Merge ~peppepetra/charm-sudo-pair/+git/sudo-pair-charm:master into ~sudo-pair-charmers/charm-sudo-pair:master

[Giuseppe Petralia]

[Alvaro Uria (aluria)]

Please find comments inline.

OTOH, what is the use case for this charm? When a unit is deployed, "juju ssh" will always use the ubuntu user. So, no matter a colleague will approve the sudo_pair request that it will look it comes from the same person (because they use the same local user). I see auto_approval is allowed, by action will trigger a PD alert.

As a minor request, could no_auto_approve be changed to "auto_approve"? I think it is easier to understand "auto_approve=true" than "no_auto_approve=false", although both would do the same.

review: Needs Fixing

[Giuseppe Petralia (peppepetra)]

> Please find comments inline.
>
> OTOH, what is the use case for this charm? When a unit is deployed, "juju ssh"
> will always use the ubuntu user. So, no matter a colleague will approve the
> sudo_pair request that it will look it comes from the same person (because
> they use the same local user). I see auto_approval is allowed, by action will
> trigger a PD alert.
>
> As a minor request, could no_auto_approve be changed to "auto_approve"? I
> think it is easier to understand "auto_approve=true" than
> "no_auto_approve=false", although both would do the same.

Comments accepted. Thanks for the review.

About the "juju ssh as me" I am still investigating a possible implementation for that but it's not strictly related to sudo-pair functionality. Any suggestion there is more than welcome. In any case it is in my to do list. At least the investigation. Right now it's not clear to me how to implement it and juju model sharing is not trivial in an automated way.

[Chris Sanders (chris.sanders)]

Comments in line

review: Needs Fixing

[Chris Sanders (chris.sanders)]

Added another in-line comment, please be sure to check the previous in-line comments as well this is in addition to not a replacement for the previous comments.

[Chris Sanders (chris.sanders)]

Comments in-line, at least one of them would be easiest if we talk about in person.

review: Needs Fixing

[Chris Sanders (chris.sanders)]

Thanks for the walk through this morning. A few comments in line.

review: Needs Fixing

[Peter Sabaini (peter-sabaini)]

Minor comment added.

[Giuseppe Petralia (peppepetra)]

Fixed. Thanks.
> Minor comment added.

[Chris Sanders (chris.sanders)]

looks good to me, these functional tests are really clean some of those fixtures would probably be nice to include in the template for re-use on new charms.

