From 2a15dc8ccabb9139d3c965b3be79bde83fb262e2 Mon Sep 17 00:00:00 2001
From: Eric Berry <eric.berry@canonical.com>
Date: Tue, 14 Jan 2025 15:11:37 -0800
Subject: [PATCH] Fix test issues

---
 .../oval/shared.xml                           | 25 ++++++++++--
 .../tests/ubuntu_common.sh                    | 18 +++++++++
 .../tests/ubuntu_conflicting_values.fail.sh   | 39 +++++++++++++++++++
 .../tests/ubuntu_conflicting_values2.fail.sh  | 39 +++++++++++++++++++
 .../tests/ubuntu_correct_value.pass.sh        |  7 +++-
 .../tests/ubuntu_missing_value.fail.sh        |  7 +++-
 .../ubuntu_missing_value_initial.pass.sh      | 38 ++++++++++++++++++
 7 files changed, 168 insertions(+), 5 deletions(-)
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_common.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values2.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value_initial.pass.sh

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/oval/shared.xml
index a83774dfd98..b87d8152982 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/oval/shared.xml
@@ -10,14 +10,33 @@
   </definition>
 
   <ind:textfilecontent54_test id="test_password_pam_unix_use_authtok" version="1"
-    check="all" check_existence="at_least_one_exists"
+    check="all" check_existence="any_exist"
     comment="use_authtok is configured in pam unix in common_password file">
     <ind:object object_ref="obj_test_use_authtok" />
+    <ind:state state_ref="ste_test_use_authtok" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="obj_test_use_authtok" version="1">
+    <set>
+      <object_reference>obj_test_use_authtok_password_lines_except_first</object_reference>
+      <filter action="include">ste_test_use_authtok_pam_unix_lines</filter>
+    </set>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="ste_test_use_authtok" version="1">
+      <ind:subexpression operation="pattern match">^[^#\n\r]+[ \t]+pam_unix\.so[ \t]+[^#\n\r]+use_authtok.*$</ind:subexpression>
+  </ind:textfilecontent54_state>
+
+  <!-- Get all password lines except the first line. This is to avoid matching a pam_unix
+  line on the top of the stack, which does not need use_authtok to pass -->
+  <ind:textfilecontent54_object id="obj_test_use_authtok_password_lines_except_first" version="1">
     <ind:filepath>{{{ accounts_password_pam_unix_file }}}</ind:filepath>
-    <ind:pattern operation="pattern match">^[ \t]*password[ \t]+([^\n\r]+)[\n\r]+[ \t]*password[ \t]+([^#\n\r]+)[ \t]+pam_unix\.so[ \t]+([^#\n\r]+[ \t]+)?use_authtok.*$</ind:pattern>
-    <ind:instance datatype="int" operation="equals">1</ind:instance>
+    <ind:pattern operation="pattern match">^[ \t]*password[ \t]+(.+)$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">2</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="ste_test_use_authtok_pam_unix_lines" version="1">
+      <ind:subexpression operation="pattern match">^[^#\n\r]+[ \t]+pam_unix\.so.*$</ind:subexpression>
+  </ind:textfilecontent54_state>
+
 </def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_common.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_common.sh
new file mode 100644
index 00000000000..8bc825f2336
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_common.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# remove all pam-auth-update configs which update the
+# primary password block and create a config with well defined
+# high priority to ensure correct stacking of our module
+grep -il "Password-Type: Primary" /usr/share/pam-configs/* | grep -v "/unix$" | xargs rm -f
+
+cat << EOF > /usr/share/pam-configs/cac_test_echo
+Name: Echo
+Default: yes
+Priority: 10000
+Password-Type: Primary
+Password:
+        password optional pam_echo.so
+Password-Initial:
+        password optional pam_echo.so
+EOF
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values.fail.sh
new file mode 100644
index 00000000000..80394934931
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values.fail.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+source ubuntu_common.sh
+
+config_file=/usr/share/pam-configs/tmpunix
+
+# lower priority to ensure the config is below the cac_test_echo
+# on the stack, thus using the "Password:" configuration
+cat << EOF > "$config_file"
+Name: Unix authentication
+Default: yes
+Priority: 1024
+Conflicts: unix
+Auth-Type: Primary
+Auth:
+        [success=end default=ignore]    pam_unix.so try_first_pass
+Auth-Initial:
+        [success=end default=ignore]    pam_unix.so
+Account-Type: Primary
+Account:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Account-Initial:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Session-Type: Additional
+Session:
+        required        pam_unix.so
+Session-Initial:
+        required        pam_unix.so
+Password-Type: Primary
+Password:
+        [success=end default=ignore]    pam_unix.so obscure use_authtok try_first_pass yescrypt 
+        [success=end default=ignore]    pam_unix.so obscure try_first_pass yescrypt 
+Password-Initial:
+        [success=end default=ignore]    pam_unix.so obscure yescrypt 
+EOF
+
+DEBIAN_FRONTEND=noninteractive pam-auth-update
+rm "$config_file"
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values2.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values2.fail.sh
new file mode 100644
index 00000000000..6aff7903b99
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_conflicting_values2.fail.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+source ubuntu_common.sh
+
+config_file=/usr/share/pam-configs/tmpunix
+
+# lower priority to ensure the config is below the cac_test_echo
+# on the stack, thus using the "Password:" configuration
+cat << EOF > "$config_file"
+Name: Unix authentication
+Default: yes
+Priority: 1024
+Conflicts: unix
+Auth-Type: Primary
+Auth:
+        [success=end default=ignore]    pam_unix.so try_first_pass
+Auth-Initial:
+        [success=end default=ignore]    pam_unix.so
+Account-Type: Primary
+Account:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Account-Initial:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Session-Type: Additional
+Session:
+        required        pam_unix.so
+Session-Initial:
+        required        pam_unix.so
+Password-Type: Primary
+Password:
+        [success=end default=ignore]    pam_unix.so obscure try_first_pass yescrypt 
+        [success=end default=ignore]    pam_unix.so obscure use_authtok try_first_pass yescrypt 
+Password-Initial:
+        [success=end default=ignore]    pam_unix.so obscure yescrypt 
+EOF
+
+DEBIAN_FRONTEND=noninteractive pam-auth-update
+rm "$config_file"
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_correct_value.pass.sh
index bef6483a480..1a8af633232 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_correct_value.pass.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_correct_value.pass.sh
@@ -1,12 +1,17 @@
 #!/bin/bash
 # platform = multi_platform_ubuntu
 
