mirror of
https://github.com/uutils/shadow.git
synced 2026-10-16 02:48:14 -07:00
Pierre Warnier
acc1771bc2
The only PAM coverage was the deployment image authenticating a real account. That cannot exercise a *refusal* without relying on a wrong password being wrong, and it cannot tell a refusal apart from a conversation that never reached the stack -- which is exactly the failure that broke password changes earlier this week and took three rounds to find. The glibc images now define two throwaway services, one backed by pam_permit and one by pam_deny, and shadow-core tests the wrapper against both: the permit stack authenticates and passes account management, the deny stack refuses with the stack's own answer rather than a conversation error, and a service with no configuration at all does not authenticate. The tests skip where the services are absent, which is any machine but the containers. CI also gains an all-features clippy pass. The completions feature and the shadow-core feature gates were compiled by no job, so a lint or a compile error in them could reach main unnoticed. make check runs it too.
50 lines
2.3 KiB
Docker
50 lines
2.3 KiB
Docker
# shadow-rs development image — Alpine 3.23 (musl libc)
|
|
#
|
|
# PAM: linux-pam-dev (Linux-PAM, not OpenPAM)
|
|
# SELinux: not available (Alpine doesn't ship SELinux)
|
|
# Default shell: /bin/ash (busybox)
|
|
# Shadow-utils package: shadow
|
|
# Note: musl libc — different from glibc. Tests NSS/getpwent differences.
|
|
# No SELinux. Busybox shadow-utils may differ from GNU shadow-utils.
|
|
|
|
# Pinned: see the note in Dockerfile.debian.
|
|
FROM rust:1.98-alpine3.23
|
|
|
|
RUN apk add --no-cache \
|
|
musl-dev \
|
|
linux-pam-dev \
|
|
linux-headers \
|
|
pkgconf \
|
|
shadow \
|
|
bash \
|
|
curl
|
|
|
|
RUN rustup component add clippy rustfmt
|
|
# Two throwaway PAM services so the PAM wrapper can be tested against a stack
|
|
# whose answer is known. Without them the only coverage is the end-to-end image
|
|
# authenticating a real account, which cannot exercise a *refusal* without
|
|
# depending on a wrong password being wrong.
|
|
RUN printf 'auth required pam_permit.so\naccount required pam_permit.so\npassword required pam_permit.so\nsession required pam_permit.so\n' > /etc/pam.d/shadow-rs-test-permit \
|
|
&& printf 'auth required pam_deny.so\naccount required pam_deny.so\npassword required pam_deny.so\nsession required pam_deny.so\n' > /etc/pam.d/shadow-rs-test-deny
|
|
|
|
|
|
# cargo-deny: pinned, checksum-verified prebuilt binary. The static musl build
|
|
# runs on glibc too, so every image shares one asset. Installing the binary
|
|
# (instead of `cargo install cargo-deny`) skips a multi-minute source compile.
|
|
ARG CARGO_DENY_VERSION=0.19.8
|
|
ARG CARGO_DENY_SHA256=70e769ae3872e34d45132b17040859175e11401dc12dddb0303e0b8c7d088f3f
|
|
RUN curl -LsSf "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz" -o /tmp/cargo-deny.tar.gz \
|
|
&& echo "${CARGO_DENY_SHA256} /tmp/cargo-deny.tar.gz" | sha256sum -c - \
|
|
&& tar zxf /tmp/cargo-deny.tar.gz -C /tmp \
|
|
&& install -m 0755 "/tmp/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny" /usr/local/cargo/bin/cargo-deny \
|
|
&& rm -rf /tmp/cargo-deny.tar.gz "/tmp/cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl" \
|
|
&& cargo-deny --version
|
|
|
|
RUN adduser -D -s /bin/bash testuser \
|
|
&& adduser -D -s /bin/sh testuser2 \
|
|
&& addgroup testgroup \
|
|
&& addgroup testuser testgroup
|
|
|
|
WORKDIR /workspace
|
|
CMD ["/bin/bash"]
|