review: Approve

diff --git a/README.md b/README.md
index 9cc2dad..0804cca 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,51 @@
-# Sudo_pair Charm
-TODO
+# Overview
+sudo_pair is a sudo plugin that ensure that no user
+can act entirely on their own authority within these systems.
+Once configured if a user tries to get root privileges, he will need
+an authorization from a pair that will monitor over his session.
+
+# Build
+```
+cd sudo-pair
+charm build 
+```
+
+# Usage
+Add to an existing application using juju-info relation.
+
+Example:
+```
+juju deploy ubuntu
+juju deploy ./sudo-pair
+juju add-unit ubuntu
+juju add-relation ubuntu sudo-pair 
+```
+
+# Configuration
+The user can configure the following parameters:
+* ```groups_enforced``` (default: ```root```): This is a comma-separated list of group names that sudo_pair will gate access to. If a user is sudoing to a user that is a member of one of these groups, they will be required to have a pair approve their session.
+* ```groups_exempted```(default: ```none```): This is a comma-separated list of group names whose users will be exempted from the requirements of sudo_pair. Note that this is not the opposite of the groups_enforced flag. Whereas groups_enforced gates access to groups, groups_exempted exempts users sudoing from groups. For instance, this setting can be used to ensure that oncall sysadmins can respond to outages without needing to find a pair.
+* ```bypass_cmds``` (default: ```none```): This is a comma-separated list of full path commands that have to be bypassed from sudo pairing
+* ```bypass_group``` (default: ```none```): This is the unix group for which the commands specified through bypass_cmds will be bypassed from sudo pairing approval
+* ```auto_approve``` (default: ```true```): If true, auto approval is permitted.
+ 
+# Testing
+Unit tests has been developed to test templates rendering for ```sudo.conf```, ```sudoers.d/91-bypass-sudopair-cmds```, ```sudo_approve```
+
+To run unit tests:
+```bash
+tox -e unit
+```
+Deploy tests has been developed using python-libjuju
+
+To run tests using python-libjuju:
+```bash
+tox -e functional
+```
+
+
+# Contact Information
+Giuseppe Petralia <[e-mail]>
+
+[service]: https://github.com/square/sudo_pair
+[icon guidelines]: https://jujucharms.com/docs/stable/authors-charm-icon
diff --git a/config.yaml b/config.yaml
new file mode 100644
index 0000000..795269b
--- /dev/null
+++ b/config.yaml
@@ -0,0 +1,21 @@
+options:
+  groups_enforced:
+    type: string
+    default: "root"
+    description: "This is a comma-separated list of group names that sudo_pair will gate access to."
+  groups_exempted:
+    type: string
+    default: ""
+    description: "This is a comma-separated list of group names whose users will be exempted from the requirements of sudo_pair"
+  bypass_cmds:
+    type: string
+    default: ""
+    description: "This is a comma-separated list of full path commands that have to be bypassed from sudo pairing"
+  bypass_group:
+    type: string
+    default: ""
+    description: "This is the unix group for which the commands will be bypassed from sudo pairing approval"
+  auto_approve:
+    type: boolean
+    default: true
+    description: "If true, auto approval is permitted."
diff --git a/files/sudo.prompt.pair b/files/sudo.prompt.pair
new file mode 100644
index 0000000..69c5c6a
--- /dev/null
+++ b/files/sudo.prompt.pair
@@ -0,0 +1,9 @@
+]0;sudo: <%U@%h:%d $ > %C[8;%H;%WtYou have been asked to approve and monitor the following sudo session:
+
+    <%U@%h:%d $ > %C
+
+Once approved, this terminal will mirror all output from the active sudo session until its completion.
+
