diff options
| author | Ophestra <cat@gensokyo.uk> | 2026-10-18 18:31:30 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2026-10-18 18:31:30 +0900 |
| commit | f92b4673a19272d8eda1302f3a36cb6073113f83 (patch) | |
| tree | 2dd8f154882736b557ff8c8cac0dabe03c79efe8 /internal/outcome/spruntime_test.go | |
| parent | bdca60d4959919a02f744457aaade3d9e2425f3a (diff) | |
internal/outcome: world-executable runtime/tmpdir
This does not reduce security, and saves the trouble of the additional
ACL setup/teardowns.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/outcome/spruntime_test.go')
| -rw-r--r-- | internal/outcome/spruntime_test.go | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/internal/outcome/spruntime_test.go b/internal/outcome/spruntime_test.go index 20e55d63..c549c857 100644 --- a/internal/outcome/spruntime_test.go +++ b/internal/outcome/spruntime_test.go @@ -33,8 +33,7 @@ func TestSpRuntimeOp(t *testing.T) { }, nil, []stub.Call{ // this op configures the system state and does not make calls during toSystem }, newI(). - Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true). - UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute). + Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false). Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true). UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{ // this op configures the container state and does not make calls during toContainer @@ -61,8 +60,7 @@ func TestSpRuntimeOp(t *testing.T) { }, nil, []stub.Call{ // this op configures the system state and does not make calls during toSystem }, newI(). - Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true). - UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute). + Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false). Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true). UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{ // this op configures the container state and does not make calls during toContainer @@ -89,8 +87,7 @@ func TestSpRuntimeOp(t *testing.T) { }, nil, []stub.Call{ // this op configures the system state and does not make calls during toSystem }, newI(). - Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true). - UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute). + Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false). Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true). UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{ // this op configures the container state and does not make calls during toContainer @@ -113,8 +110,7 @@ func TestSpRuntimeOp(t *testing.T) { }, hst.Template, nil, []stub.Call{ // this op configures the system state and does not make calls during toSystem }, newI(). - Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true). - UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute). + Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false). Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true). UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{ // this op configures the container state and does not make calls during toContainer |