Skip to content

Commit

Permalink
fix(pam/integration-tests): Fix potential failures depending on pam a…
Browse files Browse the repository at this point in the history
…rguments

Passing lots arguments to a pam library via the service file is not very much supported by older libpam libraries as the one we've in CI, so avoid failing on that by passing the same arguments to the exec-test client through a file when required.

Then increase the go timeout to allow tests to work in slower runners
  • Loading branch information
3v1n0 authored Sep 27, 2024
2 parents 908d67e + 1f50dd1 commit 8468a90
Show file tree
Hide file tree
Showing 5 changed files with 41 additions and 10 deletions.
9 changes: 5 additions & 4 deletions .github/workflows/qa.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ on:

env:
DEBIAN_FRONTEND: noninteractive
GO_TESTS_TIMEOUT: 20m
apt_deps: >-
libpam-dev
libglib2.0-dev
Expand Down Expand Up @@ -192,7 +193,7 @@ jobs:
# Overriding the default coverage directory is not an exported flag of go test (yet), so
# we need to override it using the test.gocoverdir flag instead.
#TODO: Update when https://go-review.googlesource.com/c/go/+/456595 is merged.
go test -cover -covermode=set ./... -coverpkg=./... -shuffle=on -args -test.gocoverdir="${raw_cov_dir}"
go test -timeout ${GO_TESTS_TIMEOUT} -cover -covermode=set ./... -coverpkg=./... -shuffle=on -args -test.gocoverdir="${raw_cov_dir}"
# Convert the raw coverage data into textfmt so we can merge the Rust one into it
go tool covdata textfmt -i="${raw_cov_dir}" -o="${cov_dir}/coverage.out"
Expand All @@ -208,7 +209,7 @@ jobs:
- name: Run tests (with race detector)
run: |
go test -race ./...
go test -timeout ${GO_TESTS_TIMEOUT} -race ./...
- name: Run PAM tests (with Address Sanitizer)
env:
Expand All @@ -218,10 +219,10 @@ jobs:
G_DEBUG: "fatal-criticals"
run: |
# Use `-dwarflocationlists` to give ASAN a better time to unwind the stack trace
go test -C ./pam/internal -asan -gcflags="-dwarflocationlists=true" ./...
go test -C ./pam/internal -asan -gcflags="-dwarflocationlists=true" -timeout ${GO_TESTS_TIMEOUT} ./...
pushd ./pam/integration-tests
go test -asan -gcflags="-dwarflocationlists=true" -c
go test -asan -gcflags="-dwarflocationlists=true" -timeout ${GO_TESTS_TIMEOUT} -c
# FIXME: Suppression may be removed with newer libpam, as the one we ship in ubuntu as some leaks
env LSAN_OPTIONS=suppressions=$(pwd)/lsan.supp \
./integration-tests.test \
Expand Down
11 changes: 11 additions & 0 deletions pam/integration-tests/cmd/exec-client/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"os"
"reflect"
"regexp"
"strings"

"github.com/godbus/dbus/v5"
"github.com/msteinert/pam/v2"
Expand All @@ -23,6 +24,7 @@ var (
pamFlags = flag.Int64("flags", 0, "pam flags")
serverAddress = flag.String("server-address", "", "the dbus connection address to use to communicate with module")
logFile = flag.String("client-log", "", "the file where to save logs")
argsFile = flag.String("client-args-file", "", "the file where arguments are saved")
)

func main() {
Expand Down Expand Up @@ -78,6 +80,15 @@ func mainFunc() error {
log.SetOutput(f)
}

if argsFile != nil && *argsFile != "" {
log.Debug(context.TODO(), "Reading arguments from %s", *argsFile)
ca, err := os.ReadFile(*argsFile)
if err != nil {
return err
}
args = append(args, strings.Split(string(ca), "\t")...)
}

actionFlags := pam.Flags(0)
if pamFlags != nil {
actionFlags = pam.Flags(*pamFlags)
Expand Down
14 changes: 13 additions & 1 deletion pam/integration-tests/exec_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -843,13 +843,24 @@ func getModuleArgs(t *testing.T, clientPath string, args []string) []string {
logFile := os.Stderr.Name()
if !testutils.IsVerbose() {
logFile = prepareFileLogging(t, "exec-module.log")
saveArtifactsForDebug(t, []string{logFile})
saveArtifactsForDebugOnCleanup(t, []string{logFile})
}
moduleArgs = append(moduleArgs, "--exec-log", logFile)

