@ -9,169 +9,117 @@ __metaclass__ = type
import errno
import json
import pytest
from units . mock . procenv import ModuleTestCase , swap_stdin_and_argv
from units . compat . mock import patch , MagicMock , mock_open , Mock
from ansible . module_utils . six . moves import builtins
realimport = builtins . __import__
class TestSELinux ( ModuleTestCase ) :
def test_module_utils_basic_ansible_module_selinux_mls_enabled ( self ) :
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
basic . HAVE_SELINUX = False
self . assertEqual ( am . selinux_mls_enabled ( ) , False )
basic . HAVE_SELINUX = True
basic . selinux = Mock ( )
with patch . dict ( ' sys.modules ' , { ' selinux ' : basic . selinux } ) :
with patch ( ' selinux.is_selinux_mls_enabled ' , return_value = 0 ) :
self . assertEqual ( am . selinux_mls_enabled ( ) , False )
with patch ( ' selinux.is_selinux_mls_enabled ' , return_value = 1 ) :
self . assertEqual ( am . selinux_mls_enabled ( ) , True )
delattr ( basic , ' selinux ' )
def test_module_utils_basic_ansible_module_selinux_initial_context ( self ) :
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
am . selinux_mls_enabled = MagicMock ( )
am . selinux_mls_enabled . return_value = False
self . assertEqual ( am . selinux_initial_context ( ) , [ None , None , None ] )
am . selinux_mls_enabled . return_value = True
self . assertEqual ( am . selinux_initial_context ( ) , [ None , None , None , None ] )
def test_module_utils_basic_ansible_module_selinux_enabled ( self ) :
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
# we first test the cases where the python selinux lib is
# not installed, which has two paths: one in which the system
# does have selinux installed (and the selinuxenabled command
# is present and returns 0 when run), or selinux is not installed
basic . HAVE_SELINUX = False
am . get_bin_path = MagicMock ( )
am . get_bin_path . return_value = ' /path/to/selinuxenabled '
am . run_command = MagicMock ( )
am . run_command . return_value = ( 0 , ' ' , ' ' )
self . assertRaises ( SystemExit , am . selinux_enabled )
am . get_bin_path . return_value = None
self . assertEqual ( am . selinux_enabled ( ) , False )
# finally we test the case where the python selinux lib is installed,
# and both possibilities there (enabled vs. disabled)
basic . HAVE_SELINUX = True
basic . selinux = Mock ( )
with patch . dict ( ' sys.modules ' , { ' selinux ' : basic . selinux } ) :
with patch ( ' selinux.is_selinux_enabled ' , return_value = 0 ) :
self . assertEqual ( am . selinux_enabled ( ) , False )
with patch ( ' selinux.is_selinux_enabled ' , return_value = 1 ) :
self . assertEqual ( am . selinux_enabled ( ) , True )
delattr ( basic , ' selinux ' )
def test_module_utils_basic_ansible_module_selinux_default_context ( self ) :
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
am . selinux_initial_context = MagicMock ( return_value = [ None , None , None , None ] )
am . selinux_enabled = MagicMock ( return_value = True )
# we first test the cases where the python selinux lib is not installed
basic . HAVE_SELINUX = False
self . assertEqual ( am . selinux_default_context ( path = ' /foo/bar ' ) , [ None , None , None , None ] )
# all following tests assume the python selinux bindings are installed
basic . HAVE_SELINUX = True
basic . selinux = Mock ( )
with patch . dict ( ' sys.modules ' , { ' selinux ' : basic . selinux } ) :
# next, we test with a mocked implementation of selinux.matchpathcon to simulate
# an actual context being found
with patch ( ' selinux.matchpathcon ' , return_value = [ 0 , ' unconfined_u:object_r:default_t:s0 ' ] ) :
self . assertEqual ( am . selinux_default_context ( path = ' /foo/bar ' ) , [ ' unconfined_u ' , ' object_r ' , ' default_t ' , ' s0 ' ] )
# we also test the case where matchpathcon returned a failure
with patch ( ' selinux.matchpathcon ' , return_value = [ - 1 , ' ' ] ) :
self . assertEqual ( am . selinux_default_context ( path = ' /foo/bar ' ) , [ None , None , None , None ] )
# finally, we test where an OSError occurred during matchpathcon's call
with patch ( ' selinux.matchpathcon ' , side_effect = OSError ) :
self . assertEqual ( am . selinux_default_context ( path = ' /foo/bar ' ) , [ None , None , None , None ] )
delattr ( basic , ' selinux ' )
def test_module_utils_basic_ansible_module_selinux_context ( self ) :