+Closing this terminal, losing your network connection to this host, or explicitly ending the session by typing <Ctrl-D> will cause the command being run under elevated privileges to terminate immediately.
+
+Approve? y/n [n]: 
diff --git a/files/sudo.prompt.user b/files/sudo.prompt.user
new file mode 100644
index 0000000..4bc034f
--- /dev/null
+++ b/files/sudo.prompt.user
@@ -0,0 +1,7 @@
+Due to security and compliance requirements, this `sudo` session will require approval and monitoring from another engineer. When finished, this session will be archived permanently for later retrieval and analysis.
+
+To continue, another engineer must run:
+
+    ssh -t '%h' 'sh -l -c "sudo %b %u %p"'
+
+If a suitable engineer is not available and you have an immediate and urgent need to run this command (e.g., a payments outage or other serious system issue), you may run the above command to approve your own session. Note that doing so will immediately page an oncall security engineer, so this capability should only be used in the event of an emergency.
\ No newline at end of file
diff --git a/files/sudo_pair.so b/files/sudo_pair.so
new file mode 100755
index 0000000..44bcb8d
Binary files /dev/null and b/files/sudo_pair.so differ
diff --git a/files/sudoers b/files/sudoers
new file mode 100644
index 0000000..e3a34ef
--- /dev/null
+++ b/files/sudoers
@@ -0,0 +1,31 @@
+#
+# This file MUST be edited with the 'visudo' command as root.
+#
+# Please consider adding local content in /etc/sudoers.d/ instead of
+# directly modifying this file.
+#
+# See the man page for details on how to write a sudoers file.
+#
+Defaults	env_reset
+Defaults	mail_badpass
+Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
+Defaults	log_output
+
+# Host alias specification
+
+# User alias specification
+
+# Cmnd alias specification
+
+# User privilege specification
+root	ALL=(ALL:ALL) ALL
+
+# Members of the admin group may gain root privileges
+%admin ALL=(ALL) ALL
+
+# Allow members of group sudo to execute any command
+%sudo	ALL=(ALL:ALL) ALL
+
+# See sudoers(5) for more information on "#include" directives:
+
+#includedir /etc/sudoers.d
diff --git a/layer.yaml b/layer.yaml
new file mode 100644
index 0000000..7473bae
--- /dev/null
+++ b/layer.yaml
@@ -0,0 +1,8 @@
+includes:
+  - layer:basic
+  - layer:apt
+options:
+  apt:
+    packages:
+      - socat
+repo: https://git.launchpad.net/sudo-pair-charm
diff --git a/lib/libsudopair.py b/lib/libsudopair.py
new file mode 100644
index 0000000..aa24250
--- /dev/null
+++ b/lib/libsudopair.py
@@ -0,0 +1,106 @@
+import grp
+import os
+from charmhelpers.core import host, hookenv, templating
+
+
+def check_valid_group(group_name):
+    try:
+        grp.getgrnam(group_name)
+        return True
+    except KeyError:
+        return False
+
+
+def group_id(group_name):
+    return grp.getgrnam(group_name).gr_gid
+
+
+def group_names_to_group_ids(group_names):
+    """
+    From Group Names comma-separated list to Group Ids
+    :param group_names: i.e. "root,user1,user2"
+    :return gids: i.e. "0,1001,1002"
+    """
+    group_names = list(filter(check_valid_group, group_names.split(',')))
+    return ','.join(map(str, (map(group_id, group_names))))
+
+
+def copy_file(source, destination, owner, group, perms):
+    if destination is not None:
+        target_dir = os.path.dirname(destination)
+        if not os.path.exists(target_dir):
+            # This is a terrible default directory permission, as the file
+            # or its siblings will often contain secrets.
+            host.mkdir(os.path.dirname(destination), owner, group, perms=0o755)
+        with open(source, 'rb') as source_f:
+            host.write_file(destination, source_f.read(), perms=perms, owner=owner, group=group)
+
+
+class SudoPairHelper(object):
