policy-daemon: invalidate cache on file move too

qrexec/policy/utils.py

@@ -48,7 +48,13 @@ def initialize_watcher(self):
         self.watch_manager = pyinotify.WatchManager()
 
         # pylint: disable=no-member
-        mask = pyinotify.IN_CREATE | pyinotify.IN_DELETE | pyinotify.IN_MODIFY
+        mask = (
+            pyinotify.IN_CREATE |
+            pyinotify.IN_DELETE |
+            pyinotify.IN_MODIFY |
+            pyinotify.IN_MOVED_FROM |
+            pyinotify.IN_MOVED_TO
+        )
 
         loop = asyncio.get_event_loop()
 
@@ -105,3 +111,9 @@ def process_IN_DELETE(self, _):
 
     def process_IN_MODIFY(self, _):
         self.cache.outdated = True
+
+    def process_IN_MOVED_TO(self, _):
+        self.cache.outdated = True
+
+    def process_IN_MOVED_FROM(self, _):
+        self.cache.outdated = True

qrexec/tests/policy_cache.py

@@ -97,6 +97,47 @@ async def test_13_no_change(self, tmp_path, mock_parser):
 
         assert not cache.outdated
 
+    @pytest.mark.asyncio
+    async def test_14_policy_move(self, tmp_path, mock_parser):
+        policy_path = tmp_path / "policy"
+        policy_path.mkdir()
+        cache = utils.PolicyCache(policy_path)
+        cache.initialize_watcher()
+
+        mock_parser.assert_called_once_with(policy_path=policy_path)
+
+        assert not cache.outdated
+
+        file = tmp_path / "test"
+        file.write_text("test")
+
+        await asyncio.sleep(1)
+
+        assert not cache.outdated
+
+        # move in
+        file_moved = file.rename(policy_path / "test")
+
+        await asyncio.sleep(1)
+
+        assert cache.outdated
+
+        cache.get_policy()
+
+        assert not cache.outdated
+
+        # now move out
+        file_moved.rename(file)
+
+        await asyncio.sleep(1)
+
+        assert cache.outdated
+
+        cache.get_policy()
+
+        call = unittest.mock.call(policy_path=policy_path)
+        assert mock_parser.mock_calls == [call, call, call]
+
     @pytest.mark.asyncio
     async def test_20_policy_updates(self, tmp_path, mock_parser):
         cache = utils.PolicyCache(tmp_path)