Files
hermes-agent/tests
Ben Barclay 7ef0e98328 test: pin that install-root siblings still get parent-dir hardening
The install-tree exclusion added in #93757 has a positive test (paths
inside the tree are skipped) but no negative boundary test. The guard
compares path components, so a prefix-named sibling like
/opt/hermes-data must still be chmod'd 0700 — but a rewrite to a
string-prefix match would silently drop that hardening with the suite
staying green.

Add test_install_tree_siblings_still_hardened covering a prefix-named
sibling and an ordinary sibling of the install root. Verified by
mutation: replacing the guard with str(parent).startswith(...) turns
the new test red.

Follow-up to #93757.
2026-08-25 10:54:42 +10:00
..
…