+    def __init__(self):
+        self.charm_config = hookenv.config()
+        self.binary_path = '/usr/bin/sudo_approve'
+        self.sudo_conf_path = '/etc/sudo.conf'
+        self.sudoers_path = '/etc/sudoers'
+        self.sudo_lib_path = '/usr/lib/sudo/sudo_pair.so'
+        self.sudoers_bypass_path = "/etc/sudoers.d/91-bypass-sudopair-cmds"
+        self.user_prompt_path = '/etc/sudo_pair.prompt.user'
+        self.pair_prompt_path = '/etc/sudo_pair.prompt.pair'
+        self.socket_dir = '/var/run/sudo_pair'
+        self.owner = 'root'
+        self.group = 'root'
+        self.socket_dir_perms = 0o644
+        self.sudo_pair_so_perms = 0o644
+        self.prompt_perms = 0o644
+        self.sudoers_perms = 0o440
+        self.sudo_conf_perms = 0o440
+        self.sudo_approve_perms = 0o755
+
+    def get_config(self):
+        config = {
+            'binary_path' : self.binary_path,
+            'user_prompt_path' : self.user_prompt_path,
+            'pair_prompt_path' :  self.pair_prompt_path,
+            'socket_dir': self.socket_dir,
+            'gids_enforced': group_names_to_group_ids(self.charm_config['groups_enforced']),
+            'gids_exempted' : group_names_to_group_ids(self.charm_config['groups_exempted']),
+        }
+
+        config.update(self.charm_config)
+        return config
+
+    def set_charm_config(self, charm_config):
+        self.charm_config = charm_config
+
+    def render_sudo_conf(self):
+        return templating.render('sudo.conf.tmpl', self.sudo_conf_path, self.get_config(),
+                                 perms=self.sudo_conf_perms, owner=self.owner, group=self.group)
+
+    def create_socket_dir(self):
+        host.mkdir(self.socket_dir, perms=self.socket_dir_perms, owner=self.owner, group=self.group)
+
+    def install_sudo_pair_so(self):
+        sudo_pair_lib = os.path.join(hookenv.charm_dir(), 'files', 'sudo_pair.so')
+        copy_file(sudo_pair_lib, self.sudo_lib_path, self.owner, self.group, self.sudo_pair_so_perms)
+
+    def copy_user_prompt(self):
+        prompt_file = os.path.join(hookenv.charm_dir(), 'files', 'sudo.prompt.user')
+        copy_file(prompt_file, self.user_prompt_path, self.owner, self.group, self.prompt_perms)
+
+    def copy_pair_prompt(self):
+        prompt_file = os.path.join(hookenv.charm_dir(), 'files', 'sudo.prompt.pair')
+        copy_file(prompt_file, self.pair_prompt_path, self.owner, self.group, self.prompt_perms)
+
+    def copy_sudoers(self):
+        sudoers_file = os.path.join(hookenv.charm_dir(), 'files', 'sudoers')
+        copy_file(sudoers_file, self.sudoers_path, self.owner, self.group, self.sudoers_perms)
+
+    def render_sudo_approve(self):
+        return templating.render('sudo_approve.tmpl', self.binary_path, self.get_config(),
+                                 perms=self.sudo_approve_perms, owner=self.owner, group=self.group)
+
+    def render_bypass_cmds(self):
+        if self.get_config()['bypass_cmds'] != "" and self.get_config()['bypass_group'] != "":
+            return templating.render('91-bypass-sudopair-cmds.tmpl', self.sudoers_bypass_path,
+                                     self.get_config(), perms=0o440, owner=self.owner, group=self.group)
+        return None
diff --git a/metadata.yaml b/metadata.yaml
new file mode 100644
index 0000000..5c24d8d
--- /dev/null
+++ b/metadata.yaml
@@ -0,0 +1,17 @@
+name: sudo-pair
+display-name: sudo-pair
+summary: sudo_pair is a sudo plugin to manage root privileges
+maintainer: Giuseppe Petralia <[e-mail]>
+description: |
+  sudo_pair is a sudo plugin that ensure that if a user tries to get root privileges,
+  he will need an authorization from a pair
+tags:
+  - ops
+series:
+  - xenial
