let principals-command.sh work for noexec /var/run

regress/principals-command.sh

@@ -14,15 +14,15 @@ fi
 
 # Establish a AuthorizedPrincipalsCommand in /var/run where it will have
 # acceptable directory permissions.
-PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
-cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
+PRINCIPALS_CMD="/var/run/principals_command_${LOGNAME}"
+cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_CMD'"
 #!/bin/sh
 test "x\$1" != "x${LOGNAME}" && exit 1
 test -f "$OBJ/authorized_principals_${LOGNAME}" &&
 	exec cat "$OBJ/authorized_principals_${LOGNAME}"
 _EOF
 test $? -eq 0 || fatal "couldn't prepare principals command"
-$SUDO chmod 0755 "$PRINCIPALS_COMMAND"
+$SUDO chmod 0755 "$PRINCIPALS_CMD"
 
 # Create a CA key and a user certificate.
 ${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
@@ -33,6 +33,7 @@ ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
     -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
 	fatal "couldn't sign cert_user_key"
 
+if [ -x $PRINCIPALS_CMD ]; then
 	# Test explicitly-specified principals
 	for privsep in yes no ; do
 		_prefix="privsep $privsep"
@@ -43,7 +44,7 @@ for privsep in yes no ; do
 			cat $OBJ/sshd_proxy_bak
 			echo "UsePrivilegeSeparation $privsep"
 			echo "AuthorizedKeysFile none"
-		echo "AuthorizedPrincipalsCommand $PRINCIPALS_COMMAND %u"
+			echo "AuthorizedPrincipalsCommand $PRINCIPALS_CMD %u"
 			echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
 			echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
 		) > $OBJ/sshd_proxy
@@ -97,7 +98,6 @@ for privsep in yes no ; do
 			fail "ssh cert connect succeeded unexpectedly"
 		fi
 
-
 		# authorized_principals with command=true
 		verbose "$tid: ${_prefix} authorized_principals command=true"
 		echo 'command="true" mekmitasdigoat' > \
@@ -139,3 +139,7 @@ for privsep in yes no ; do
 			fail "ssh cert connect failed"
 		fi
 	done
+else
+	echo "SKIPPED: $PRINCIPALS_COMMAND not executable " \
+	    "(/var/run mounted noexec?)"
+fi