WIP

cardano-cli/cardano-cli.cabal

@@ -153,6 +153,9 @@ test-suite cardano-cli-test
   hs-source-dirs:       test
   main-is:              cardano-cli-test.hs
   type:                 exitcode-stdio-1.0
+  if !os(windows)
+      build-depends:     unix
+      other-modules:     Test.Cli.FilePermissions
 
   build-depends:        base
                       , aeson
@@ -161,6 +164,7 @@ test-suite cardano-cli-test
                       , base16-bytestring
                       , cardano-api
                       , cardano-cli
+                      , cardano-node
                       , cardano-prelude
                       , containers
                       , deepseq
@@ -177,7 +181,8 @@ test-suite cardano-cli-test
                       , transformers-except
                       , unordered-containers
 
-  other-modules:        Test.Cli.ITN
+  other-modules:        Test.Cli.FilePermissions
+                        Test.Cli.ITN
                         Test.Cli.Pioneers.Exercise1
                         Test.Cli.Pioneers.Exercise2
                         Test.Cli.Pioneers.Exercise3

cardano-cli/test/Test/Cli/FilePermissions.hs

@@ -0,0 +1,50 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TemplateHaskell #-}
+
+module Test.Cli.FilePermissions
+  ( tests
+  ) where
+
+import           Cardano.Prelude
+
+import           Control.Exception (bracket_)
+import           System.Directory (removeFile)
+import           System.Posix.Files
+import           System.Posix.IO (createFile)
+import           System.Posix.Types (FileMode)
+
+import           Cardano.Node.Run (checkVRFFilePermissions)
+import           Cardano.Node.Types (VRFPrivateKeyFilePermissionError (..))
+import           Hedgehog (Gen, Property, classify, discover, forAll, property, success)
+import qualified Hedgehog
+import qualified Hedgehog.Gen as Gen
+import           Hedgehog.Internal.Property (failWith)
+
+
+-- | This property ensures that the VRF signing key file is created only with owner permissions
+prop_createVRFSigningKeyFilePermissions :: Property
+prop_createVRFSigningKeyFilePermissions = propertyOnce . H.moduleWorkspace "tmp" $ \tempDir -> do
+  -- Key filepaths
+  vrfVerKey <- noteTempFile tempDir "VRF-verification-key-file"
+
+  vrfSignKey <- noteTempFile tempDir "VRF-signing-key-file"
+
+  -- Create VRF key pair
+  void $ execCardanoCLI
+    [ "shelley","node","key-gen-VRF"
+    , "--verification-key-file", vrfVerKey
+    , "--signing-key-file", vrfSignKey
+    ]
+
+  result <- liftIO . runExceptT $ checkVRFFilePermissions vrfSignKey
+  case result of
+    Left err ->
+      failWith Nothing
+        $ "key-gen-VRF cli command created a VRF signing key file with the wrong permissions: " <> show err
+    Right () -> success
+
+-- -----------------------------------------------------------------------------
+
+tests :: IO Bool
+tests =
+  Hedgehog.checkParallel $$discover

cardano-cli/test/cardano-cli-test.hs

@@ -2,6 +2,7 @@ import           Cardano.Prelude
 
 import           Hedgehog.Main (defaultMain)
 
+import qualified Test.Cli.FilePermissions
 import qualified Test.Cli.ITN
 import qualified Test.Cli.Pioneers.Exercise1
 import qualified Test.Cli.Pioneers.Exercise2
@@ -11,7 +12,8 @@ import qualified Test.Cli.Pioneers.Exercise4
 main :: IO ()
 main =
   defaultMain
-    [ Test.Cli.ITN.tests
+    [ Test.Cli.FilePermissions.tests
+    , Test.Cli.ITN.tests
     , Test.Cli.Pioneers.Exercise1.tests
     , Test.Cli.Pioneers.Exercise2.tests
     , Test.Cli.Pioneers.Exercise3.tests