+  - bionic
+subordinate: true
+requires:
+  juju-info:
+    interface: juju-info
+    scope: container
diff --git a/reactive/sudo_pair.py b/reactive/sudo_pair.py
new file mode 100644
index 0000000..a5de1e5
--- /dev/null
+++ b/reactive/sudo_pair.py
@@ -0,0 +1,41 @@
+from charms.reactive import when, when_not, set_state, remove_state, hook
+from charmhelpers.core import hookenv
+
+
+from libsudopair import SudoPairHelper
+
+sph = SudoPairHelper()
+
+
+@when('apt.installed.socat')
+@when_not('sudo-pair.configured')
+def install_sudo_pair():
+    # Install sudo_pair.so, create socket dir, copy sudo_approve to /usr/bin, copy prompts to /etc
+    sph.install_sudo_pair_so()
+
+    sph.create_socket_dir()
+
+    sph.copy_user_prompt()
+
+    sph.copy_pair_prompt()
+
+    sph.render_sudo_approve()
+
+    # Add "Defaults log_output to /etc/sudoers
+    sph.copy_sudoers()
+
+    # If there are cmds to bypass sudo pairing create file unders sudoers.d
+    sph.render_bypass_cmds()
+
+    # Add Plugin sudo_pair sudo_pair.so to sudo.conf
+    sph.render_sudo_conf()
+
+    set_state('sudo-pair.installed')
+    set_state('sudo-pair.configured')
+    hookenv.status_set('active', 'sudo pairing for users groups: [{}]'.format(sph.get_config()['gids_enforced']))
+
+
+@hook('config-changed')
+def reconfigure_sudo_pair_charm():
+    sph.set_charm_config(hookenv.config())
+    remove_state('sudo-pair.configured')
diff --git a/templates/91-bypass-sudopair-cmds.tmpl b/templates/91-bypass-sudopair-cmds.tmpl
new file mode 100644
index 0000000..cb54e77
--- /dev/null
+++ b/templates/91-bypass-sudopair-cmds.tmpl
@@ -0,0 +1,6 @@
+# Created by sudo-pair
+
+# Bypass Sudo Pair commands
+%{{ bypass_group }} ALL = (ALL) NOLOG_OUTPUT: {{ bypass_cmds }}
+
+
diff --git a/templates/sudo.conf.tmpl b/templates/sudo.conf.tmpl
new file mode 100644
index 0000000..db9a689
--- /dev/null
+++ b/templates/sudo.conf.tmpl
@@ -0,0 +1 @@
+Plugin sudo_pair sudo_pair.so binary_path={{ binary_path }} user_prompt_path={{ user_prompt_path }} pair_prompt_path={{ pair_prompt_path }} socket_dir={{ socket_dir }} gids_enforced={{ gids_enforced }} {% if gids_exempted != "" %}gids_exempted={{ gids_exempted }} {% endif %}
diff --git a/templates/sudo_approve.tmpl b/templates/sudo_approve.tmpl
new file mode 100755
index 0000000..7164b5a
--- /dev/null
+++ b/templates/sudo_approve.tmpl
@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+#
+# Copyright 2018 Square Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+#set -o errexit  # quit on first error
+set -o pipefail # quit on failures in pipes
+set -o nounset  # quit on unset variables
+
+[[ ${TRACE:-} ]] && set -o xtrace # output subcommands if TRACE is set
+
+declare -r SUDO_SOCKET_PATH="{{ socket_dir }}"
+
+pair() {
+    declare -r socket="${1}"
+
+    # restore TTY settings on exit
+    # shellcheck disable=SC2064
+    trap "stty $(stty -g)" EXIT
+
+    # disable line-buffering and local echo, so the pairer doesn't
+    # get confused that their typing in the shell isn't doing
+    # anything
+    stty cbreak -echo
+
+    # send SIGINT on Ctrl-D
+    stty intr "^D"
+
+    clear
+
+    # prompt the user to approve
+    socat STDIO unix-connect:"${socket}"
+}
+
+usage() {
+    echo "Usage: $(basename -- "$0") uid pid"
+    exit 1
+}
+
+main() {
+    declare -r socket_path="${1}"
+    declare -ri uid="${2}"
+    declare -ri pid="${3}"
+
+    # if we're running this under `sudo`, we want to know the original
+    # user's `uid` from `SUDO_UID`; if not, it's jsut their normal `uid`
+    declare -i ruid
+    ruid="${SUDO_UID:-$(id -u)}"
+    declare -r ruid
+
+    declare -r socket="${socket_path}/${uid}.${pid}.sock"
+
+    declare -i socket_uid socket_gid