if clientPath != "" {
moduleArgs = append(moduleArgs, "--", clientPath)
moduleArgs = append(moduleArgs, "-client-log", logFile)

if len(strings.Join(append(moduleArgs, args...), " ")) > 768 {
// FIXME: If the number of arguments is too big, we may break old PAM.
// This is not required anymore when we can use libpam 1.6.0 in CI:
// https://github.com/linux-pam/linux-pam/pull/658
clientArgsPath := filepath.Join(t.TempDir(), "client-args-file")
require.NoError(t, os.WriteFile(clientArgsPath, []byte(strings.Join(args, "\t")), 0600),
"Setup: Creation of client args file failed")
saveArtifactsForDebugOnCleanup(t, []string{clientArgsPath})
return append(moduleArgs, "-client-args-file", clientArgsPath)
}
}
return append(moduleArgs, args...)
}
Expand Down Expand Up @@ -891,6 +902,7 @@ func preparePamTransactionForServiceFile(t *testing.T, serviceFile string, user
} else {
tx, err = pam.StartConfDir(filepath.Base(serviceFile), user, nil, filepath.Dir(serviceFile))
}
saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
require.NoError(t, err, "PAM: Error to initialize module")
require.NotNil(t, tx, "PAM: Transaction is not set")
t.Cleanup(func() { require.NoError(t, tx.End(), "PAM: can't end transaction") })
Expand Down
12 changes: 7 additions & 5 deletions pam/integration-tests/gdm_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -673,11 +673,11 @@ func TestGdmModule(t *testing.T) {
moduleArgs := []string{"socket=" + socketPath}

gdmLog := prepareFileLogging(t, "authd-pam-gdm.log")
t.Cleanup(func() { saveArtifactsForDebug(t, []string{gdmLog}) })
saveArtifactsForDebugOnCleanup(t, []string{gdmLog})
moduleArgs = append(moduleArgs, "debug=true", "logfile="+gdmLog)

serviceFile := createServiceFile(t, "gdm-authd", libPath,
moduleArgs)
serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
saveArtifactsForDebugOnCleanup(t, []string{serviceFile})

pamUser := "user-integration-" + strings.ReplaceAll(filepath.Base(t.Name()), "_", "-")
if tc.pamUser != nil {
Expand Down Expand Up @@ -788,10 +788,11 @@ func TestGdmModuleAuthenticateWithoutGdmExtension(t *testing.T) {
moduleArgs = append(moduleArgs, "socket="+socketPath)

gdmLog := prepareFileLogging(t, "authd-pam-gdm.log")
t.Cleanup(func() { saveArtifactsForDebug(t, []string{gdmLog}) })
saveArtifactsForDebugOnCleanup(t, []string{gdmLog})
moduleArgs = append(moduleArgs, "debug=true", "logfile="+gdmLog)

serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
pamUser := "user-integration-auth-no-gdm-extension"
gh := newGdmTestModuleHandler(t, serviceFile, pamUser)
t.Cleanup(func() { require.NoError(t, gh.tx.End(), "PAM: can't end transaction") })
Expand Down Expand Up @@ -830,10 +831,11 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) {
moduleArgs = append(moduleArgs, "socket="+socketPath)

gdmLog := prepareFileLogging(t, "authd-pam-gdm.log")
t.Cleanup(func() { saveArtifactsForDebug(t, []string{gdmLog}) })
saveArtifactsForDebugOnCleanup(t, []string{gdmLog})
moduleArgs = append(moduleArgs, "debug=true", "logfile="+gdmLog)

serviceFile := createServiceFile(t, "gdm-authd", libPath, moduleArgs)
saveArtifactsForDebugOnCleanup(t, []string{serviceFile})
pamUser := "user-integration-acctmgmt-no-gdm-extension"
gh := newGdmTestModuleHandler(t, serviceFile, pamUser)
t.Cleanup(func() { require.NoError(t, gh.tx.End(), "PAM: can't end transaction") })
Expand Down
5 changes: 5 additions & 0 deletions pam/integration-tests/helpers_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -51,3 +51,8 @@ func requirePreviousBrokerForUser(t *testing.T, socketPath string, brokerName st
}
require.Equal(t, prevBroker.PreviousBroker, prevBrokerID)
}

func saveArtifactsForDebugOnCleanup(t *testing.T, artifacts []string) {
t.Helper()
t.Cleanup(func() { saveArtifactsForDebug(t, artifacts) })
}

0 comments on commit 8468a90

Please sign in to comment.