From ff94e562a0c3e10c05fbead70e27215ace47b1d2 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Feb 06 2019 00:19:28 +0000
Subject: Ticket 50197 - Container integration improvements


Bug Description: During the container integration process
I have noticed a small number of remaining issues.

Fix Description:
* dm password is left as randomised in container install
* nss_ssl only removes dir content, not the directory itself
* basic tests rely on incorrect assumptions about file perms,
  hostnames and ports.

https://pagure.io/389-ds-base/issue/50197

Author: William Brown <william@blackhats.net.au>

Review by: spichugi (Thanks!)

---

diff --git a/dirsrvtests/tests/suites/basic/basic_test.py b/dirsrvtests/tests/suites/basic/basic_test.py
index 50b5dc0..652129f 100644
--- a/dirsrvtests/tests/suites/basic/basic_test.py
+++ b/dirsrvtests/tests/suites/basic/basic_test.py
@@ -21,6 +21,9 @@ from lib389.dbgen import dbgen
 from lib389.idm.organizationalunit import OrganizationalUnits
 from lib389._constants import DN_DM, PASSWORD, PW_DM
 from lib389.topologies import topology_st
+from lib389.paths import Paths
+
+default_paths = Paths()
 
 log = logging.getLogger(__name__)
 
@@ -1143,6 +1146,8 @@ def test_ticketldbm_audit(topology_st):
         assert audit_pattern_found(inst, regex)
 
 
+@pytest.mark.skipif(not get_user_is_root() or not default_paths.perl_enabled,
+                    reason="This test is only required if perl is enabled, and requires root.")
 def test_dscreate(request):
     """Test that dscreate works, we need this for now until setup-ds.pl is
     fully discontinued.
@@ -1157,16 +1162,26 @@ def test_dscreate(request):
         2. Should succeeds
     """
 
-    template_file = "dssetup.inf"
+    template_file = "/tmp/dssetup.inf"
     template_text = """[general]
 config_version = 2
+# This invalid hostname ...
 full_machine_name = localhost.localdomain
-
+# Means we absolutely require this.
+strict_host_checking = False
+# In tests, we can be run in containers, NEVER trust
+# that systemd is there, or functional in any capacity
+systemd = False
 
 [slapd]
 instance_name = test_dscreate
 root_dn = cn=directory manager
 root_password = someLongPassword_123
+# We do not have access to high ports in containers,
+# so default to something higher.
+port = 38999
+secure_port = 63699
+
 
 [backend-userroot]
 suffix = dc=example,dc=com
@@ -1175,10 +1190,13 @@ sample_entries = yes
 
     with open(template_file, "w") as template_fd:
         template_fd.write(template_text)
-    cmd = 'dscreate from-file ' + template_file
 
     try:
-        subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT)
+        subprocess.check_call([
+            'dscreate',
+            'from-file',
+            template_file
+        ])
     except subprocess.CalledProcessError as e:
         log.fatal("dscreate failed!  Error ({}) {}".format(e.returncode, e.output))
         assert False
@@ -1186,7 +1204,7 @@ sample_entries = yes
     def fin():
         os.remove(template_file)
         try:
-            subprocess.check_output('dsctl test_dscreate remove --do-it', shell=True)
+            subprocess.check_call(['dsctl', 'test_dscreate', 'remove', '--do-it'])
         except subprocess.CalledProcessError as e:
             log.fatal("Failed to remove test instance  Error ({}) {}".format(e.returncode, e.output))
 
diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index c0aa608..423a1db 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -896,6 +896,7 @@ class SetupDs(object):
         ds_instance.config.set('nsslapd-ldapiautobind', 'on')
         ds_instance.config.set('nsslapd-ldapimaprootdn', slapd['root_dn'])
 
+
         # Create all required sasl maps: if we have a single backend ...
         # our default maps are really really bad, and we should feel bad.
         # they basically only work with a single backend, and they'll break
@@ -921,14 +922,11 @@ class SetupDs(object):
             self.log.debug("Skipping default SASL maps - no backend found!")
 
         # Complete.
-        # Change the root password finally
-        ds_instance.config.set('nsslapd-rootpw',
-                               ensure_str(slapd['root_password']))
-
         if self.containerised:
             # In a container build we need to stop DirSrv at the end
             ds_instance.stop()
         else:
+            # If we are not a container, change the root password finally
+            ds_instance.config.set('nsslapd-rootpw', slapd['root_password'])
             # Restart for changes to take effect - this could be removed later
             ds_instance.restart(post_open=False)
-
diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index ccd15d0..5f225c0 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -165,9 +165,6 @@ class NssSsl(object):
             except FileNotFoundError:
                 pass
 
-        if os.path.isdir(self._certdb) and not os.listdir(self._certdb):
-            os.removedirs(self._certdb)
-
         assert not self._db_exists()
         return True
 
diff --git a/src/lib389/lib389/utils.py b/src/lib389/lib389/utils.py
index de3c5b7..afc8951 100644
--- a/src/lib389/lib389/utils.py
+++ b/src/lib389/lib389/utils.py
@@ -1215,6 +1215,13 @@ def get_user_is_ds_owner():
         return True
     return False
 
+def get_user_is_root():
+    cur_uid = os.getuid()
+    if cur_uid == 0:
+        # We are root, we have permission
+        return True
+    return False
+
 def basedn_to_ldap_dns_uri(basedn):
     #  ldap:///dc%3Dexample%2Cdc%3Dcom
     return "ldaps:///" + basedn.replace("=", "%3D").replace(",", "%2C")