+    socket_uid="$(stat -c '%u' "${socket}")"
+    socket_gid="$(stat -c '%g' "${socket}")"
+    declare -r socket_uid socket_gid
+
+    declare socket_user socket_group socket_mode
+    socket_user="$(getent passwd "${socket_uid}" | cut -d: -f1)"
+    socket_group="$(getent group "${socket_gid}" | cut -d: -f1)"
+    socket_mode="$(stat -c '%a' "${socket}")"
+    declare -r socket_user socket_group socket_mode
+
+    # if the user approving the command is the same as the user who
+    # invoked `sudo` in the first place, abort
+    #
+    # another option would be to allow the session, but log it in a way
+    # that it immediately pages oncall security engineers; such an
+    # approach is useful in production systems in that it allows for a
+    # in-case-of-fire-break-glass workaround so engineers can respond to
+    # a outage in the middle of the night
+    #
+    # this responsibility will be moved into the plugin itself when time
+    # allots
+    declare username
+    username="$(getent passwd "${uid}" | cut -d: -f1)"
+    declare -r username
+
+    declare log_line
+    log_line="$(date "+[%b %d %H:%M:%S] WARNING: ${username} approved is own sudo session.")"
+    declare -r log_line
+
+    if [[ "${uid}" -eq "${ruid}" ]]; then
+        {% if not auto_approve %}
+        echo "You can't approve your own session."
+        exit 1
+        {% else %}
+        echo "You are approving your own session. The incident will be logged."
+        echo ${log_line} >> /var/log/sudo_pair.log
+        {% endif %}
+    fi
+
+    # if we can write:          pair
+    # if user-owner can write:  sudo to them and try again
+    # if group-owner can write: sudo to them and try again
+    # if none, die
+    if [ -w "${socket}" ]; then
+        pair "${socket}"
+    elif [[ $(( 8#${socket_mode} & 8#200 )) -ne 0 ]]; then
+        sudo -u "${socket_user}" "${0}" "${uid}" "${pid}"
+    elif [[ $(( 8#${socket_mode} & 8#020 )) -ne 0 ]]; then
+        sudo -g "${socket_group}" "${0}" "${uid}" "${pid}"
+    else
+        echo "The socket for this sudo session is neither user- nor group-writable."
+        exit 2
+    fi
+}
+
+case "$#" in
+    2) main "${SUDO_SOCKET_PATH}" "$1" "$2" ;;
+    *) usage ;;
+esac
diff --git a/tests/00-unit b/tests/00-unit
new file mode 100755
index 0000000..d5f2e15
--- /dev/null
+++ b/tests/00-unit
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+tox -v -e unit
diff --git a/tests/01-functional b/tests/01-functional
new file mode 100755
index 0000000..946e972
--- /dev/null
+++ b/tests/01-functional
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+tox -v -e functional
diff --git a/tests/functional/requirements.txt b/tests/functional/requirements.txt
new file mode 100644
index 0000000..b9815c2
--- /dev/null
+++ b/tests/functional/requirements.txt
@@ -0,0 +1,6 @@
+juju
+requests
+pytest
+pytest-asyncio
+mock
+flake8
diff --git a/tests/functional/test_deploy.py b/tests/functional/test_deploy.py
new file mode 100644
index 0000000..28ac196
--- /dev/null
+++ b/tests/functional/test_deploy.py
@@ -0,0 +1,164 @@
+#!/usr/bin/python3.6
+
+from juju.model import Model
+import asyncio
+import json
+import pytest
+
+
+STAT_FILE = "python3 -c \"import json; import os; s=os.stat('%s'); print(json.dumps({'uid': s.st_uid, 'gid': s.st_gid, 'mode': oct(s.st_mode), 'size': s.st_size}))\""
+
+FILE_CONTENT = "python3 -c \"print(open('%s').read())\""
+
+pytestmark = pytest.mark.asyncio
+
+
[e-mail]
+async def model():
+    model = Model()
+    await model.connect_current()
+    yield model
+    await model.disconnect()
+
+
[e-mail]
+async def deploy_app(model):
+    await model.deploy(
+        'ubuntu',
+        application_name='ubuntu',
+        series='bionic',
+        channel='stable'
