From 412edf89825b241cecdebf896b0096d87559a671 Mon Sep 17 00:00:00 2001
From: Michal Nowak <mnowak@isc.org>
Date: Wed, 27 Nov 2019 11:52:08 +0000
Subject: [PATCH] Verifying that named switches UID

This test runs only under root, which is required for the user-switch
`-u` option to work.

Closes #537.

(cherry picked from commit b00360537eae440f03ee47e9779ceeecd491dba7)
---
 bin/tests/system/conf.sh.in                   |  4 +++
 bin/tests/system/runtime/clean.sh             |  1 +
 .../system/runtime/ns2/named-alt9.conf.in     | 18 +++++++++++
 bin/tests/system/runtime/tests.sh             | 30 +++++++++++++++++++
 util/copyrights                               |  1 +
 5 files changed, 54 insertions(+)
 create mode 100644 bin/tests/system/runtime/ns2/named-alt9.conf.in

diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 60c8f68edf..6d196b209e 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -22,6 +22,9 @@ DEFAULT_ALGORITHM=RSASHA256
 DEFAULT_ALGORITHM_NUMBER=8
 DEFAULT_BITS=1280
 
+# Provide TMPDIR variable for tests that need it.
+TMPDIR=${TMPDIR:-/tmp}
+
 # must be different from DEFAULT_ALGORITHM
 ALTERNATIVE_ALGORITHM=RSASHA1
 ALTERNATIVE_ALGORITHM_NUMBER=5
@@ -508,3 +511,4 @@ export RRCHECKER
 export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
+export TMPDIR
diff --git a/bin/tests/system/runtime/clean.sh b/bin/tests/system/runtime/clean.sh
index e98d0f3c03..896e20f502 100644
--- a/bin/tests/system/runtime/clean.sh
+++ b/bin/tests/system/runtime/clean.sh
@@ -18,3 +18,4 @@ rm -f rndc.out*
 [ -d ns2/nope ] && chmod 755 ns2/nope
 rm -rf ns2/nope
 rm -f ns2/dir ns2/nopedir ns2/mkd ns2/nopemkd
+rm -rf ns2/tmp.*
diff --git a/bin/tests/system/runtime/ns2/named-alt9.conf.in b/bin/tests/system/runtime/ns2/named-alt9.conf.in
new file mode 100644
index 0000000000..7a5cb244e8
--- /dev/null
+++ b/bin/tests/system/runtime/ns2/named-alt9.conf.in
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named9.pid";
+	listen-on { 127.0.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+};
diff --git a/bin/tests/system/runtime/tests.sh b/bin/tests/system/runtime/tests.sh
index e515f2ac45..5c77a9cabb 100644
--- a/bin/tests/system/runtime/tests.sh
+++ b/bin/tests/system/runtime/tests.sh
@@ -1,3 +1,5 @@
+#!/bin/sh
+#
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
@@ -149,5 +151,33 @@ cd ..
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "verifying that named switches UID ($n)"
+if [ "`id -u`" = 0 ] && [ ! "$CYGWIN" ]; then
+    ret=0
+    TEMP_NAMED_DIR=`mktemp -d`
+    if [ -d "${TEMP_NAMED_DIR}" ]; then
+        copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
+        export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
+        sh -x "$TOP/util/prepare-softhsm2.sh"
+        chown -R nobody "${TEMP_NAMED_DIR}"
+        chmod 0700 "${TEMP_NAMED_DIR}"
+        ( cd "${TEMP_NAMED_DIR}" && $NAMED -u nobody -c named-alt9.conf -d 99 -g -U 4 >> named9.run 2>&1 & )
+        sleep 2
+        [ -s "${TEMP_NAMED_DIR}/named9.pid" ] || ret=1
+        grep "loading configuration: permission denied" "${TEMP_NAMED_DIR}/named9.run" > /dev/null && ret=1
+        pid=`cat "${TEMP_NAMED_DIR}/named9.pid" 2>/dev/null`
+        test "${pid:+set}" = set && $KILL -15 "${pid}" >/dev/null 2>&1
+        mv "${TEMP_NAMED_DIR}" ns2/
+    else
+        echo_i "mktemp failed"
+        ret=1
+    fi
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=`expr $status + $ret`
+else
+    echo_i "skipped, not running as root or running on Windows"
+fi
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
diff --git a/util/copyrights b/util/copyrights
index 07e271d8f4..b5863d94c0 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2210,6 +2210,7 @@
 ./bin/tests/system/runtime/ns2/named-alt4.conf.in	CONF-C	2014,2016,2017,2018,2019
 ./bin/tests/system/runtime/ns2/named-alt5.conf.in	CONF-C	2014,2016,2017,2018,2019
 ./bin/tests/system/runtime/ns2/named-alt6.conf.in	CONF-C	2014,2016,2017,2018,2019
+./bin/tests/system/runtime/ns2/named-alt9.conf.in	CONF-C	2019
 ./bin/tests/system/runtime/ns2/named1.conf.in	CONF-C	2014,2016,2017,2018,2019
 ./bin/tests/system/runtime/setup.sh		SH	2015,2016,2017,2018,2019
 ./bin/tests/system/runtime/tests.sh		SH	2014,2015,2016,2017,2018,2019