Files
diskless-workstation/files/agent/snapshot_test.go
T
Audiobuzz 4ca0b6dd06 agent: read chrony status from tracking.log instead of the command socket
Bench on comet-beacon-54 proved every command-socket route is blocked for the
hardened agent: chronyd's unix socket is owner-write-only (0755, so even a
chrony-group member can't connect), and STIG closes the UDP command port
(cmdport 0). Rather than re-open a port or expose chrony's privileged socket,
enable chronyd's tracking log and have the agent READ it — no port, no socket,
no group, no SELinux domain transition, full hardening intact.

- chrony.conf: enable 'log tracking' (idempotent) so chronyd appends
  source/stratum/offset to /var/log/chrony/tracking.log. Write volume is a ~130B
  line per clock update (backing off to ~maxpoll when stable) and capped by the
  chrony RPM's logrotate — negligible on the RAM overlay. cmdport 0 stays, so no
  STIG deviation.
- agent: chronyTracking() now reads the last data line of tracking.log via
  parseTrackingLog() (source f[2], stratum f[3], offset f[6], leap/sync f[7]);
  replaces the chronyc exec + parseChrony. Unit test swapped accordingly.
- revert the two abandoned approaches: drop the bindcmdaddress line (394ad10)
  and the fleet_agent_chronyc SELinux nnp_transition module + provisioner block
  (e6fd4a2, .te deleted) — no chronyc exec means no transition to allow. Removed
  stig-deviations #16 and #17 (both waivers no longer needed).

Needs a workstation image rebuild + reboot. BENCH-VERIFY: tracking.log is
world-readable so the DynamicUser agent can read it; under enforcing
unconfined_service_t can read chronyd_var_log_t (add a minimal file-read allow
if denied); and the offset sign matches chronyc on a synced host.
2026-07-10 09:36:37 +00:00

