23 lines
824 B
Bash
23 lines
824 B
Bash
#!/usr/bin/env bash
|
|
|
|
# Regression test for the NTFS mask used by the recovery volume. The 0177
|
|
# file mask removes owner execute plus every group/other permission, producing
|
|
# mode 0600 for the KeePass database and LUKS container.
|
|
set -Eeuo pipefail
|
|
|
|
readonly REPOSITORY_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
|
|
readonly VALIDATOR_PATH="${REPOSITORY_ROOT}/scripts/validate/k3s-local-recovery.sh"
|
|
|
|
# shellcheck source=/dev/null
|
|
source "$VALIDATOR_PATH"
|
|
|
|
readonly LIVE_SAFE_OPTIONS='rw,nosuid,nodev,noexec,relatime,uid=1000,gid=1000,dmask=0077,fmask=0177,iocharset=utf8'
|
|
|
|
if ! _k3slrv_outer_masks_secure "$LIVE_SAFE_OPTIONS"; then
|
|
printf '%s\n' \
|
|
'TEST FAILURE: recovery validator rejected secure fmask=0177' >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s\n' 'PASS: recovery validator accepts secure fmask=0177'
|