+    )
+    sudo_pair_app = await model.deploy(
+        'local:',
+        application_name='sudo-pair',
+        series='bionic',
+        num_units=0,
+        config={
+            'bypass_cmds': '/bin/ls',
+            'groups_enforced': 'ubuntu',
+            'bypass_group': 'warthogs',
+        }
+    )
+    await model.add_relation(
+        'ubuntu',
+        'sudo-pair'
+    )
+
+    await model.block_until(lambda: sudo_pair_app.status == 'active')
+    return sudo_pair_app
+
+
[e-mail]
+async def get_app(model):
+    for app in model.applications:
+        if app == 'sudo-pair':
+            return model.applications[app]
+
+
[e-mail]
+async def get_unit(model):
+    for app in model.applications:
+        if app == 'ubuntu':
+            return model.applications[app].units[0]
+
+
[e-mail]
+async def run_command(get_unit):
+    async def make_run_command(cmd):
+        action = await get_unit.run(cmd)
+        return action.results
+    return make_run_command
+
+
[e-mail]
+async def file_stat(run_command):
+    async def make_file_stat(path):
+        cmd = STAT_FILE % path
+        results = await run_command(cmd)
+        return json.loads(results['Stdout'])
+    return make_file_stat
+
+
[e-mail]
+async def file_contents(run_command):
+    async def make_file_contents(path):
+        cmd = FILE_CONTENT % path
+        results = await run_command(cmd)
+        return results['Stdout']
+    return make_file_contents
+
+
[e-mail]
+async def reconfigure_app(get_app):
+    async def make_reconfigure_app(cfg):
+        await get_app.set_config(cfg)
+        await get_app.get_config()
+        await asyncio.sleep(10)
+    return make_reconfigure_app
+
+
[e-mail]
+async def create_group(run_command):
+    async def make_create_group(group_name):
+        cmd = "sudo groupadd %s" % group_name
+        await run_command(cmd)
+    return make_create_group
+
+
+async def test_deploy(deploy_app):
+    status = deploy_app.status
+    assert status == 'active'
+
+
+async def test_sudo_pair_lib(file_stat):
+    sudo_pair_lib_stat = await file_stat("/usr/lib/sudo/sudo_pair.so")
+    assert sudo_pair_lib_stat['size'] > 0
+    assert sudo_pair_lib_stat['gid'] == 0
+    assert sudo_pair_lib_stat['uid'] == 0
+    assert sudo_pair_lib_stat['mode'] == '0o100644'
+
+
+async def test_sudo_approve(file_stat, file_contents):
+    sudo_approve_path = '/usr/bin/sudo_approve'
+    sudo_approve_stat = await file_stat(sudo_approve_path)
+    assert sudo_approve_stat['size'] > 0
+    assert sudo_approve_stat['gid'] == 0
+    assert sudo_approve_stat['uid'] == 0
+    assert sudo_approve_stat['mode'] == '0o100755'
+
+
+async def test_sudo_prompt(file_stat):
+    for prompt_type in ['user', 'pair']:
+        sudo_prompt_stat = await file_stat('/etc/sudo_pair.prompt.' + prompt_type)
+        assert sudo_prompt_stat['size'] > 0
+        assert sudo_prompt_stat['gid'] == 0
+        assert sudo_prompt_stat['uid'] == 0
+        assert sudo_prompt_stat['mode'] == '0o100644'
+
+
+async def test_socket_dir(file_stat):
+    dir_stat = await file_stat('/var/run/sudo_pair')
+    assert dir_stat['gid'] == 0
+    assert dir_stat['uid'] == 0
+    assert dir_stat['mode'] == '0o40644'
+
+
+async def test_sudoers(file_contents):
+    sudoers_content = await file_contents("/etc/sudoers")
+    assert 'Defaults	log_output' in sudoers_content
+
+
+async def test_sudoers_bypass_conf(file_contents):
+    sudoers_bypass_content = await file_contents("/etc/sudoers.d/91-bypass-sudopair-cmds")
+    content = '%warthogs ALL = (ALL) NOLOG_OUTPUT: /bin/ls'
+    assert content in sudoers_bypass_content
+
+
+async def test_reconfigure(reconfigure_app, file_contents, file_stat):
+    auto_approve = "false"
