#######################################################
#
# Create a file, check defaults
#
#######################################################
body common control
{
  inputs => { "../../default.sub.cf" };
  bundlesequence => { default("$(this.promise_filename)") };
  version => "1.0";
}

bundle common g
{
  vars:
    # This extracts the octal mode, and decimal nlink, uid, gid, size
    "policy_file"
      string => '

body common control
{
      bundlesequence  => { "test" };
}

bundle agent test
{
  reports:
    "We\'re not in KS anymore toto.";

}';
}

#######################################################
bundle agent init
{
  files:
    "$(G.testfile)"
      create => "true",
      edit_defaults => empty,
      edit_line => insert_lines("$(g.policy_file)"),
      perms => m("602");
}

#######################################################
bundle agent test
{
  vars:
    "agent_output"
      string => execresult("$(sys.cf_agent) -f $(G.testfile)", "noshell"),
      if => fileexists("$(G.testfile)");

  classes:
    "security_exception"
      expression => regcmp(
        ".*is writable by others (security exception).*", "$(agent_output)"
      ),
      comment => "It's a security risk to evaluate policy that is writeable by users other than the owner";
}

#######################################################
bundle agent check
{
  classes:
    "ok" expression => "!security_exception";

  reports:
    ok::
      "$(this.promise_filename) Pass";

    !ok::
      "$(this.promise_filename) FAIL";
}
