", "exec", "capsh", "--has-"+string(p)+"=CAP_SYS_ADMIN",
-			)
+		for _, p := range [][2]string{
+			{"ambient", "in ambient vector"},
+			{"bounding", "in bounding vector"},
+			{"inheritable"},
+			{"permitted"},
+		} {
+			if p[1] == "" {
+				p[1] = p[0]
+			}
+			testsuite.AssertOutput(
+				"checking CAP_SYS_ADMIN not "+p[1],
+				"", "cap[CAP_SYS_ADMIN] not "+p[1]+"\n",
+			)(testsuite.MustOutput(
+				ctx, &cred, nil, 1, p[0],
+				"hakurei", "exec",
+				"capsh", "--has-"+p[0][:1]+"=CAP_SYS_ADMIN",
+			))
 		}
-		testsuite.MustFail(
-			&cred, nil, false,
-			"hakurei", "exec", "umount", "-R", "/dev",
-		)
+
+		testsuite.AssertOutput(
+			"attempting unmount",
+			"", "umount: /tmp: must be superuser to unmount.\n",
+		)(testsuite.MustOutput(
+			ctx, &cred, nil, 32, "attempt unmount",
+			"hakurei", "exec", "umount", "/tmp",
+		))
 	})
 
 	wg.Go(func() {
@@ -289,9 +343,9 @@ func main() {
 			_, pid := testsuite.MustStartHakurei(
 				ctx, &wg, &cred, dbusEnv,
 				func(err error, output string) {
-					log.Printf("completed test case %s\n%s", name, output)
+					log.Printf("completed test case %s", name)
 					if err != nil {
-						log.Fatalf("test case %s: %v", name, err)
+						log.Fatalf("test case %s: %v\n%s", name, err, output)
 					}
 				}, true, true, false, false, &tc.Hakurei,
 			)