|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const common = require('../common'); |
| 4 | +const { spawn, spawnSync } = require('node:child_process'); |
| 5 | +const { createInterface } = require('node:readline'); |
| 6 | +const assert = require('node:assert'); |
| 7 | + |
| 8 | +if (!common.hasCrypto) |
| 9 | + common.skip('missing crypto'); |
| 10 | +if (!common.isLinux) |
| 11 | + common.skip('linux only'); |
| 12 | +if (spawnSync('strace').error !== undefined) { |
| 13 | + common.skip('missing strace'); |
| 14 | +} |
| 15 | + |
| 16 | +{ |
| 17 | + const allowedOpenCalls = new Set([ |
| 18 | + '/etc/ssl/openssl.cnf', |
| 19 | + ]); |
| 20 | + const strace = spawn('strace', [ |
| 21 | + '-f', '-ff', |
| 22 | + '-e', 'trace=openat', |
| 23 | + '-s', '128', |
| 24 | + '-D', process.execPath, '-e', 'require("crypto")', |
| 25 | + ]); |
| 26 | + |
| 27 | + // stderr is the default for strace |
| 28 | + const rl = createInterface({ input: strace.stderr }); |
| 29 | + rl.on('line', (line) => { |
| 30 | + if (!line.startsWith('openat')) { |
| 31 | + return; |
| 32 | + } |
| 33 | + |
| 34 | + const file = line.match(/"(.*?)"/)[1]; |
| 35 | + // skip .so reading attempt |
| 36 | + if (file.match(/.+\.so(\.?)/) !== null) { |
| 37 | + return; |
| 38 | + } |
| 39 | + assert(allowedOpenCalls.delete(file), `${file} is not in the list of allowed openat calls`); |
| 40 | + }); |
| 41 | + |
| 42 | + strace.on('error', common.mustNotCall()); |
| 43 | + strace.on('exit', common.mustCall((code) => { |
| 44 | + assert.strictEqual(code, 0); |
| 45 | + const missingKeys = Array.from(allowedOpenCalls.keys()); |
| 46 | + if (missingKeys.length) { |
| 47 | + assert.fail(`The following openat call are missing: ${missingKeys.join(',')}`); |
| 48 | + } |
| 49 | + })); |
| 50 | +} |
0 commit comments