improvements to acl-ptest

The acl tests assume that umask is 022 (or similar) by default for some of the permissions tests. The existing run-ptest script also assumes availability of gpasswd, which we tend to remove by default, and that the current filesystem supports ACLs. Fix this by adding a line to the test script for the umask, and making run-ptest use direct sed to alter /etc/group (it really does need to) and use a temporary filesystem. (This creates a requirement for mkfs.ext3, which may be a problem, but it works in our usual environment, so I figure I'll leave it that way for now?)

The following changes since commit 2fef37fab6967410aff33744c8843bcae028de56:

gcc: Security fix CVE-2016-4490 (2016-05-17 14:42:18 +0100)

are available in the git repository at:
git://git.yoctoproject.org/poky-contrib seebs/aclptest
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=seebs/aclptest

Peter Seebach (1):
acl.inc, run-ptest: improve ptest functionality on limited rootfs

 meta/recipes-support/attr/acl.inc                  |    1 +
 meta/recipes-support/attr/acl/run-ptest            |   67 ++++++++++++++++++--
 .../attr/acl/test-fix-directory-permissions.patch  |   24 +++++++
 3 files changed, 87 insertions(+), 5 deletions(-)
 create mode 100644 meta/recipes-support/attr/acl/test-fix-directory-permissions.patch

ACL's ptest has a handful of failure modes which can be triggered by a restrictive or small system. First, the ptest requires that daemon be in the bin group, which run-ptest attempts to do using gpasswd, but gpasswd is part of shadow, and oe-core removes shadow when it doesn't think shadow will be needed. Even if, say, a package has RDEPENDS on it. Whoops. So we manually sed the group file. This will probably work.

Second, the filesystem used for the test has to support ACLs, so we create a dummy ext3 filesystem and use that.

Third, the root/permissions test relies on the assumption that "mkdir d" produces a directory which non-root users can access, but in a secure product which defaults to umask 077, this doesn't work. (That fix has been separately reported to upstream acl through their bug report form.)

(This may prevent the test from running without mkfs.ext3, but it allows the test to run on targets where root doesn't have ACL support. Tradeoffs, tradeoffs everywhere.)

---
 meta/recipes-support/attr/acl.inc                  |    1 +
 meta/recipes-support/attr/acl/run-ptest            |   67 ++++++++++++++++++--
 .../attr/acl/test-fix-directory-permissions.patch  |   24 +++++++
 3 files changed, 87 insertions(+), 5 deletions(-)
 create mode 100644 meta/recipes-support/attr/acl/test-fix-directory-permissions.patch

index 198fb4f..aebebfd 100644
@@ -14,6 +14,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/acl/${BP}.src.tar.gz \
            file://acl-fix-the-order-of-expected-output-of-getfacl.patch \
            file://test-fix-insufficient-quoting-of.patch \
            file://test-fixups-on-SELinux-machines-for-root-testcases.patch \
+           file://test-fix-directory-permissions.patch \
 "
 
 require ea-acl.inc

new file mode 100644
index 0000000..cd4510c
@@ -0,0 +1,24 @@
+commit c45bae84817a70fef6c2b661a07a492a0d23ae85
+Author: Peter Seebach <[email protected]>
+Date:   Wed May 11 15:16:06 2016 -0500
+
+    Fix permissions on temporary directory
+
+    The temporary directory's permissions have to allow other users to
+    view the directory. A default umask of 022 is common, but not mandatory,
+    and secure systems may have more restrictive defaults.
+
+    Signed-off-by: Peter Seebach <[email protected]>
+
+diff --git a/test/root/permissions.test b/test/root/permissions.test
+index 42615f5..098b52a 100644
+--- a/test/root/permissions.test
++++ b/test/root/permissions.test
+@@ -16,6 +16,7 @@ Cry immediately if we are not running as root.
+ First, set up a temporary directory and create a regular file with
+ defined permissions.
+ 
++	$ umask 022
+ 	$ mkdir d
+ 	$ cd d
+ 	$ umask 027

1.7.1