from . . . compat . mock import mock_open , patch
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
am . selinux_initial_context = MagicMock ( return_value = [ None , None , None , None ] )
am . selinux_enabled = MagicMock ( return_value = True )
# we first test the cases where the python selinux lib is not installed
basic . HAVE_SELINUX = False
self . assertEqual ( am . selinux_context ( path = ' /foo/bar ' ) , [ None , None , None , None ] )
# all following tests assume the python selinux bindings are installed
basic . HAVE_SELINUX = True
basic . selinux = Mock ( )
with patch . dict ( ' sys.modules ' , { ' selinux ' : basic . selinux } ) :
# next, we test with a mocked implementation of selinux.lgetfilecon_raw to simulate
# an actual context being found
with patch ( ' selinux.lgetfilecon_raw ' , return_value = [ 0 , ' unconfined_u:object_r:default_t:s0 ' ] ) :
self . assertEqual ( am . selinux_context ( path = ' /foo/bar ' ) , [ ' unconfined_u ' , ' object_r ' , ' default_t ' , ' s0 ' ] )
# we also test the case where matchpathcon returned a failure
with patch ( ' selinux.lgetfilecon_raw ' , return_value = [ - 1 , ' ' ] ) :
self . assertEqual ( am . selinux_context ( path = ' /foo/bar ' ) , [ None , None , None , None ] )
# finally, we test where an OSError occurred during matchpathcon's call
e = OSError ( )
e . errno = errno . ENOENT
with patch ( ' selinux.lgetfilecon_raw ' , side_effect = e ) :
self . assertRaises ( SystemExit , am . selinux_context , path = ' /foo/bar ' )
e = OSError ( )
with patch ( ' selinux.lgetfilecon_raw ' , side_effect = e ) :
self . assertRaises ( SystemExit , am . selinux_context , path = ' /foo/bar ' )
delattr ( basic , ' selinux ' )
from ansible . module_utils . common . text . converters import to_bytes
from ansible . module_utils . six . moves import builtins
def test_module_utils_basic_ansible_module_is_special_selinux_path ( self ) :
from ansible . module_utils import basic
args = json . dumps ( dict ( ANSIBLE_MODULE_ARGS = { ' _ansible_selinux_special_fs ' : " nfs,nfsd,foos " ,
@pytest.fixture
def no_args_module_exec ( ) :
with patch . object ( basic , ' _ANSIBLE_ARGS ' , b ' { " ANSIBLE_MODULE_ARGS " : {} } ' ) :
yield # we're patching the global module object, so nothing to yield
def no_args_module ( selinux_enabled = None , selinux_mls_enabled = None ) :
am = basic . AnsibleModule ( argument_spec = { } )
# just dirty-patch the wrappers on the object instance since it's short-lived
if isinstance ( selinux_enabled , bool ) :
patch . object ( am , ' selinux_enabled ' , return_value = selinux_enabled ) . start ( )
if isinstance ( selinux_mls_enabled , bool ) :
patch . object ( am , ' selinux_mls_enabled ' , return_value = selinux_mls_enabled ) . start ( )
return am
# test AnsibleModule selinux wrapper methods
@pytest.mark.usefixtures ( ' no_args_module_exec ' )
class TestSELinuxMU :
def test_selinux_enabled ( self ) :
# test selinux unavailable
# selinux unavailable, should return false
with patch . object ( basic , ' HAVE_SELINUX ' , False ) :
assert no_args_module ( ) . selinux_enabled ( ) is False
# test selinux present/not-enabled
disabled_mod = no_args_module ( )
with patch ( ' ansible.module_utils.compat.selinux.is_selinux_enabled ' , return_value = 0 ) :
assert disabled_mod . selinux_enabled ( ) is False
# ensure value is cached (same answer after unpatching)
assert disabled_mod . selinux_enabled ( ) is False
# and present / enabled
enabled_mod = no_args_module ( )
with patch ( ' ansible.module_utils.compat.selinux.is_selinux_enabled ' , return_value = 1 ) :
assert enabled_mod . selinux_enabled ( ) is True
# ensure value is cached (same answer after unpatching)
assert enabled_mod . selinux_enabled ( ) is True
def test_selinux_mls_enabled ( self ) :
# selinux unavailable, should return false
with patch . object ( basic , ' HAVE_SELINUX ' , False ) :
assert no_args_module ( ) . selinux_mls_enabled ( ) is False
# selinux disabled, should return false
with patch ( ' ansible.module_utils.compat.selinux.is_selinux_mls_enabled ' , return_value = 0 ) :
assert no_args_module ( selinux_enabled = False ) . selinux_mls_enabled ( ) is False
# selinux enabled, should pass through the value of is_selinux_mls_enabled
with patch ( ' ansible.module_utils.compat.selinux.is_selinux_mls_enabled ' , return_value = 1 ) :
