Skip to content

Commit 1e48dcb

Browse files
LeChatPLeChatP
committed
Refactor: Remove wildcard-denied option from configuration and related code
- Removed "wildcard-denied" option from rootasrole.json and associated code in CLI and data structures. - Updated CLI commands and help documentation to reflect the removal of wildcard-denied. - Cleaned up tests and processing logic that referenced wildcard-denied. - Adjusted capability handling to ensure proper functionality without wildcard-denied.
1 parent af22a0b commit 1e48dcb

File tree

22 files changed

+796
-475
lines changed

22 files changed

+796
-475
lines changed

‎.cargo/config.toml‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,28 @@
11
[alias]
22
xtask = "run --package xtask --release --bin xtask --"
3+
test-root = [
4+
"test",
5+
"--workspace",
6+
"--all-features",
7+
"--all-targets",
8+
"--config",
9+
"target.\"cfg(all())\".runner=\"/usr/bin/sudo -E\"",
10+
"--"
11+
]
12+
13+
coverage = [
14+
"--config",
15+
"target.\"cfg(all())\".runner=\"/usr/bin/sudo -E\"",
16+
"tarpaulin",
17+
"--workspace",
18+
"--all-features",
19+
"--timeout",
20+
"120",
21+
"--exclude-files",
22+
"build.rs", "xtask/src/*",
23+
"-e",
24+
"xtask",
25+
]
326

427
[env]
528
RAR_CFG_TYPE = "json"
@@ -22,5 +45,4 @@ RAR_ENV_SET_LIST = ""
2245
RAR_ENV_OVERRIDE_BEHAVIOR = "false"
2346
RAR_AUTHENTICATION = "perform"
2447
RAR_USER_CONSIDERED = "user"
25-
RAR_BOUNDING = "strict"
26-
RAR_WILDCARD_DENIED = "&|"
48+
RAR_BOUNDING = "strict"

‎Cargo.toml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ name = "chsr"
5151
path = "src/chsr/main.rs"
5252
required-features = ["editor"]
5353

54+
# Integration tests that require root privileges
55+
[[test]]
56+
name = "integration_tests"
57+
path = "tests/integration_tests.rs"
58+
required-features = ["finder"]
59+
5460
[features]
5561
finder = ["pcre2", "rar-common/finder"]
5662
pcre2 = ["dep:pcre2", "rar-common/pcre2"]

‎book/src/chsr/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ chsr role [role_name] task [task_name] options [option] [operation]
6969
<b>env</b> Manage environment variable settings (set, whitelist, blacklist, checklist).
7070
<b>root</b> [policy] Defines when the root user (uid == 0) gets his privileges by default. (privileged, user, inherit)
7171
<b>bounding</b> [policy] Defines when dropped capabilities are permanently removed in the instantiated process. (strict, ignore, inherit)
72-
<b>wildcard-denied</b> Manage chars that are denied in binary path.
7372
<b>timeout</b> Manage timeout settings (set, unset).
7473

7574

‎book/src/chsr/file-config.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ The following example shows a RootAsRole config without plugins when almost ever
5959
},
6060
"root": "privileged", // Default policy for root: privileged, user, inherit
6161
"bounding": "ignore", // Default policy for bounding: strict, ignore, inherit
62-
"wildcard-denied": "*", // Characters denied in any binary path
6362
"timeout": {
6463
"type": "ppid", // Type of timeout: tty, ppid, uid
6564
"duration": "15:30:30", // Duration of the timeout in HH:MM:SS format
@@ -165,7 +164,6 @@ The following example shows a RootAsRole config without plugins when almost ever
165164
},
166165
"root": "privileged",
167166
"bounding": "ignore",
168-
"wildcard-denied": "*",
169167
"timeout": {
170168
"type": "ppid",
171169
"duration": "15:30:30",
@@ -203,7 +201,6 @@ The following example shows a RootAsRole config without plugins when almost ever
203201
},
204202
"root": "privileged",
205203
"bounding": "ignore",
206-
"wildcard-denied": "*",
207204
"timeout": {
208205
"type": "ppid",
209206
"duration": "15:30:30",

‎rar-common/src/database/options.rs‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ pub enum OptType {
4747
Env,
4848
Root,
4949
Bounding,
50-
Wildcard,
5150
Timeout,
5251
}
5352

