diff --git a/web/app/Actions/CreateLinuxWebUser.php b/web/app/Actions/CreateLinuxWebUser.php index d6a9474..9a3c9d2 100644 --- a/web/app/Actions/CreateLinuxWebUser.php +++ b/web/app/Actions/CreateLinuxWebUser.php @@ -38,6 +38,12 @@ class CreateLinuxWebUser $command = 'sudo echo '.$username.':'.$password.' | chpasswd -e'; $output .= shell_exec($command); + $homeDir = '/home'; + if (substr(sprintf('%o', fileperms($homeDir)), -4) !== '0711') { + $command = 'sudo chmod 711 /home'; + $output .= shell_exec($command); + } + $command = 'sudo chmod 711 /home/'.$username; $output .= shell_exec($command); diff --git a/web/tests/Unit/SecurityTest.php b/web/tests/Unit/SecurityTest.php index 4be0a77..732f706 100644 --- a/web/tests/Unit/SecurityTest.php +++ b/web/tests/Unit/SecurityTest.php @@ -77,6 +77,11 @@ class SecurityTest extends ActionTestCase $hostingSubscription = $callHostingSubscriptionStoreResponse['data']['hostingSubscription']; // Check user home dir permissions + $homeDir = '/home'; + $this->assertDirectoryExists($homeDir); + $getHomeDirPermission = substr(sprintf('%o', fileperms($homeDir)), -4); + $this->assertSame('0711', $getHomeDirPermission); + $userHomeDir = '/home/' . $hostingSubscription['system_username']; $this->assertDirectoryExists($userHomeDir); $getUserHomeDirPermission = substr(sprintf('%o', fileperms($userHomeDir)), -4); @@ -109,18 +114,18 @@ class SecurityTest extends ActionTestCase $this->assertTrue($callHostingSubscriptionStoreResponse['status'] == 'ok'); $secondHostingSubscription = $callHostingSubscriptionStoreResponse['data']['hostingSubscription']; -// // Try to open /home directory with linux user -// $output = shell_exec("sudo -H -u ".$hostingSubscription['system_username']." bash -c 'ls -la /home'"); -// $this->assertSame($output, null); -// -// // Try to open /home/$user with linux user -// $output = shell_exec("sudo -H -u ".$hostingSubscription['system_username']." bash -c 'ls -la /home/".$hostingSubscription['system_username']."'"); -// $this->assertTrue(str_contains($output, 'public_html')); -// $this->assertTrue(str_contains($output, $hostingSubscription['system_username'])); -// -// // Try to open /home/$user directory with another linux user -// $output = shell_exec("sudo -H -u ".$secondHostingSubscription['system_username']." bash -c 'ls -la /home/".$hostingSubscription['system_username']."'"); -// $this->assertSame($output, null); + // Try to open /home directory with linux user + $output = shell_exec("sudo -H -u ".$hostingSubscription['system_username']." bash -c 'ls -la /home'"); + $this->assertSame($output, null); + + // Try to open /home/$user with linux user + $output = shell_exec("sudo -H -u ".$hostingSubscription['system_username']." bash -c 'ls -la /home/".$hostingSubscription['system_username']."'"); + $this->assertTrue(str_contains($output, 'public_html')); + $this->assertTrue(str_contains($output, $hostingSubscription['system_username'])); + + // Try to open /home/$user directory with another linux user + $output = shell_exec("sudo -H -u ".$secondHostingSubscription['system_username']." bash -c 'ls -la /home/".$hostingSubscription['system_username']."'"); + $this->assertSame($output, null); }