assert no_args_module ( selinux_enabled = True ) . selinux_mls_enabled ( ) is True
def test_selinux_initial_context ( self ) :
# selinux missing/disabled/enabled sans MLS is 3-element None
assert no_args_module ( selinux_enabled = False , selinux_mls_enabled = False ) . selinux_initial_context ( ) == [ None , None , None ]
assert no_args_module ( selinux_enabled = True , selinux_mls_enabled = False ) . selinux_initial_context ( ) == [ None , None , None ]
# selinux enabled with MLS is 4-element None
assert no_args_module ( selinux_enabled = True , selinux_mls_enabled = True ) . selinux_initial_context ( ) == [ None , None , None , None ]
def test_selinux_default_context ( self ) :
# selinux unavailable
with patch . object ( basic , ' HAVE_SELINUX ' , False ) :
assert no_args_module ( ) . selinux_default_context ( path = ' /foo/bar ' ) == [ None , None , None ]
am = no_args_module ( selinux_enabled = True , selinux_mls_enabled = True )
# matchpathcon success
with patch ( ' ansible.module_utils.compat.selinux.matchpathcon ' , return_value = [ 0 , ' unconfined_u:object_r:default_t:s0 ' ] ) :
assert am . selinux_default_context ( path = ' /foo/bar ' ) == [ ' unconfined_u ' , ' object_r ' , ' default_t ' , ' s0 ' ]
# matchpathcon fail (return initial context value)
with patch ( ' ansible.module_utils.compat.selinux.matchpathcon ' , return_value = [ - 1 , ' ' ] ) :
assert am . selinux_default_context ( path = ' /foo/bar ' ) == [ None , None , None , None ]
# matchpathcon OSError
with patch ( ' ansible.module_utils.compat.selinux.matchpathcon ' , side_effect = OSError ) :
assert am . selinux_default_context ( path = ' /foo/bar ' ) == [ None , None , None , None ]
def test_selinux_context ( self ) :
# selinux unavailable
with patch . object ( basic , ' HAVE_SELINUX ' , False ) :
assert no_args_module ( ) . selinux_context ( path = ' /foo/bar ' ) == [ None , None , None ]
am = no_args_module ( selinux_enabled = True , selinux_mls_enabled = True )
# lgetfilecon_raw passthru
with patch ( ' ansible.module_utils.compat.selinux.lgetfilecon_raw ' , return_value = [ 0 , ' unconfined_u:object_r:default_t:s0 ' ] ) :
assert am . selinux_context ( path = ' /foo/bar ' ) == [ ' unconfined_u ' , ' object_r ' , ' default_t ' , ' s0 ' ]
# lgetfilecon_raw returned a failure
with patch ( ' ansible.module_utils.compat.selinux.lgetfilecon_raw ' , return_value = [ - 1 , ' ' ] ) :
assert am . selinux_context ( path = ' /foo/bar ' ) == [ None , None , None , None ]
# lgetfilecon_raw OSError (should bomb the module)
with patch ( ' ansible.module_utils.compat.selinux.lgetfilecon_raw ' , side_effect = OSError ( errno . ENOENT , ' NotFound ' ) ) :
with pytest . raises ( SystemExit ) :
am . selinux_context ( path = ' /foo/bar ' )
with patch ( ' ansible.module_utils.compat.selinux.lgetfilecon_raw ' , side_effect = OSError ( ) ) :
with pytest . raises ( SystemExit ) :
am . selinux_context ( path = ' /foo/bar ' )
def test_is_special_selinux_path ( self ) :
args = to_bytes ( json . dumps ( dict ( ANSIBLE_MODULE_ARGS = { ' _ansible_selinux_special_fs ' : " nfs,nfsd,foos " ,
' _ansible_remote_tmp ' : " /tmp " ,
' _ansible_keep_remote_files ' : False } ) )
' _ansible_keep_remote_files ' : False } ) ) )
with swap_stdin_and_argv ( stdin_data = args ) :
basic . _ANSIBLE_ARGS = None
with patch . object ( basic , ' _ANSIBLE_ARGS ' , args ) :
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
@ -183,14 +131,14 @@ class TestSELinux(ModuleTestCase):
return ' /weird/random/fstype '
return ' / '
am . find_mount_point = MagicMock( side_effect = _mock_find_mount_point)
am . selinux_context = MagicMock ( return_value = [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] )
am . find_mount_point =
am . selinux_context = lambda path : [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ]
m = mock_open ( )
m . side_effect = OSError
with patch . object ( builtins , ' open ' , m , create = True ) :
self . assertEqual ( am . is_special_selinux_path ( ' /some/path/that/should/be/nfs ' ) , ( False , None ) )
assert am . is_special_selinux_path ( ' /some/path/that/should/be/nfs ' ) == ( False , None )
mount_data = [
' /dev/disk1 / ext4 rw,seclabel,relatime,data=ordered 0 0 \n ' ,
@ -204,51 +152,38 @@ class TestSELinux(ModuleTestCase):
