|
| 1 | +//! Loaded permissions tied to the actual OS sink, including precommit rotation denial. |
| 2 | +use super::{audit_config, module_peer}; |
| 3 | +#[cfg(unix)] |
| 4 | +use std::os::unix::fs::OpenOptionsExt; |
| 5 | +use std::{ |
| 6 | + fs::OpenOptions, |
| 7 | + path::{Path, PathBuf}, |
| 8 | + time::Duration, |
| 9 | +}; |
| 10 | +use tinybus::{Connection, broker::Broker, module::ModuleHost, transport::memory::MemoryBus}; |
| 11 | +use tinysecurity_bus::{ |
| 12 | + AccessTier, AuditCorrelation2, AuditedRequest2, CallerContext, Check, CheckAuditedResponse2, |
| 13 | + CheckRequest, ModuleConfig, Verdict, names, |
| 14 | +}; |
| 15 | + |
| 16 | +fn namespace() -> std::result::Result<(tempfile::TempDir, PathBuf), Box<dyn std::error::Error>> { |
| 17 | + #[cfg(unix)] |
| 18 | + let directory = tempfile::tempdir()?; |
| 19 | + #[cfg(windows)] |
| 20 | + let directory = tempfile::tempdir_in( |
| 21 | + std::env::var_os("TINYSECURITY_AUDIT_TEST_ROOT") |
| 22 | + .ok_or("audit namespace not provisioned")?, |
| 23 | + )?; |
| 24 | + #[cfg(windows)] |
| 25 | + provision(directory.path())?; |
| 26 | + #[cfg(unix)] |
| 27 | + let path = directory.path().canonicalize()?.join("audit"); |
| 28 | + #[cfg(windows)] |
| 29 | + let path = directory.path().join("audit"); |
| 30 | + let mut options = OpenOptions::new(); |
| 31 | + options.write(true).create_new(true); |
| 32 | + #[cfg(unix)] |
| 33 | + options.mode(0o600); |
| 34 | + options |
| 35 | + .open(path.with_file_name("audit.journal"))? |
| 36 | + .sync_all()?; |
| 37 | + #[cfg(unix)] |
| 38 | + { |
| 39 | + use std::os::unix::fs::PermissionsExt; |
| 40 | + let mode = std::fs::metadata(path.with_file_name("audit.journal"))? |
| 41 | + .permissions() |
| 42 | + .mode() |
| 43 | + & 0o777; |
| 44 | + eprintln!("audit-stage=native-journal-installer mode={mode}"); |
| 45 | + assert_eq!( |
| 46 | + mode, 0o600, |
| 47 | + "the fixture must restrict the authority before module initialization" |
| 48 | + ); |
| 49 | + } |
| 50 | + Ok((directory, path)) |
| 51 | +} |
| 52 | + |
| 53 | +#[cfg(windows)] |
| 54 | +fn provision(path: &Path) -> std::result::Result<(), Box<dyn std::error::Error>> { |
| 55 | + let script = r" |
| 56 | +$ErrorActionPreference = 'Stop' |
| 57 | +$identity = [Security.Principal.WindowsIdentity]::GetCurrent() |
| 58 | +$acl = [Security.AccessControl.DirectorySecurity]::new() |
| 59 | +$acl.SetOwner($identity.User) |
| 60 | +$acl.SetAccessRuleProtection($true, $false) |
| 61 | +$rule = [Security.AccessControl.FileSystemAccessRule]::new($identity.User, [Security.AccessControl.FileSystemRights]::FullControl, [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit', [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow) |
| 62 | +[void]$acl.AddAccessRule($rule) |
| 63 | +Set-Acl -LiteralPath $env:TINYSECURITY_NATIVE_DIRECTORY -AclObject $acl |
| 64 | +"; |
| 65 | + let output = std::process::Command::new("powershell.exe") |
| 66 | + .args(["-NoProfile", "-NonInteractive", "-Command", script]) |
| 67 | + .env("TINYSECURITY_NATIVE_DIRECTORY", path) |
| 68 | + .output()?; |
| 69 | + if !output.status.success() { |
| 70 | + return Err("native audit namespace installer failed".into()); |
| 71 | + } |
| 72 | + Ok(()) |
| 73 | +} |
| 74 | + |
| 75 | +fn request(tail: u64) -> AuditedRequest2<CheckRequest> { |
| 76 | + AuditedRequest2 { |
| 77 | + request: CheckRequest { |
| 78 | + caller: CallerContext { |
| 79 | + agent: "agent".into(), |
| 80 | + call_id: format!("bearer private-native-operation-{tail}"), |
| 81 | + tier: AccessTier::Full, |
| 82 | + ..Default::default() |
| 83 | + }, |
| 84 | + checks: vec![Check::LocalDiagnostic {}], |
| 85 | + }, |
| 86 | + audit: AuditCorrelation2 { |
| 87 | + event_id: format!("{:032x}", tail + 1), |
| 88 | + expected_tail: tail, |
| 89 | + generation: 1, |
| 90 | + }, |
| 91 | + } |
| 92 | +} |
| 93 | + |
| 94 | +pub(super) async fn verify(library: &Path) -> std::result::Result<(), Box<dyn std::error::Error>> { |
| 95 | + let (_directory, path) = namespace()?; |
| 96 | + let bus = MemoryBus::new(); |
| 97 | + let broker = Broker::new(); |
| 98 | + let task = broker.spawn(bus.clone()); |
