steam-backlog-enforcer/steam_backlog_enforcer/tests/test_game_install.py
Krzysztof kuhy Rudnicki 21fe2f7742 Stop the enforcer launching Steam and notifications as root
The enforce service runs as root (no User=) but sets DISPLAY=:0, so any GUI
it starts lands on the desktop session. Two resolvers disagreed about who to
drop privileges to:

  library_hider._resolve_desktop_user()  read STEAM_ENFORCER_DESKTOP_USER
  game_install._get_real_user()          read only SUDO_USER or USER

systemd sets neither of the latter, so _get_real_user() returned None under
the service and every `geteuid() == 0 and real_user and ...` guard fell
through to running as root. Steam answered with a zenity modal ("Cannot run
as root user", /usr/lib/steam/steam:261) on screen.

Confirmed from the live process tree: root `bash /usr/lib/steam/steam
-cef-disable-gpu ... steam://install/618510` with a root zenity child. It
never reached the journal, because that text goes to zenity and _run_as_user
sends child output to DEVNULL.

- _desktop_env: add resolve_desktop_user/desktop_uid/desktop_user_cmd. Only
  the argv builder is shared, never the spawn call: tests/_no_subprocess.py
  patches subprocess per module by name, so a spawn site in an unpatched
  module could fire a real `sudo -u kuhy steam`.
- game_install._get_real_user: delegate to the shared resolver. This alone
  also fixes the root `steam -silent` in _ensure_steam_running and the
  no-op os.chown on new appmanifests.
- _trigger_steam_install / enforcer.send_notification: drop privileges.
  send_notification had no DBUS_SESSION_BUS_ADDRESS, so it silently reached
  nobody for all six of its callers.
- _run_as_user: fail closed. Running unchanged as root when no desktop user
  resolves is what put the modal on screen; refuse and log instead.

Also stop the retry storm behind it. steamapps does not exist (Steam has
never completed sign-in), so is_game_installed() was always False and the
loop re-triggered every allowed game every pass: 1656 attempts in 30
minutes, service RSS 1.5 GB (peak 4.3 GB), a FileNotFoundError traceback
each time. Guard install_game and _reinstall_missing_allowed on
steam_library_ready() -- a missing library means no install can succeed by
any route, so this is a correctness check rather than a tuned retry limit.

The module splits here are forced by the pre-commit 250-line gate, which
blocks any commit touching an over-cap file: game_install, library_hider and
_enforce_loop were already over before this change. They are split by
responsibility (_cdp transport, _steam_launch lifecycle, _steam_process
spawning, _steam_errors, _steam_client, _game_names, game_uninstall,
_enforce_steps, _owned_apps_cache, _echo, _protected_apps). game_install and
library_hider re-export their old public names, so the 15 modules that
import from them are untouched by this commit.

Verified as real root under the unit's environment: argv is now
`sudo -u kuhy env DISPLAY=:0 ... xdg-open steam://install/...` for both the
installer and notify-send; three enforce passes spawn no process and log
once; _run_as_user refuses with no desktop user. After restart: 0 retries,
0 tracebacks, 0 root-owned files under ~/.local/share/Steam, RSS 342 MB.

1311 tests pass. _desktop_env and _steam_state at 100% branch coverage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016A1EYiv7e7HGhET84oa9M3
2026-08-24 13:55:44 +02:00