m . return_value . readlines . return_value = mount_data
with patch . object ( builtins , ' open ' , m , create = True ) :
self . assertEqual ( am . is_special_selinux_path ( ' /some/random/path ' ) , ( False , None ) )
self . assertEqual ( am . is_special_selinux_path ( ' /some/path/that/should/be/nfs ' ) , ( True , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] ) )
self . assertEqual ( am . is_special_selinux_path ( ' /weird/random/fstype/path ' ) , ( True , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] ) )
def test_module_utils_basic_ansible_module_set_context_if_different ( self ) :
from ansible . module_utils import basic
basic . _ANSIBLE_ARGS = None
am = basic . AnsibleModule (
argument_spec = dict ( ) ,
)
basic . HAVE_SELINUX = False
assert am . is_special_selinux_path ( ' /some/random/path ' ) == ( False , None )
assert am . is_special_selinux_path ( ' /some/path/that/should/be/nfs ' ) == ( True , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] )
assert am . is_special_selinux_path ( ' /weird/random/fstype/path ' ) == ( True , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] )
am . selinux_enabled = MagicMock ( return_value = False )
self . assertEqual ( am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True ) , True )
self . assertEqual ( am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) , False )
def test_set_context_if_different ( self ) :
am = no_args_module ( selinux_enabled = False )
assert am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True ) is True
assert am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) is False
basic . HAVE_SELINUX = True
am = no_args_module ( selinux_enabled = True , selinux_mls_enabled = True )
am . selinux_context = lambda path : [ ' bar_u ' , ' bar_r ' , None , None ]
am . is_special_selinux_path = lambda path : ( False , None )
am . selinux_enabled = MagicMock ( return_value = True )
am . selinux_context = MagicMock ( return_value = [ ' bar_u ' , ' bar_r ' , None , None ] )
am . is_special_selinux_path = MagicMock ( return_value = ( False , None ) )
basic . selinux = Mock ( )
with patch . dict ( ' sys.modules ' , { ' selinux ' : basic . selinux } ) :
with patch ( ' selinux.lsetfilecon ' , return_value = 0 ) as m :
self . assertEqual ( am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) , True )
with patch ( ' ansible.module_utils.compat.selinux.lsetfilecon ' , return_value = 0 ) as m :
assert am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) is True
m . assert_called_with ( ' /path/to/file ' , ' foo_u:foo_r:foo_t:s0 ' )
m . reset_mock ( )
am . check_mode = True
self . assertEqual ( am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) , True )
self . assertEqual ( m . called , False )
assert am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) is True
assert not m . called
am . check_mode = False
with patch ( ' selinux.lsetfilecon ' , return_value = 1 ) as m :
self . assertRaises ( SystemExit , am . set_context_if_different , ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True )
with patch ( ' ansible.module_utils.compat.selinux.lsetfilecon ' , return_value = 1 ) :
with pytest . raises ( SystemExit ) :
am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True )
with patch ( ' selinux.lsetfilecon ' , side_effect = OSError ) as m :
self . assertRaises ( SystemExit , am . set_context_if_different , ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True )
with patch ( ' ansible.module_utils.compat.selinux.lsetfilecon ' , side_effect = OSError ) :
with pytest . raises ( SystemExit ) :
am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , True )
am . is_special_selinux_path = MagicMock ( return_value = ( True , [ ' sp_u ' , ' sp_r ' , ' sp_t ' , ' s0 ' ] ) )
am . is_special_selinux_path = lambda path : ( True , [ ' sp_u ' , ' sp_r ' , ' sp_t ' , ' s0 ' ] )
with patch ( ' ' , return_value = 0 ) as m :
self . assertEqual ( am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) , True )
with patch ( ' ansible.module_utils.compat. selinux.lsetfilecon' , return_value = 0 ) as m :
assert am . set_context_if_different ( ' /path/to/file ' , [ ' foo_u ' , ' foo_r ' , ' foo_t ' , ' s0 ' ] , False ) is True
m . assert_called_with ( ' /path/to/file ' , ' sp_u:sp_r:sp_t:s0 ' )
delattr ( basic , ' selinux ' )
Matt Davis
4 years ago
committed by