From ca9e5044a1678a3ff33f13582bd6498632113c3e Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Wed, 12 Aug 2026 04:26:44 +0000 Subject: Prevent rootfs copy from following symlinks --- tests/rootfs_finalization.rs | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'tests/rootfs_finalization.rs') diff --git a/tests/rootfs_finalization.rs b/tests/rootfs_finalization.rs index 3a98290..a450b7e 100644 --- a/tests/rootfs_finalization.rs +++ b/tests/rootfs_finalization.rs @@ -115,3 +115,35 @@ fn finalization_is_idempotent_for_matching_symlinks() { .iter() .any(|path| path == "etc/controller/controller-link")); } + +#[test] +fn finalization_replaces_a_destination_symlink_instead_of_following_it() { + let fixture = tempdir().expect("fixture directory"); + let source = fixture.path().join("overlay"); + fs::create_dir_all(&source).expect("create source tree"); + fs::write(source.join("controller.conf"), "new controller configuration\n") + .expect("write source file"); + let rootfs = tempdir().expect("rootfs directory"); + let outside = fixture.path().join("outside.conf"); + fs::write(&outside, "must not change\n").expect("write outside file"); + fs::create_dir_all(rootfs.path().join("etc/controller")).expect("create destination directory"); + symlink(&outside, rootfs.path().join("etc/controller/controller.conf")) + .expect("create destination symlink"); + let finalization = RootfsFinalization::new( + vec![CopyTree::new(&source, "etc/controller").expect("valid copy destination")], + InitrdOem::new(std::iter::empty::<&str>(), std::iter::empty::<&str>()), + vec![], + ); + + finalization.apply(rootfs.path()).expect("finalization replaces symlink safely"); + + assert_eq!(fs::read_to_string(&outside).expect("read outside file"), "must not change\n"); + assert!(fs::symlink_metadata(rootfs.path().join("etc/controller/controller.conf")) + .expect("inspect copied file") + .file_type() + .is_file()); + assert_eq!( + fs::read_to_string(rootfs.path().join("etc/controller/controller.conf")).expect("read copied file"), + "new controller configuration\n" + ); +} -- cgit v1.2.3