gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restore Windows installer test compilation

Browse Source 
The Unix agent-ID recovery test imported syscall.Mkfifo from a generic test file. Go must compile that file before its runtime skip can run, so Windows CI could no longer build the installer test package. Keep the security regression on supported Unix targets while restoring the Windows delivery signal.

Change-source: pulse-maintainer
(cherry picked from commit c0ca94ee9f)
This commit is contained in:
pulse-triage[bot]
2026-09-01 23:23:25 +01:00
parent 62003caaea
commit d2cc6b4884
2 changed files with 64 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/installtests/agent_id_recovery_unix_test.go
+64
View File
@@ -0,0 +1,64 @@
//go:build linux || darwin || freebsd
package installtests
import (
"context"
"os"
"os/exec"
"path/filepath"
"strings"
"syscall"
"testing"
"time"
)
func TestInstallSHAgentIDRecoveryRejectsSymlinkFIFOAndOversizedState(t *testing.T) {
binaryPath := buildLifecycleAgent(t)
root := t.TempDir()
validPath := filepath.Join(root, "valid-agent-id")
oversizedPath := filepath.Join(root, "oversized-agent-id")
symlinkPath := filepath.Join(root, "symlink-agent-id")
fifoPath := filepath.Join(root, "fifo-agent-id")
if err := os.WriteFile(validPath, []byte("agent-safe-123\n"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(oversizedPath, []byte(strings.Repeat("a", 5000)), 0600); err != nil {
t.Fatal(err)
}
if err := os.Symlink(validPath, symlinkPath); err != nil {
t.Fatal(err)
}
if err := syscall.Mkfifo(fifoPath, 0600); err != nil {
t.Fatal(err)
}
harness := func(path string) ([]byte, error) {
script := `
set -euo pipefail
COLLECTOR_LIFECYCLE_BINARY_PATH="` + binaryPath + `"
INSTALL_DIR="` + root + `"
BINARY_NAME="pulse-agent"
LEAST_PRIVILEGE_USER="pulse-agent-test-missing"
` + extractLifecycleTrustShellFunctions(t) + `
` + extractInstallShellFunction(t, "collector_lifecycle_binary") + `
` + extractInstallShellFunction(t, "read_agent_id_file_safely") + `
read_agent_id_file_safely "` + path + `"
`
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
return exec.CommandContext(ctx, "bash", "-c", script).CombinedOutput()
}
if out, err := harness(validPath); err != nil || strings.TrimSpace(string(out)) != "agent-safe-123" {
t.Fatalf("valid descriptor-bound agent ID recovery failed: %v\n%s", err, out)
}
for _, path := range []string{symlinkPath, fifoPath, oversizedPath} {
started := time.Now()
if out, err := harness(path); err == nil {
t.Fatalf("unsafe agent ID path %s was accepted:\n%s", path, out)
}
if elapsed := time.Since(started); elapsed >= 2*time.Second {
t.Fatalf("unsafe agent ID path %s blocked for %s", path, elapsed)
}
}
}
scripts/installtests/agent_state_dir_lifecycle_test.go
-54
View File
@@ -3,7 +3,6 @@ package installtests
import (
"bytes"
"compress/gzip"
"context"
"encoding/json"
"io"
"net/http"
@@ -19,59 +18,6 @@ import (
"time"
)
func TestInstallSHAgentIDRecoveryRejectsSymlinkFIFOAndOversizedState(t *testing.T) {
if runtime.GOOS == "windows" {
t.Skip("Unix descriptor-bound identity recovery")
}
binaryPath := buildLifecycleAgent(t)
root := t.TempDir()
validPath := filepath.Join(root, "valid-agent-id")
oversizedPath := filepath.Join(root, "oversized-agent-id")
symlinkPath := filepath.Join(root, "symlink-agent-id")
fifoPath := filepath.Join(root, "fifo-agent-id")
if err := os.WriteFile(validPath, []byte("agent-safe-123\n"), 0600); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(oversizedPath, []byte(strings.Repeat("a", 5000)), 0600); err != nil {
t.Fatal(err)
}
if err := os.Symlink(validPath, symlinkPath); err != nil {
t.Fatal(err)
}
if err := syscall.Mkfifo(fifoPath, 0600); err != nil {
t.Fatal(err)
}
harness := func(path string) ([]byte, error) {
script := `
set -euo pipefail
COLLECTOR_LIFECYCLE_BINARY_PATH="` + binaryPath + `"
INSTALL_DIR="` + root + `"
BINARY_NAME="pulse-agent"
LEAST_PRIVILEGE_USER="pulse-agent-test-missing"
` + extractLifecycleTrustShellFunctions(t) + `
` + extractInstallShellFunction(t, "collector_lifecycle_binary") + `
` + extractInstallShellFunction(t, "read_agent_id_file_safely") + `
read_agent_id_file_safely "` + path + `"
`
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
return exec.CommandContext(ctx, "bash", "-c", script).CombinedOutput()
}
if out, err := harness(validPath); err != nil || strings.TrimSpace(string(out)) != "agent-safe-123" {
t.Fatalf("valid descriptor-bound agent ID recovery failed: %v\n%s", err, out)
}
for _, path := range []string{symlinkPath, fifoPath, oversizedPath} {
started := time.Now()
if out, err := harness(path); err == nil {
t.Fatalf("unsafe agent ID path %s was accepted:\n%s", path, out)
}
if elapsed := time.Since(started); elapsed >= 2*time.Second {
t.Fatalf("unsafe agent ID path %s blocked for %s", path, elapsed)
}
}
}
type agentLifecycleControlPlane struct {
mu sync.Mutex
online bool