230 lines
8.0 KiB
Python

"""Tests for game_install module."""
from __future__ import annotations
import os
from typing import TYPE_CHECKING
from unittest.mock import MagicMock, patch
import pytest
from steam_backlog_enforcer._echo import _echo
from steam_backlog_enforcer._steam_client import (
_get_real_user,
_get_uid_gid_for_user,
is_game_installed,
)
from steam_backlog_enforcer._steam_state import _assert_not_real_steam
from steam_backlog_enforcer.game_install import (
_trigger_steam_install,
)
if TYPE_CHECKING:
from pathlib import Path
PKG = "steam_backlog_enforcer.game_install"
ECHO_PKG = "steam_backlog_enforcer._echo"
STEAM_CLIENT_PKG = "steam_backlog_enforcer._steam_client"
class TestAssertNotRealSteam:
"""Tests for the _assert_not_real_steam safety guard."""
def test_allows_tmp_path(self, tmp_path: Path) -> None:
"""Non-Steam paths pass through without raising."""
_assert_not_real_steam(tmp_path / "appmanifest_440.acf")
def test_raises_when_real_steam_not_redirected(self, tmp_path: Path) -> None:
"""Raises when path is under real Steam and STEAMAPPS_PATH is real."""
real = tmp_path / "real_steam"
real.mkdir()
fake_manifest = real / "appmanifest_440.acf"
fake_manifest.touch()
with (
patch("steam_backlog_enforcer._steam_state._REAL_STEAMAPPS", real),
patch("steam_backlog_enforcer._steam_state.STEAMAPPS_PATH", real),
pytest.raises(RuntimeError, match="SAFETY"),
):
_assert_not_real_steam(fake_manifest)
def test_allows_when_steamapps_redirected(self, tmp_path: Path) -> None:
"""No raise when STEAMAPPS_PATH differs from _REAL_STEAMAPPS."""
real = tmp_path / "real_steam"
real.mkdir()
fake_manifest = real / "appmanifest_440.acf"
fake_manifest.touch()
redirected = tmp_path / "fake_steam"
redirected.mkdir()
with (
patch("steam_backlog_enforcer._steam_state._REAL_STEAMAPPS", real),
patch("steam_backlog_enforcer._steam_state.STEAMAPPS_PATH", redirected),
):
_assert_not_real_steam(fake_manifest)
def test_noop_outside_pytest(self, tmp_path: Path) -> None:
"""In production (no PYTEST_CURRENT_TEST) the guard is a no-op."""
real = tmp_path / "real_steam"
real.mkdir()
fake_manifest = real / "appmanifest_440.acf"
fake_manifest.touch()
env = {k: v for k, v in os.environ.items() if k != "PYTEST_CURRENT_TEST"}
with (
patch.dict(os.environ, env, clear=True),
patch("steam_backlog_enforcer._steam_state._REAL_STEAMAPPS", real),
patch("steam_backlog_enforcer._steam_state.STEAMAPPS_PATH", real),
):
_assert_not_real_steam(fake_manifest)
class TestEcho:
"""Tests for _echo."""
def test_default(self, capsys: pytest.CaptureFixture[str]) -> None:
_echo("hello")
assert capsys.readouterr().out == "hello\n"
def test_custom_end(self, capsys: pytest.CaptureFixture[str]) -> None:
_echo("hi", end="")
assert capsys.readouterr().out == "hi"
def test_empty(self, capsys: pytest.CaptureFixture[str]) -> None:
_echo()
assert capsys.readouterr().out == "\n"
def test_flush(self, capsys: pytest.CaptureFixture[str]) -> None:
_echo("x", flush=True)
assert capsys.readouterr().out == "x\n"
class TestTriggerSteamInstall:
"""Tests for _trigger_steam_install."""
def test_success(self) -> None:
with patch("steam_backlog_enforcer.game_install.subprocess.run") as mock_run:
result = _trigger_steam_install(440, "TF2")
assert result is True
mock_run.assert_called_once()
def test_file_not_found(self) -> None:
with patch(
"steam_backlog_enforcer.game_install.subprocess.run",
side_effect=FileNotFoundError,
):
result = _trigger_steam_install(440, "TF2")
assert result is False
def test_os_error(self) -> None:
with patch(
"steam_backlog_enforcer.game_install.subprocess.run",
side_effect=OSError,
):
result = _trigger_steam_install(440, "TF2")
assert result is False
def test_timeout(self) -> None:
import subprocess
with patch(
"steam_backlog_enforcer.game_install.subprocess.run",
side_effect=subprocess.TimeoutExpired("cmd", 15),
):
result = _trigger_steam_install(440, "TF2")
assert result is False
class TestGetRealUser:
"""Tests for _get_real_user."""
def test_sudo_user(self) -> None:
with patch.dict(os.environ, {"SUDO_USER": "alice", "USER": "root"}):
assert _get_real_user() == "alice"
def test_regular_user(self) -> None:
with patch.dict(os.environ, {"USER": "bob"}, clear=False):
env = os.environ.copy()
env.pop("SUDO_USER", None)
with patch.dict(os.environ, env, clear=True):
assert _get_real_user() == "bob"
class TestGetUidGid:
"""Tests for _get_uid_gid_for_user."""
def test_known_user(self) -> None:
mock_pw = MagicMock()
mock_pw.pw_uid = 1001
mock_pw.pw_gid = 1001
with patch(
"steam_backlog_enforcer._steam_client.pwd.getpwnam",
return_value=mock_pw,
):
assert _get_uid_gid_for_user("alice") == (1001, 1001)
def test_unknown_user(self) -> None:
with patch(
"steam_backlog_enforcer._steam_client.pwd.getpwnam",
side_effect=KeyError,
):
assert _get_uid_gid_for_user("nobody") == (1000, 1000)
class TestIsGameInstalled:
"""Tests for is_game_installed."""
def test_installed(self, tmp_path: Path) -> None:
manifest = tmp_path / "appmanifest_440.acf"
manifest.touch()
with patch("steam_backlog_enforcer._steam_client.STEAMAPPS_PATH", tmp_path):
assert is_game_installed(440) is True
def test_not_installed(self, tmp_path: Path) -> None:
with patch("steam_backlog_enforcer._steam_client.STEAMAPPS_PATH", tmp_path):
assert is_game_installed(440) is False
class TestTriggerSteamInstallPrivilegeDrop:
"""Regression tests: never invoke the steam:// handler as root.
A bare root ``xdg-open steam://install/...`` makes Steam answer with a
"Cannot run as root user" modal on the user's display.
"""
_PKG = "steam_backlog_enforcer.game_install"
def test_root_drops_to_desktop_user(self) -> None:
with (
patch(f"{self._PKG}.os.geteuid", return_value=0),
patch(f"{self._PKG}._get_real_user", return_value="kuhy"),
patch(f"{self._PKG}.desktop_session_ready", return_value=True),
patch(f"{self._PKG}.desktop_uid", return_value=1000),
patch(f"{self._PKG}.subprocess.run") as mock_run,
):
assert _trigger_steam_install(440, "TF2") is True
argv = mock_run.call_args[0][0]
assert argv[:4] == ["sudo", "-u", "kuhy", "env"]
assert argv[-1] == "steam://install/440"
def test_non_root_does_not_wrap(self) -> None:
with (
patch(f"{self._PKG}.os.geteuid", return_value=1000),
patch(f"{self._PKG}._get_real_user", return_value="kuhy"),
patch(f"{self._PKG}.subprocess.run") as mock_run,
):
assert _trigger_steam_install(440, "TF2") is True
assert mock_run.call_args[0][0][0] != "sudo"
def test_defers_when_session_not_ready(self) -> None:
"""No runtime dir means a Steam launched now loses audio all session."""
with (
patch(f"{self._PKG}.os.geteuid", return_value=0),
patch(f"{self._PKG}._get_real_user", return_value="kuhy"),
patch(f"{self._PKG}.desktop_session_ready", return_value=False),
patch(f"{self._PKG}.subprocess.run") as mock_run,
):
assert _trigger_steam_install(440, "TF2") is False
mock_run.assert_not_called()