@@ -260,8 +259,6 @@ pub struct Opt {
260259
pub bounding: Option<SBounding>,
261260
#[serde(default, skip_serializing_if = "Option::is_none")]
262261
pub authentication: Option<SAuthentication>,
263-
#[serde(skip_serializing_if = "Option::is_none")]
264-
pub wildcard_denied: Option<String>,
265262
#[serde(default, skip_serializing_if = "Option::is_none")]
266263
pub timeout: Option<STimeout>,
267264
#[serde(default, flatten)]
@@ -278,7 +275,6 @@ impl Opt {
278275
root: Option<SPrivileged>,
279276
bounding: Option<SBounding>,
280277
authentication: Option<SAuthentication>,
281-
#[builder(into)] wildcard_denied: Option<String>,
282278
timeout: Option<STimeout>,
283279
#[builder(default)] _extra_fields: Map<String, Value>,
284280
) -> Self {
@@ -289,7 +285,6 @@ impl Opt {
289285
root,
290286
bounding,
291287
authentication,
292-
wildcard_denied,
293288
timeout,
294289
_extra_fields,
295290
}
@@ -344,7 +339,6 @@ impl Opt {
344339
)
345340
.build(),
346341
)
347-
.wildcard_denied(env!("RAR_WILDCARD_DENIED"))
348342
.build()
349343
}
350344
}
@@ -357,7 +351,6 @@ impl Default for Opt {
357351
root: Some(SPrivileged::default()),
358352
bounding: Some(SBounding::default()),
359353
authentication: None,
360-
wildcard_denied: None,
361354
timeout: None,
362355
_extra_fields: Map::default(),
363356
level: Level::Default,
@@ -897,15 +890,6 @@ impl OptStack {
897890
})
898891
.map(|(_, authentication)| authentication),
899892
)
900-
.maybe_wildcard_denied(
901-
self.find_in_options(|opt| {
902-
opt.wildcard_denied
903-
.borrow()
904-
.as_ref()
905-
.map(|wildcard| (opt.level, wildcard.clone()))
906-
})
907-
.map(|(_, wildcard)| wildcard),
908-
)
909893
.maybe_timeout(
910894
self.find_in_options(|opt| opt.timeout.clone().map(|timeout| (opt.level, timeout)))
911895
.map(|(_, timeout)| timeout),
@@ -1061,7 +1045,6 @@ mod tests {
10611045
.duration(Duration::minutes(3))
10621046
.build(),
10631047
)
1064-
.wildcard_denied("c")
10651048
.build()
10661049
})
10671050
.build(),
@@ -1087,7 +1070,6 @@ mod tests {
10871070
.duration(Duration::minutes(2))
10881071
.build(),
10891072
)
1090-
.wildcard_denied("b")
10911073
.build()
10921074
})
10931075
.build(),
@@ -1113,7 +1095,6 @@ mod tests {
11131095
.duration(Duration::minutes(1))
11141096
.build(),
11151097
)
1116-
.wildcard_denied("a")
11171098
.build()
11181099
})
11191100
.build();
@@ -1178,7 +1159,6 @@ mod tests {
11781159
global_options.timeout.as_ref().unwrap().type_field.unwrap(),
11791160
TimestampType::TTY
11801161
);
1181-
assert_eq!(global_options.wildcard_denied.as_ref().unwrap(), "a");
11821162
let opt = OptStack::from_role(config.clone().role("test").unwrap()).to_opt();
11831163
let role_options = opt.as_ref().borrow();
11841164
assert_eq!(
@@ -1222,7 +1202,6 @@ mod tests {
12221202
role_options.timeout.as_ref().unwrap().type_field.unwrap(),
12231203
TimestampType::PPID
12241204
);
1225-
assert_eq!(role_options.wildcard_denied.as_ref().unwrap(), "b");
12261205
let opt = OptStack::from_task(config.task("test", 1).unwrap()).to_opt();
12271206
let task_options = opt.as_ref().borrow();
12281207
assert_eq!(
@@ -1269,7 +1248,6 @@ mod tests {
12691248
task_options.timeout.as_ref().unwrap().type_field.unwrap(),
12701249
TimestampType::TTY
12711250
);
1272-
assert_eq!(task_options.wildcard_denied.as_ref().unwrap(), "c");
12731251
}
12741252

12751253
#[test]

‎rar-common/src/database/structs.rs‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -709,7 +709,6 @@ mod tests {
709709
"root": "privileged",
710710
"bounding": "ignore",
711711
"authentication": "skip",
712-
"wildcard-denied": "wildcards",
713712
"timeout": {
714713
"type": "ppid",
715714
"duration": "00:05:00"
@@ -786,7 +785,6 @@ mod tests {
786785
assert!(options.root.as_ref().unwrap().is_privileged());
787786
assert!(options.bounding.as_ref().unwrap().is_ignore());
788787
assert_eq!(options.authentication, Some(SAuthentication::Skip));
789-
assert_eq!(options.wildcard_denied.as_ref().unwrap(), "wildcards");
790788

791789
let timeout = options.timeout.as_ref().unwrap();
792790
assert_eq!(timeout.type_field, Some(TimestampType::PPID));
@@ -859,7 +857,6 @@ mod tests {
859857
},
860858
"allow-root": false,
861859
"allow-bounding": false,
862-
"wildcard-denied": "wildcards",
863860
"timeout": {
864861
"type": "ppid",
865862
"duration": "00:05:00",
@@ -975,7 +972,6 @@ mod tests {
975972
"root": "privileged",
976973
"bounding": "ignore",
977974
"authentication": "skip",
978-
"wildcard-denied": "wildcards",
979975
"timeout": {
980976
"type": "ppid",
981977
"duration": "00:05:00"
@@ -1042,7 +1038,6 @@ mod tests {
10421038
assert!(options.root.as_ref().unwrap().is_privileged());
10431039
assert!(options.bounding.as_ref().unwrap().is_ignore());
10441040
assert_eq!(options.authentication, Some(SAuthentication::Skip));
1045-
assert_eq!(options.wildcard_denied.as_ref().unwrap(), "wildcards");
10461041

10471042
let timeout = options.timeout.as_ref().unwrap();
10481043
assert_eq!(timeout.type_field, Some(TimestampType::PPID));
@@ -1153,7 +1148,6 @@ mod tests {
11531148
.root(SPrivileged::Privileged)
11541149
.bounding(SBounding::Ignore)
11551150
.authentication(SAuthentication::Skip)
1156-
.wildcard_denied("wildcards")
11571151
.timeout(
11581152
STimeout::builder()
11591153
.type_field(TimestampType::PPID)

0 commit comments

Comments
 (0)