Skip to content

Commit f7bbab5

Browse files
coderbirjucoderbirju
committed
chore: dirty commit
Signed-off-by: Arjun Raja Yogidas <[email protected]>
1 parent e6dbdf3 commit f7bbab5

File tree

2 files changed

+57
-51
lines changed

2 files changed

+57
-51
lines changed

‎.github/workflows/ci.yaml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -105,17 +105,19 @@ jobs:
105105
run: |
106106
sudo ls /etc/cni/net.d
107107
sudo rm /etc/cni/net.d/87-podman-bridge.conflist
108-
- name: Start finch-daemon
109-
run: sudo bin/finch-daemon --debug --socket-owner $UID &
110-
- name: Run e2e test
111-
run: sudo make test-e2e
112-
- name: Clean up Daemon socket
113-
run: sudo rm /var/run/finch.sock && sudo rm /run/finch.pid
114108
- name: Verify Rego file presence
115109
run: ls -l ${{ github.workspace }}/docs/sample-rego-policies/default.rego
116110
- name: Set Rego file path
117111
run: echo "REGO_FILE_PATH=${{ github.workspace }}/docs/sample-rego-policies/default.rego" >> $GITHUB_ENV
118112
- name: Start finch-daemon with opa Authz
119-
run: sudo bin/finch-daemon --debug --enable-middleware --rego-file ${{ github.workspace }}/docs/sample-rego-policies/default.rego --socket-owner $UID --socket-addr /run/test.sock --pidfile /run/test.pid &
113+
run: sudo bin/finch-daemon --debug --enable-middleware --rego-file ${{ github.workspace }}/docs/sample-rego-policies/default.rego --skip-rego-perm-check --socket-owner $UID --socket-addr /run/finch.sock --pidfile /run/finch.pid &
120114
- name: Run opa e2e tests
121115
run: sudo -E make test-e2e-opa
116+
- name: Clean up Daemon socket
117+
run: sudo rm /run/finch.sock && sudo rm /run/finch.pid
118+
- name: Start finch-daemon
119+
run: sudo bin/finch-daemon --debug --socket-owner $UID &
120+
- name: Run e2e test
121+
run: sudo make test-e2e
122+
- name: Clean up Daemon socket
123+
run: sudo rm /var/run/finch.sock && sudo rm /run/finch.pid

‎e2e/tests/opa_middleware.go

Lines changed: 48 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ import (
88
"encoding/json"
99
"fmt"
1010
"net/http"
11+
"os"
12+
"os/exec"
13+
"path/filepath"
14+
"time"
1115

1216
. "github.com/onsi/ginkgo/v2"
1317
. "github.com/onsi/gomega"
@@ -105,49 +109,49 @@ func OpaMiddlewareTest(opt *option.Option) {
105109
})
106110

107111
// Add this test to OpaMiddlewareTest function
108-
// It("should handle rego file permissions correctly", func() {
109-
// // Create a temporary rego file with overly permissive permissions
110-
// tmpDir, err := os.MkdirTemp("", "rego_test")
111-
// Expect(err).NotTo(HaveOccurred())
112-
// defer os.RemoveAll(tmpDir)
113-
114-
// regoPath := filepath.Join(tmpDir, "test.rego")
115-
// regoContent := []byte(`package finch.authz
116-
// default allow = false`)
117-
118-
// err = os.WriteFile(regoPath, regoContent, 0644)
119-
// Expect(err).NotTo(HaveOccurred())
120-
121-
// // Try to start daemon with overly permissive file
122-
// cmd := exec.Command(GetFinchDaemonExe(), //nolint:gosec // G204: This is a test file with controlled inputs
123-
// "--socket-addr", "/run/test.sock",
124-
// "--pidfile", "/run/test.pid",
125-
// "--rego-file", regoPath,
126-
// "--enable-middleware")
127-
// output, err := cmd.CombinedOutput()
128-
129-
// // Should fail due to permissions
130-
// Expect(err).To(HaveOccurred())
131-
// Expect(string(output)).To(ContainSubstring("rego file permissions 644 are too permissive - must be no more permissive than 0600"))
132-
133-
// // For the second test with skip-check:
134-
// cmd = exec.Command(GetFinchDaemonExe(), //nolint:gosec // G204: This is a test file with controlled inputs
135-
// "--socket-addr", "/run/test.sock",
136-
// "--pidfile", "/run/test.pid",
137-
// "--rego-file", regoPath,
138-
// "--enable-middleware",
139-
// "--skip-rego-perm-check")
140-
141-
// // Start the process in background
142-
// err = cmd.Start()
143-
// Expect(err).NotTo(HaveOccurred())
144-
145-
// // Give it a moment to initialize
146-
// time.Sleep(1 * time.Second)
147-
148-
// // Kill the process
149-
// err = cmd.Process.Kill()
150-
// Expect(err).NotTo(HaveOccurred())
151-
// })
112+
It("should handle rego file permissions correctly", func() {
113+
// Create a temporary rego file with overly permissive permissions
114+
tmpDir, err := os.MkdirTemp("", "rego_test")
115+
Expect(err).NotTo(HaveOccurred())
116+
defer os.RemoveAll(tmpDir)
117+
118+
regoPath := filepath.Join(tmpDir, "test.rego")
119+
regoContent := []byte(`package finch.authz
120+
default allow = false`)
121+
122+
err = os.WriteFile(regoPath, regoContent, 0644)
123+
Expect(err).NotTo(HaveOccurred())
124+
125+
// Try to start daemon with overly permissive file
126+
cmd := exec.Command(GetFinchDaemonExe(), //nolint:gosec // G204: This is a test file with controlled inputs
127+
"--socket-addr", "/run/test.sock",
128+
"--pidfile", "/run/test.pid",
129+
"--rego-file", regoPath,
130+
"--enable-middleware")
131+
output, err := cmd.CombinedOutput()
132+
133+
// Should fail due to permissions
134+
Expect(err).To(HaveOccurred())
135+
Expect(string(output)).To(ContainSubstring("rego file permissions 644 are too permissive - must be no more permissive than 0600"))
136+
137+
// For the second test with skip-check:
138+
cmd = exec.Command(GetFinchDaemonExe(), //nolint:gosec // G204: This is a test file with controlled inputs
139+
"--socket-addr", "/run/test.sock",
140+
"--pidfile", "/run/test.pid",
141+
"--rego-file", regoPath,
142+
"--enable-middleware",
143+
"--skip-rego-perm-check")
144+
145+
// Start the process in background
146+
err = cmd.Start()
147+
Expect(err).NotTo(HaveOccurred())
148+
149+
// Give it a moment to initialize
150+
time.Sleep(1 * time.Second)
151+
152+
// Kill the process
153+
err = cmd.Process.Kill()
154+
Expect(err).NotTo(HaveOccurred())
155+
})
152156
})
153157
}

0 commit comments

Comments
 (0)