mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 12:33:02 +02:00
41 lines
1.3 KiB
Plaintext
41 lines
1.3 KiB
Plaintext
=== Basic NACM permissions
|
|
|
|
ifdef::topdoc[:imagesdir: {topdoc}../../test/case/system/nacm-basic]
|
|
|
|
==== Description
|
|
|
|
Test that NACM groups (admin, operator, guest) correctly enforce
|
|
access control with permissive defaults and targeted denials.
|
|
|
|
The NACM design is "permit by default, deny sensitive items":
|
|
|
|
- admin: Full unrestricted access (permit-all rule)
|
|
- operator: Can configure everything EXCEPT passwords, keystore, truststore
|
|
- guest: Read-only access (explicit deny of create/update/delete/exec)
|
|
|
|
Verifies that:
|
|
|
|
- Operators can read and modify most configuration (hostname, interfaces)
|
|
- Operators CANNOT read or write password hashes (protected path)
|
|
- Guests can read but cannot modify any configuration
|
|
- Admin can access everything including passwords
|
|
|
|
==== Topology
|
|
|
|
image::topology.svg[Basic NACM permissions topology, align=center, scaledwidth=75%]
|
|
|
|
==== Sequence
|
|
|
|
. Set up topology and attach to target
|
|
. Configure NACM groups, rules, and test users
|
|
. Verify operator can read configuration
|
|
. Verify operator can modify interface configuration
|
|
. Verify operator can modify hostname
|
|
. Verify operator cannot read password hashes
|
|
. Verify operator cannot write password hashes
|
|
. Verify guest can read configuration
|
|
. Verify guest cannot modify configuration
|
|
. Verify admin can access passwords
|
|
|
|
|