154 lines
4.8 KiB
Go

package main
import (
"math"
"os"
"testing"
)
func approx(a, b float64) bool { return math.Abs(a-b) < 0.01 }
func TestParseLoadAvg(t *testing.T) {
got := parseLoadAvg([]byte("0.42 0.31 0.19 1/234 5678\n"))
if !approx(got, 0.42) {
t.Fatalf("load = %v, want 0.42", got)
}
if v := parseLoadAvg([]byte("")); v != 0 {
t.Fatalf("empty load = %v, want 0", v)
}
}
func TestParseCPUStat(t *testing.T) {
total, idle, ok := parseCPUStat([]byte("cpu 100 0 50 800 50 0 0 0 0 0\ncpu0 1 2 3 4\n"))
if !ok {
t.Fatal("parseCPUStat not ok")
}
// total = 100+0+50+800+50 = 1000; idle = idle(800)+iowait(50) = 850.
if total != 1000 || idle != 850 {
t.Fatalf("total=%d idle=%d, want 1000/850", total, idle)
}
}
func TestCPUBusyPct(t *testing.T) {
// From (total 1000, idle 850) to (total 1100, idle 900): dTotal=100, dIdle=50
// → busy = 50/100 = 50%.
if got := cpuBusyPct(1000, 850, 1100, 900); !approx(got, 50) {
t.Fatalf("busy = %v, want 50", got)
}
// No forward progress → 0 (guards a counter reset / same sample).
if got := cpuBusyPct(1000, 850, 1000, 850); got != 0 {
t.Fatalf("no-delta busy = %v, want 0", got)
}
// idle jumping more than total is clamped, never negative.
if got := cpuBusyPct(1000, 850, 1100, 1000); got != 0 {
t.Fatalf("clamped busy = %v, want 0", got)
}
}
func TestParseMemUsedPct(t *testing.T) {
// total 1000, available 250 → used 75%.
mem := []byte("MemTotal: 1000 kB\nMemFree: 100 kB\nMemAvailable: 250 kB\n")
if got := parseMemUsedPct(mem); !approx(got, 75) {
t.Fatalf("mem used = %v, want 75", got)
}
if got := parseMemUsedPct([]byte("garbage")); got != 0 {
t.Fatalf("garbage mem = %v, want 0", got)
}
}
func TestParseUptime(t *testing.T) {
if got := parseUptime([]byte("12345.67 98765.43\n")); got != 12345 {
t.Fatalf("uptime = %d, want 12345", got)
}
if got := parseUptime([]byte("")); got != 0 {
t.Fatalf("empty uptime = %d, want 0", got)
}
if got := parseUptime([]byte("garbage")); got != 0 {
t.Fatalf("garbage uptime = %d, want 0", got)
}
}
func TestParseTrackingLog(t *testing.T) {
// A realistic tracking.log: banner + header + two data lines. parseTrackingLog
// must take the LAST data line, skip banner/header, and read source/stratum/offset.
log := `====================================================================
Date (UTC) Time IP Address St Freq ppm Skew ppm Offset L Co Offset sd
====================================================================
2026-07-10 05:59:00 192.168.50.10 3 -1.234 0.100 +0.000002000 N 4 1.0e-07
2026-07-10 06:00:00 192.168.50.10 3 -1.250 0.090 -0.000012345 N 4 1.0e-07
`
c := parseTrackingLog([]byte(log))
if c.state != "synced" {
t.Errorf("state = %q, want synced", c.state)
}
if c.source != "192.168.50.10" {
t.Errorf("source = %q, want 192.168.50.10", c.source)
}
if c.stratum != 3 {
t.Errorf("stratum = %d, want 3", c.stratum)
}
// last line's Offset is -0.000012345 (sign-sensitive: must not read the +2e-6 above).
if c.offset >= 0 || math.Abs(c.offset+0.000012345) > 1e-9 {
t.Errorf("offset = %v, want -0.000012345", c.offset)
}
// unsynchronised reference: L='?' and 0.0.0.0 source.
uns := "2026-07-10 06:01:00 0.0.0.0 0 0.000 0.000 +0.000000000 ? 0 0.0e+00\n"
if c := parseTrackingLog([]byte(uns)); c.state != "unsynced" || c.source != "" {
t.Errorf("unsynced parse = %+v, want state=unsynced source=''", c)
}
// empty / header-only -> zero chrony{}.
if c := parseTrackingLog([]byte(" Date (UTC) Time IP Address\n")); c.state != "" {
t.Errorf("header-only parse = %+v, want zero", c)
}
}
func TestParseHandle(t *testing.T) {
for _, tc := range []struct {
in string
want uint32
bad bool
}{
{"0x81000100", 0x81000100, false},
{"81000100", 0x81000100, false},
{"0X01800100", 0x01800100, false},
{"nope", 0, true},
} {
h, err := parseHandle(tc.in)
if tc.bad {
if err == nil {
t.Errorf("parseHandle(%q) = %#x, want error", tc.in, uint32(h))
}
continue
}
if err != nil || uint32(h) != tc.want {
t.Errorf("parseHandle(%q) = %#x, %v; want %#x", tc.in, uint32(h), err, tc.want)
}
}
}
func TestHostOf(t *testing.T) {
for _, tc := range []struct{ in, want string }{
{"diskless-server.bitasylum.org:9600", "diskless-server.bitasylum.org"},
{"host", "host"},
{"[2001:db8::1]:9600", "2001:db8::1"},
} {
if got := hostOf(tc.in); got != tc.want {
t.Errorf("hostOf(%q) = %q, want %q", tc.in, got, tc.want)
}
}
}
func TestReadKioskURL(t *testing.T) {
dir := t.TempDir()
f := dir + "/kiosk.env"
if err := os.WriteFile(f, []byte("# comment\nKIOSK_URL=\"http://boot.fleet.lab/kiosk/\"\nOTHER=x\n"), 0o644); err != nil {
t.Fatal(err)
}
if got := readKioskURL(f); got != "http://boot.fleet.lab/kiosk/" {
t.Fatalf("kiosk url = %q", got)
}
if got := readKioskURL(dir + "/missing"); got != "" {
t.Fatalf("missing kiosk env = %q, want empty", got)
}
}