From ff917813a8d13e44d87f8eee83a28363f2d69672 Mon Sep 17 00:00:00 2001 From: fuleyi Date: Wed, 19 Aug 2026 10:57:15 +0800 Subject: [PATCH] fix: make authorization tests independent of host PIDs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Inject the process start-time reader into allowCallerRegistry. 2. Keep getProcessStartTime as the production implementation. 3. Stub start-time reads in tests to remove /proc PID dependencies. Log: No user-facing changes Influence: 1. Run locale-helper tests in an isolated PID namespace. 2. Verify non-root authorization still detects PID reuse. 3. Build the package on architectures using isolated build workers. fix: 修复授权测试依赖构建机进程的问题 1. 为 allowCallerRegistry 注入进程启动时间读取函数。 2. 生产环境仍使用 getProcessStartTime 读取 /proc。 3. 测试使用固定启动时间，消除对构建机 PID 的依赖。 Log: 无用户可见变化 Influence: 1. 在隔离 PID 命名空间中运行 locale-helper 测试。 2. 验证非 root 授权仍能检测 PID 复用。 3. 在使用隔离构建容器的各架构上执行软件包构建。 PMS: TASK-393313 --- locale-helper/allow_caller.go | 10 ++++++---- locale-helper/allow_caller_test.go | 6 +++++- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/locale-helper/allow_caller.go b/locale-helper/allow_caller.go index ddc3492..c0dc25c 100644 --- a/locale-helper/allow_caller.go +++ b/locale-helper/allow_caller.go @@ -57,7 +57,7 @@ type persistedCallerEntry struct { } type persistedAllowCallers struct { - BusID string `json:"busId"` + BusID string `json:"busId"` Callers []persistedCallerEntry `json:"callers"` } @@ -71,6 +71,7 @@ type allowCallerRegistry struct { stateFile string busID string privilegedGroupID uint32 + processStartTime func(uint32) (uint64, error) processGroups func(uint32) ([]uint32, error) processParent func(uint32) (uint32, error) @@ -127,6 +128,7 @@ func newAllowCallerRegistryWithConfig(service allowCallerBus, stateFile string, stateFile: stateFile, busID: busID, privilegedGroupID: privilegedGroupID, + processStartTime: getProcessStartTime, processGroups: getProcessGroups, processParent: getProcessParentPID, callers: make(map[string]callerInfo), @@ -336,7 +338,7 @@ func (r *allowCallerRegistry) authorizeRegistrar(sender dbus.Sender, uniqueName } // Capture starttime before reading /proc to detect PID reuse (TOCTOU mitigation). - senderStartTime, err := getProcessStartTime(senderPID) + senderStartTime, err := r.processStartTime(senderPID) if err != nil { return fmt.Errorf("get sender %s start time failed: %w", sender, err) } @@ -347,7 +349,7 @@ func (r *allowCallerRegistry) authorizeRegistrar(sender dbus.Sender, uniqueName } // Verify PID was not recycled during /proc access. - checkStartTime, err := getProcessStartTime(senderPID) + checkStartTime, err := r.processStartTime(senderPID) if err != nil || checkStartTime != senderStartTime { return fmt.Errorf("sender %s PID %d reused during authorization", sender, senderPID) } @@ -525,4 +527,4 @@ func (r *allowCallerRegistry) load() error { } r.mu.Unlock() return nil -} \ No newline at end of file +} diff --git a/locale-helper/allow_caller_test.go b/locale-helper/allow_caller_test.go index cc8cebc..e702baf 100644 --- a/locale-helper/allow_caller_test.go +++ b/locale-helper/allow_caller_test.go @@ -68,6 +68,9 @@ func newRegistryForTest(t *testing.T, bus *mockAllowCallerBus) *allowCallerRegis require.NoError(t, err) require.NotNil(t, r) require.Equal(t, bus.busID, r.busID) + r.processStartTime = func(uint32) (uint64, error) { + return 1, nil + } return r } @@ -218,6 +221,7 @@ func TestNewAllowCallerRegistryWithConfig(t *testing.T) { assert.Equal(t, uint32(42), r.privilegedGroupID) assert.NotNil(t, r.callers) assert.Len(t, r.callers, 0) + assert.NotNil(t, r.processStartTime) assert.NotNil(t, r.processGroups) assert.NotNil(t, r.processParent) }) @@ -692,4 +696,4 @@ func TestLookupGroupID(t *testing.T) { gid, err := lookupGroupID("root") require.NoError(t, err) assert.Equal(t, uint32(0), gid) -} \ No newline at end of file +}