Improve security and error handling for VM state and guest file operations; clarify permissions requirements in documentation.

tests/test_images.py

@@ -10,6 +10,7 @@ from uvm.config import Settings
 from uvm.errors import UvmError
 from uvm.images import (
     _FIRECRACKER_DEMO_PUBLIC_KEY,
+    _GuestFile,
     _enable_ssh_password_authentication,
     _set_shadow_password,
     _without_firecracker_demo_key,
@@ -96,6 +97,8 @@ class ImageStoreTests(unittest.TestCase):
                 "HostKey /etc/ssh/ssh_host_ecdsa_key\n"
                 "HostKey /etc/ssh/ssh_host_ed25519_key\n"
                 "PasswordAuthentication no\n"
+                "KbdInteractiveAuthentication no\n"
+                "ChallengeResponseAuthentication no\n"
                 "PermitRootLogin yes\n"
                 "Match User root\n"
                 "    PasswordAuthentication yes\n"
@@ -105,6 +108,16 @@ class ImageStoreTests(unittest.TestCase):
         self.assertNotIn("/insecure/shared-key", updated)
         self.assertNotIn("PermitRootLogin prohibit-password", updated)
 
+    def test_non_root_credentials_preserve_the_existing_root_login_policy(self) -> None:
+        updated = _enable_ssh_password_authentication(
+            "PermitRootLogin no\nChallengeResponseAuthentication yes\n",
+            "service",
+        )
+
+        self.assertIn("PermitRootLogin no", updated)
+        self.assertIn("Match User service\n    PasswordAuthentication yes", updated)
+        self.assertNotIn("ChallengeResponseAuthentication yes", updated)
+
     def test_removes_only_the_public_firecracker_demo_key(self) -> None:
         own_key = "ssh-ed25519 AAAA-own-key developer@example"
 
@@ -150,3 +163,27 @@ class ImageStoreTests(unittest.TestCase):
                     Path(temporary_directory) / "authorized_keys",
                     required=False,
                 )
+
+    def test_refuses_to_replace_files_with_unpreserved_security_metadata(self) -> None:
+        runner = PasswordHashRunner()
+        store = ImageStore(Settings(), runner=runner)  # type: ignore[arg-type]
+
+        for guest_file in (
+            _GuestFile(Path("/tmp/shadow"), 0o640, 0, 42, links=2),
+            _GuestFile(
+                Path("/tmp/shadow"),
+                0o640,
+                0,
+                42,
+                has_extended_attributes=True,
+            ),
+        ):
+            with self.subTest(guest_file=guest_file):
+                with self.assertRaises(UvmError):
+                    store._write_guest_file(
+                        Path("/tmp/rootfs.ext4"),
+                        "/etc/shadow",
+                        guest_file,
+                    )
+
+        self.assertEqual(runner.calls, [])