3 use MediaWiki\Shell\FirejailCommand
;
4 use MediaWiki\Shell\Shell
;
7 * Integration tests to ensure that firejail actually prevents execution.
8 * Meant to run on vagrant, although will probably work on other setups
9 * as long as firejail and sudo has similar config.
12 class FirejailCommandIntegrationTest
extends PHPUnit_Framework_TestCase
{
14 public function setUp() {
16 if ( Shell
::command( 'which', 'firejail' )->execute()->getExitCode() ) {
17 $this->markTestSkipped( 'firejail not installed' );
18 } elseif ( wfIsWindows() ) {
19 $this->markTestSkipped( 'test supports POSIX environments only' );
23 public function testSanity() {
24 // Make sure that firejail works at all.
25 $command = new FirejailCommand( 'firejail' );
27 ->unsafeParams( 'ls .' )
28 ->restrict( Shell
::RESTRICT_DEFAULT
);
29 $result = $command->execute();
30 $this->assertSame( 0, $result->getExitCode() );
35 * @dataProvider provideExecute
37 public function testExecute( $testCommand, $flag ) {
38 if ( preg_match( '/^sudo /', $testCommand ) ) {
39 if ( Shell
::command( 'sudo', '-n', 'ls', '/' )->execute()->getExitCode() ) {
40 $this->markTestSkipped( 'need passwordless sudo' );
44 $command = new FirejailCommand( 'firejail' );
46 ->unsafeParams( $testCommand )
47 // If we don't restrict at all, firejail won't be invoked,
48 // so the test will give a false positive if firejail breaks
49 // the command for some non-flag-related reason. Instead,
50 // set some flag that won't get in the way.
51 ->restrict( $flag === Shell
::NO_NETWORK ? Shell
::PRIVATE_DEV
: Shell
::NO_NETWORK
);
52 $result = $command->execute();
53 $this->assertSame( 0, $result->getExitCode(), 'sanity check' );
55 $command = new FirejailCommand( 'firejail' );
57 ->unsafeParams( $testCommand )
59 $result = $command->execute();
60 $this->assertNotSame( 0, $result->getExitCode(), 'real check' );
63 public function provideExecute() {
66 [ 'sudo -n ls /', Shell
::NO_ROOT
],
67 [ 'sudo -n ls /', Shell
::SECCOMP
], // not a great test but seems to work
68 [ 'ls /dev/cpu', Shell
::PRIVATE_DEV
],
69 [ 'curl -fsSo /dev/null https://wikipedia.org/', Shell
::NO_NETWORK
],
70 [ 'exec ls /', Shell
::NO_EXECVE
],
71 [ "cat $IP/LocalSettings.php", Shell
::NO_LOCALSETTINGS
],