cockpit-project / cockpit

Cockpit is a web-based graphical interface for servers.
http://www.cockpit-project.org/
GNU Lesser General Public License v2.1
11.07k stars 1.1k forks source link

"should become root" saving logic not right on fedora-coreos #20262

Open allisonkarlitskaya opened 6 months ago

allisonkarlitskaya commented 6 months ago

When investigating an issue that only occurs on ostree-based images we noticed that logging in as admin, logging out, then logging in as a non-privileged user ("scruffy") is enough to trigger the issue, which is caused by a pending sudo operation. Removing the "admin" login part and the problem disappears.

My theory is that the login page is somehow changing its local storage behaviour of remember the "should be root" flag for the case where we are using the -ws container to connect to the host via ssh.

cc @jelly

jelly commented 6 months ago

So digging into the test (TestUser.testExpire) it does:

        b.logout()
        self.login_and_go("/users", user="scruffy")
        b.go("#/scruffy")

So we could add a check that the bridge was really closed on b.logout or we can read what login_and_go does:

    def login_and_go(self, path: Optional[str] = None, user: Optional[str] = None, host: Optional[str] = None,
                     superuser: bool = True, urlroot: Optional[str] = None, tls: bool = False, password: Optional[str] = None,
                     legacy_authorized: Optional[bool] = None):

        self.try_login(user, password, superuser=superuser, legacy_authorized=legacy_authorized)

So by default we try to login as superuser in try_login:

        if superuser is not None:
            self.eval_js('window.localStorage.setItem("superuser:%s", "%s");' % (user, "any" if superuser else "none"))

If I change the test to superuser=False it seems to pass! Verified via:

-> window.localStorage.setItem("superuser:scruffy", "any");
<- {'type': 'undefined'}