abrown38andClaude Opus 5.5
785b0006f9
- CLI: name several servers and groups in the config file; select them with -s/--server NAME|GROUP|all|URL or JARL_SERVER. A command aimed at several servers is dry-run on all of them first and only runs if every one accepts it. Named servers always use their own token. - Reverse zones: /32 and /128 get single-address zones; networks between octet or nibble boundaries (e.g. a /22) are covered by several zones created together, from the CLI and the web UI. - Fix: under jarl.service's RestrictSUIDSGID, creating a view directory failed on chmod with the setgid bit; fall back to the permission bits. - Web UI: the review/live switch is a small header button, and the pending-changes bar only shows when there are pending changes. - TSIG key wording; the keys page points to restricted API tokens. - Docs: several servers (cli.md), a secondary server (operations.md), tokens vs TSIG keys (permissions.md); CHANGELOG. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.2 KiB
Go
48 lines
1.2 KiB
Go
package engine
|
|
|
|
import (
|
|
"io/fs"
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
"testing"
|
|
)
|
|
|
|
// Under systemd's RestrictSUIDSGID a chmod that sets the setgid bit fails
|
|
// with EPERM; EnsureDir must still create a group-writable directory.
|
|
func TestEnsureDirSetgidRestricted(t *testing.T) {
|
|
old := chmod
|
|
defer func() { chmod = old }()
|
|
chmod = func(name string, mode fs.FileMode) error {
|
|
if mode&fs.ModeSetgid != 0 {
|
|
return &fs.PathError{Op: "chmod", Path: name, Err: syscall.EPERM}
|
|
}
|
|
return os.Chmod(name, mode)
|
|
}
|
|
oldMask := syscall.Umask(0o027)
|
|
defer syscall.Umask(oldMask)
|
|
|
|
root := t.TempDir()
|
|
d := &Deployer{NamedWritable: []string{root}}
|
|
dir := filepath.Join(root, "internal")
|
|
if err := d.EnsureDir(dir, d.dirMode(dir)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
fi, err := os.Stat(dir)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi.Mode().Perm() != 0o770 {
|
|
t.Errorf("mode = %v, want group-writable 0770", fi.Mode())
|
|
}
|
|
// Unrestricted, the setgid bit is set too.
|
|
chmod = os.Chmod
|
|
dir2 := filepath.Join(root, "external")
|
|
if err := d.EnsureDir(dir2, d.dirMode(dir2)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi, _ := os.Stat(dir2); fi.Mode()&(fs.ModePerm|fs.ModeSetgid) != 0o770|fs.ModeSetgid {
|
|
t.Errorf("mode = %v, want 2770", fi.Mode())
|
|
}
|
|
}
|