+source ubuntu_common.sh
+
 config_file=/usr/share/pam-configs/tmpunix
 
+# lower priority to ensure the config is below the cac_test_echo
+# on the stack, thus using the "Password:" configuration
 cat << EOF > "$config_file"
 Name: Unix authentication
 Default: yes
-Priority: 0
+Priority: 1024
+Conflicts: unix
 Auth-Type: Primary
 Auth:
         [success=end default=ignore]    pam_unix.so try_first_pass
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value.fail.sh
index 904456b6ada..42d499b7c2f 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value.fail.sh
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value.fail.sh
@@ -1,12 +1,17 @@
 #!/bin/bash
 # platform = multi_platform_ubuntu
 
+source ubuntu_common.sh
+
 config_file=/usr/share/pam-configs/tmpunix
 
+# lower priority to ensure the config is below the cac_test_echo
+# on the stack, thus using the "Password:" configuration
 cat << EOF > "$config_file"
 Name: Unix authentication
 Default: yes
 Priority: 1024
+Conflicts: unix
 Auth-Type: Primary
 Auth:
         [success=end default=ignore]    pam_unix.so try_first_pass
@@ -29,5 +34,5 @@ Password-Initial:
         [success=end default=ignore]    pam_unix.so obscure yescrypt 
 EOF
 
-DEBIAN_FRONTEND=noninteractive pam-auth-update --remove unix --enable tmpunix
+DEBIAN_FRONTEND=noninteractive pam-auth-update
 rm "$config_file"
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value_initial.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value_initial.pass.sh
new file mode 100644
index 00000000000..a8ef5c3e10e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_authtok/tests/ubuntu_missing_value_initial.pass.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+source ubuntu_common.sh
+
+config_file=/usr/share/pam-configs/tmpunix
+
+# higher priority to ensure the config is above the cac_test_echo
+# on the stack, thus using the "Password-Initial:" configuration
+cat << EOF > "$config_file"
+Name: Unix authentication
+Default: yes
+Priority: 1000000
+Conflicts: unix
+Auth-Type: Primary
+Auth:
+        [success=end default=ignore]    pam_unix.so try_first_pass
+Auth-Initial:
+        [success=end default=ignore]    pam_unix.so
+Account-Type: Primary
+Account:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Account-Initial:
+        [success=end new_authtok_reqd=done default=ignore]      pam_unix.so
+Session-Type: Additional
+Session:
+        required        pam_unix.so
+Session-Initial:
+        required        pam_unix.so
+Password-Type: Primary
+Password:
+        [success=end default=ignore]    pam_unix.so obscure try_first_pass yescrypt 
+Password-Initial:
+        [success=end default=ignore]    pam_unix.so obscure yescrypt 
+EOF
+
+DEBIAN_FRONTEND=noninteractive pam-auth-update
+rm "$config_file"