Merge pull request #4074 from dokku/4027-plugin-force-permissions

Force set all plugin permissions on plugin:install/update

plugins/plugin/install

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/plugin/internal-functions"
+
+trigger-plugin-install() {
+  declare desc="plugin install plugin trigger"
+  declare trigger="install"
+
+  fn-plugin-set-permissions
+}
+
+trigger-plugin-install "$@"

plugins/plugin/internal-functions

@@ -21,6 +21,12 @@ cmd-plugin-installed() {
   plugn list | awk '{print $1}' | grep -q "^${PLUGIN_NAME}$"
 }
 
+fn-plugin-set-permissions() {
+  declare desc="ensures correct permissions for all available plugins"
+  chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_CORE_AVAILABLE_PATH" "$PLUGIN_AVAILABLE_PATH"
+  chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$PLUGIN_CORE_ENABLED_PATH" "$PLUGIN_ENABLED_PATH"
+}
+
 plugin_prime_bash_completion() {
   declare desc="primes the bash-completion cache"
 

plugins/plugin/update

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -eo pipefail
+[[ $DOKKU_TRACE ]] && set -x
+source "$PLUGIN_AVAILABLE_PATH/plugin/internal-functions"
+
+trigger-plugin-update() {
+  declare desc="plugin update plugin trigger"
+  declare trigger="update"
+
+  fn-plugin-set-permissions
+}
+
+trigger-plugin-update "$@"

tests/unit/plugin.bats

@@ -180,3 +180,69 @@ teardown() {
   echo "status: $status"
   assert_failure
 }
+
+@test "(plugin) plugin:install permissions set properly" {
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+
+  run /bin/bash -c "chown -R root:root /var/lib/dokku/core-plugins/available/git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "2"
+  assert_output_contains "dokku" "1"
+
+  run /bin/bash -c "dokku plugin:install"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+}
+
+@test "(plugin) plugin:update permissions set properly" {
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+
+  run /bin/bash -c "chown -R root:root /var/lib/dokku/core-plugins/available/git"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "2"
+  assert_output_contains "dokku" "1"
+
+  run /bin/bash -c "dokku plugin:update"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "ls -lah /var/lib/dokku/core-plugins/available/git/commands"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "root" "0"
+  assert_output_contains "dokku" "3"
+}