| 99 | + let host = ModuleHost::new(broker); |
| 100 | + let client = Connection::connect(bus.connect().await?).await?; |
| 101 | + let mut audit = audit_config(true); |
| 102 | + audit.native_path = Some(path.to_str().ok_or("native fixture path encoding")?.into()); |
| 103 | + audit.max_bytes = 2048; |
| 104 | + host.load_file_with_config( |
| 105 | + library, |
| 106 | + serde_json::to_value(ModuleConfig { |
| 107 | + trusted_host: client.unique_name().map(|peer| peer.as_str().to_owned()), |
| 108 | + audit: Some(audit), |
| 109 | + ..Default::default() |
| 110 | + })?, |
| 111 | + )?; |
| 112 | + let module = module_peer(&client).await?; |
| 113 | + let proxy = client.proxy(module.as_str(), names::OBJECT_PATH, names::INTERFACE)?; |
| 114 | + assert!(proxy.attestation().await?.is_some()); |
| 115 | + let first: CheckAuditedResponse2 = proxy |
| 116 | + .call_confidential(names::methods::CHECK_AUDITED2, (request(0),)) |
| 117 | + .await?; |
| 118 | + assert!( |
| 119 | + first.audit.permitted |
| 120 | + && first.audit.committed |
| 121 | + && matches!(first.decision.decisions[0].verdict, Verdict::Allow) |
| 122 | + ); |
| 123 | + assert_eq!( |
| 124 | + proxy |
| 125 | + .call::<CheckAuditedResponse2>(names::methods::CHECK_AUDITED2, (request(0),)) |
| 126 | + .await?, |
| 127 | + first |
| 128 | + ); |
| 129 | + let journal = path.with_file_name("audit.journal"); |
| 130 | + assert!(std::fs::metadata(&journal)?.len() > 0); |
| 131 | + assert!( |
| 132 | + std::fs::read(&journal)? |
| 133 | + .windows(b"private-native-operation".len()) |
| 134 | + .all(|part| part != b"private-native-operation"), |
| 135 | + "the actual authority must contain sanitized data only" |
| 136 | + ); |
| 137 | + #[cfg(windows)] |
| 138 | + verify_rename_denial(&proxy, &path).await?; |
| 139 | + host.shutdown(Duration::from_secs(1)).await; |
| 140 | + task.abort(); |
| 141 | + println!("loaded required permission is backed by the actual restricted native journal"); |
| 142 | + Ok(()) |
| 143 | +} |
| 144 | + |
| 145 | +#[cfg(windows)] |
| 146 | +async fn verify_rename_denial( |
| 147 | + proxy: &tinybus::Proxy, |
| 148 | + path: &Path, |
| 149 | +) -> std::result::Result<(), Box<dyn std::error::Error>> { |
| 150 | + use std::os::windows::fs::OpenOptionsExt; |
| 151 | + let pin = OpenOptions::new().read(true).share_mode(3).open(path)?; |
| 152 | + let journal = path.with_file_name("audit.journal"); |
| 153 | + let mut blocked = None; |
| 154 | + for tail in 1..16 { |
| 155 | + let before = std::fs::read(&journal)?; |
| 156 | + let response: CheckAuditedResponse2 = proxy |
| 157 | + .call(names::methods::CHECK_AUDITED2, (request(tail),)) |
| 158 | + .await?; |
| 159 | + if !response.audit.permitted { |
| 160 | + assert!(!response.audit.committed && response.audit.receipt.is_none()); |
| 161 | + assert!( |
| 162 | + response |
| 163 | + .decision |
| 164 | + .decisions |
| 165 | + .iter() |
| 166 | + .all(|decision| !matches!(decision.verdict, Verdict::Allow)) |
| 167 | + ); |
| 168 | + assert_eq!( |
| 169 | + std::fs::read(&journal)?, |
| 170 | + before, |
| 171 | + "required denied rename must not journal the candidate" |
| 172 | + ); |
| 173 | + blocked = Some(tail); |
| 174 | + break; |
| 175 | + } |
| 176 | + assert!(response.audit.committed); |
| 177 | + } |
| 178 | + let tail = blocked.ok_or("required permission never reached blocked rotation")?; |
| 179 | + drop(pin); |
| 180 | + let permitted: CheckAuditedResponse2 = proxy |
| 181 | + .call(names::methods::CHECK_AUDITED2, (request(tail),)) |
| 182 | + .await?; |
| 183 | + assert!(permitted.audit.permitted && permitted.audit.committed); |
| 184 | + let receipt = permitted |
| 185 | + .audit |
| 186 | + .receipt |
| 187 | + .as_ref() |
| 188 | + .ok_or("native exact receipt absent")?; |
| 189 | + assert_eq!(receipt.new_tail, tail + 1); |
| 190 | + assert_eq!(receipt.events[0].event_id, request(tail).audit.event_id); |
| 191 | + assert_eq!( |
| 192 | + proxy |
| 193 | + .call::<CheckAuditedResponse2>(names::methods::CHECK_AUDITED2, (request(tail),)) |
| 194 | + .await?, |
| 195 | + permitted |
| 196 | + ); |
| 197 | + Ok(()) |
| 198 | +} |
0 commit comments