visudo: test --no-includes and --strict

test-framework/sudo-compliance-tests/src/visudo.rs

@@ -7,9 +7,11 @@ use crate::{Result, SUDOERS_ALL_ALL_NOPASSWD};
 mod flag_check;
 mod flag_file;
 mod flag_help;
+mod flag_no_includes;
 mod flag_owner;
 mod flag_perms;
 mod flag_quiet;
+mod flag_strict;
 mod flag_version;
 mod sudoers;
 mod what_now_prompt;

test-framework/sudo-compliance-tests/src/visudo/flag_no_includes.rs

@@ -0,0 +1,112 @@
+use sudo_test::{Command, Env, TextFile};
+
+use crate::{
+    visudo::{CHMOD_EXEC, DEFAULT_EDITOR, LOGS_PATH},
+    Result,
+};
+
+#[test]
+fn does_not_edit_at_include_files_that_dont_contain_syntax_errors() -> Result<()> {
+    let env = Env("# 1
+@include sudoers2")
+    .file("/etc/sudoers2", "# 2")
+    .file(
+        DEFAULT_EDITOR,
+        TextFile(format!(
+            "#!/bin/sh
+cat $2 >> {LOGS_PATH}"
+        ))
+        .chmod(CHMOD_EXEC),
+    )
+    .build()?;
+
+    Command::new("visudo")
+        .arg("--no-includes")
+        .output(&env)?
+        .assert_success()?;
+    let logs = Command::new("cat").arg(LOGS_PATH).output(&env)?.stdout()?;
+
+    let comments = logs
+        .lines()
+        .filter(|line| line.starts_with('#'))
+        .collect::<Vec<_>>();
+
+    assert_eq!(["# 1"], &*comments);
+
+    Ok(())
+}
+
+#[test]
+fn does_edit_at_include_files_that_contain_syntax_errors() -> Result<()> {
+    let env = Env("# 1
+@include sudoers2")
+    .file(
+        "/etc/sudoers2",
+        "# 2
+this is fine",
+    )
+    .file(
+        DEFAULT_EDITOR,
+        TextFile(format!(
+            "#!/bin/sh
+cat $2 >> {LOGS_PATH}"
+        ))
+        .chmod(CHMOD_EXEC),
+    )
+    .build()?;
+
+    Command::new("visudo")
+        .arg("--no-includes")
+        .output(&env)?
+        .assert_success()?;
+    let logs = Command::new("cat").arg(LOGS_PATH).output(&env)?.stdout()?;
+
+    let comments = logs
+        .lines()
+        .filter(|line| line.starts_with('#'))
+        .collect::<Vec<_>>();
+
+    assert_eq!(["# 1"], &*comments);
+
+    Ok(())
+}
+
+#[test]
+fn does_not_edit_deep_at_include_files_that_contain_syntax_errors() -> Result<()> {
+    let env = Env("# 1
+@include sudoers2")
+    .file(
+        "/etc/sudoers2",
+        "# 2
+@include sudoers3",
+    )
+    .file(
+        "/etc/sudoers3",
+        "# 3
+this is fine",
+    )
+    .file(
+        DEFAULT_EDITOR,
+        TextFile(format!(
+            "#!/bin/sh
+cat $2 >> {LOGS_PATH}"
+        ))
+        .chmod(CHMOD_EXEC),
+    )
+    .build()?;
+
+    Command::new("visudo")
+        .arg("--no-includes")
+        .output(&env)?
+        .assert_success()?;
+    let logs = Command::new("cat").arg(LOGS_PATH).output(&env)?.stdout()?;
+
+    let comments = logs
+        .lines()
+        .filter(|line| line.starts_with('#'))
+        .collect::<Vec<_>>();
+
+    assert_eq!(["# 1"], &*comments);
+
+    Ok(())
+}

test-framework/sudo-compliance-tests/src/visudo/flag_strict.rs

@@ -0,0 +1,66 @@
+use sudo_test::{Command, Env, TextFile};
+
+use crate::{
+    visudo::{CHMOD_EXEC, DEFAULT_EDITOR, EDITOR_TRUE},
+    Result,
+};
+
+#[test]
+#[ignore = "gh657"]
+fn undefined_alias() -> Result<()> {
+    let env = Env(["# User_Alias ADMINS = root", "ADMINS ALL=(ALL:ALL) ALL"])
+        .file(DEFAULT_EDITOR, TextFile(EDITOR_TRUE).chmod(CHMOD_EXEC))
+        .build()?;
+
+    let output = Command::new("visudo").arg("--strict").output(&env)?;
+
+    let diagnostic = r#"User_Alias "ADMINS" referenced but not defined"#;
+    let prompt = "What now?";
+
+    assert!(output.status().success());
+    assert_contains!(output.stderr(), diagnostic);
+    // we only get this prompt in `--strict` mode
+    assert_contains!(output.stdout()?, prompt);
+
+    let output = Command::new("visudo").output(&env)?;
+
+    assert!(output.status().success());
+    assert_contains!(output.stderr(), diagnostic);
+    assert_not_contains!(output.stdout()?, prompt);
+
+    Ok(())
+}
+
+#[test]
+fn alias_cycle() -> Result<()> {
+    let env = Env(["User_Alias FOO = FOO", "FOO ALL=(ALL:ALL) ALL"])
+        .file(DEFAULT_EDITOR, TextFile(EDITOR_TRUE).chmod(CHMOD_EXEC))
+        .build()?;
+
+    let output = Command::new("visudo").arg("--strict").output(&env)?;
+
+    let diagnostic = if sudo_test::is_original_sudo() {
+        r#"cycle in User_Alias "FOO""#
+    } else {
+        "syntax error: recursive alias: 'FOO'"
+    };
+    let prompt = "What now?";
+
+    assert!(output.status().success());
+    assert_contains!(output.stderr(), diagnostic);
+    // we only get this prompt in `--strict` mode
+    assert_contains!(output.stdout()?, prompt);
+
+    let output = Command::new("visudo").output(&env)?;
+
+    assert!(output.status().success());
+    assert_contains!(output.stderr(), diagnostic);
+    if sudo_test::is_original_sudo() {
+        assert_not_contains!(output.stdout()?, prompt);
+    } else {
+        // visudo-rs is always strict
+        assert_contains!(output.stdout()?, prompt);
+    }
+
+    Ok(())
+}