extend env-settings tests to include SETENV/NOSETENV tests

trifectatechfoundation · Dec 17, 2024 · 6275390 · 6275390
1 parent 62ac2bb
commit 6275390
Showing 1 changed file with 37 additions and 23 deletions.
diff --git a/test-framework/sudo-compliance-tests/src/sudo/sudoers/env/keep.rs b/test-framework/sudo-compliance-tests/src/sudo/sudoers/env/keep.rs
@@ -253,19 +253,27 @@ fn checks_not_applied() -> Result<()> {
 fn can_set_from_commandline() -> Result<()> {
     let name = "CAN_BE_SET";
     let value = "4%2";
-    let env = Env([
-        "ALL ALL=(ALL:ALL) NOPASSWD: /usr/bin/env",
-        &format!("Defaults env_keep = {name}"),
-    ])
-    .build()?;
-
-    let stdout = Command::new("sudo")
-        .args([format!("{name}={value}"), "env".to_string()])
-        .output(&env)?
-        .stdout()?;
-    let sudo_env = helpers::parse_env_output(&stdout)?;
-
-    assert_eq!(Some(value), sudo_env.get(name).copied());
+    for sudoers in [
+        [
+            "ALL ALL=(ALL:ALL) NOPASSWD: /usr/bin/env",
+            format!("Defaults env_keep = {name}"),
+        ],
+        [
+            // SETENV overrides checks
+            "ALL ALL=(ALL:ALL) NOPASSWD: SETENV: /usr/bin/env",
+            format!("Defaults env_delete = {name}"),
+        ],
+    ] {
+        let env = Env(sudoers).build()?;
+
+        let stdout = Command::new("sudo")
+            .args([format!("{name}={value}"), "env".to_string()])
+            .output(&env)?
+            .stdout()?;
+        let sudo_env = helpers::parse_env_output(&stdout)?;
+
+        assert_eq!(Some(value), sudo_env.get(name).copied());
+    }
 
     Ok(())
 }
@@ -274,17 +282,23 @@ fn can_set_from_commandline() -> Result<()> {
 fn cannot_set_from_commandline() -> Result<()> {
     let name = "CANNOT_BE_SET";
     let value = "42";
-    let env = Env(["ALL ALL=(ALL:ALL) NOPASSWD: /usr/bin/env"]).build()?;
-
-    let output = Command::new("sudo")
-        .args([format!("{name}={value}"), "env".to_string()])
-        .output(&env)?;
 
-    assert_eq!(Some(1), output.status().code());
-    assert_contains!(
-        output.stderr(),
-        format!("you are not allowed to set the following environment variables: {name}")
-    );
+    for sudoers in [
+        ["ALL ALL=(ALL:ALL) NOPASSWD: /usr/bin/env"],
+        ["ALL ALL=(ALL:ALL) NOPASSWD: NOSETENV: /usr/bin/env"],
+    ] {
+        let env = Env(sudoers).build()?;
+
+        let output = Command::new("sudo")
+            .args([format!("{name}={value}"), "env".to_string()])
+            .output(&env)?;
+
+        assert_eq!(Some(1), output.status().code());
+        assert_contains!(
+            output.stderr(),
+            format!("you are not allowed to set the following environment variables: {name}")
+        );
+    }
 
     Ok(())
 }