mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run authelia's digest under a real shell, not the service user's nologin

Browse source
This commit is contained in:
atlas 2026-11-09 15:34:10 +01:00 • committed by mara
commit 2a0ebe35ba
1 changed files with 25 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/script-tests/oidc-client-secrets.nix
View file

@ -74,13 +74,13 @@ let
esac
'';
# Runs the command it is given, as util-linux's `script -qec <cmd> /dev/null`
# Runs the command it is given with `$SHELL -c`, as util-linux's `script -qec <cmd> /dev/null`
# does, without needing a pty in the build sandbox. The real pty is checked
# against the real authelia by hand.
fakeScript = pkgs.writeShellScriptBin "script" ''
echo "script $1 $3" >> "$FAKE_AUTHELIA_LOG"
[ "$1" = -qec ] || exit 99
exec ${pkgs.bash}/bin/bash -c "$2"
exec "$SHELL" -c "$2"
'';
in
pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
@ -88,7 +88,7 @@ pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
HELPER = pkgs.writeText "oidc-client-secrets.sh" (
import ../host-modules/lib/store-seeded-secret.nix { }
+ import ../host-modules/lib/atomic-write-secret.nix { }
+ import ../host-modules/lib/oidc-client-secrets.nix { }
+ import ../host-modules/lib/oidc-client-secrets.nix { shell = "${pkgs.bash}/bin/bash"; }
);
FAKE_BIN = pkgs.symlinkJoin {
name = "fake-bao-and-authelia";