+    sudo_approve_path = '/usr/bin/sudo_approve'
+    await reconfigure_app({'auto_approve': auto_approve})
+    sudo_approve_content = await file_contents(sudo_approve_path)
+    new_content = 'echo "You can\'t approve your own session."'
+    assert new_content in sudo_approve_content
diff --git a/tests/tests.yaml b/tests/tests.yaml
new file mode 100644
index 0000000..193e5ac
--- /dev/null
+++ b/tests/tests.yaml
@@ -0,0 +1 @@
+tests: "[0-9]*"
diff --git a/tests/unit/conftest.py b/tests/unit/conftest.py
new file mode 100644
index 0000000..11d53a9
--- /dev/null
+++ b/tests/unit/conftest.py
@@ -0,0 +1,46 @@
+#!/usr/bin/python3
+
+import pytest
+import pwd
+import grp
+import os
+
+
[e-mail]
+def mock_hookenv_config(monkeypatch):
+    import yaml
+
+    def mock_config():
+        cfg = {}
+        yml = yaml.load(open('./config.yaml'))
+
+        # Load all defaults
+        for key, value in yml['options'].items():
+            cfg[key] = value['default']
+
+        return cfg
+
+    monkeypatch.setattr('charmhelpers.core.hookenv.config', mock_config)
+
+
[e-mail]
+def mock_charm_dir(monkeypatch):
+    monkeypatch.setattr('charmhelpers.core.hookenv.charm_dir', lambda: '.')
+
+
[e-mail]
+def sph(mock_hookenv_config, mock_charm_dir, tmpdir):
+    from libsudopair import SudoPairHelper
+    sph = SudoPairHelper()
+    sph.owner = pwd.getpwuid(os.getuid()).pw_name
+    sph.group = grp.getgrgid(os.getgid()).gr_name
+    sph.sudo_conf_path = tmpdir.join(sph.sudo_conf_path)
+    sph.socket_dir = tmpdir.join(sph.socket_dir)
+    sph.sudo_lib_path = tmpdir.join(sph.sudo_lib_path)
+    sph.user_prompt_path = tmpdir.join(sph.user_prompt_path)
+    sph.pair_prompt_path = tmpdir.join(sph.pair_prompt_path)
+    sph.sudoers_path = tmpdir.join(sph.sudoers_path)
+    sph.binary_path = tmpdir.join(sph.binary_path)
+    sph.sudoers_bypass_path = tmpdir.join(sph.sudoers_bypass_path)
+    sph.socket_dir_perms = 0o775
+    return sph
diff --git a/tests/unit/requirements.txt b/tests/unit/requirements.txt
new file mode 100644
index 0000000..081ed97
--- /dev/null
+++ b/tests/unit/requirements.txt
@@ -0,0 +1,4 @@
+charmhelpers
+charms.reactive
+pytest
+mock
diff --git a/tests/unit/test_libsudopair.py b/tests/unit/test_libsudopair.py
new file mode 100644
index 0000000..5abb33b
--- /dev/null
+++ b/tests/unit/test_libsudopair.py
@@ -0,0 +1,165 @@
+import os
+import grp
+import filecmp
+
+from libsudopair import (
+    check_valid_group,
+    group_id
+)
+
+
+def test_check_valid_group():
+    assert not check_valid_group('fake_group')
+    assert check_valid_group(grp.getgrgid(os.getgid()).gr_name)
+
+
+def test_group_id():
+    assert group_id(grp.getgrgid(os.getgid()).gr_name) == os.getgid()
+
+
+class TestSudoPairHelper():
+    def test_pytest(self):
+        assert True
+
+    def test_sph(self, sph):
+        ''' See if the ph fixture works to load charm configs '''
+        assert isinstance(sph.charm_config, dict)
+
+    def test_get_config(self, sph):
+        default_keywords = [
+            'binary_path',
+            'user_prompt_path',
+            'pair_prompt_path',
+            'socket_dir',
+            'gids_enforced',
+            'gids_exempted',
+            'extra_packages'
+        ]
+        config = sph.get_config()
+        for option in default_keywords:
+            assert option in config
+
+    def test_set_charm_config(self, sph):
+        charm_config = {
+            'groups_enforced': 'root',
+            'groups_exempted': '',
+            'bypass_cmds': '',
+            'bypass_group': '',
+            'auto_approve': True
+        }
+
+        sph.set_charm_config(charm_config)
+
+        for option in charm_config:
+            assert option in sph.get_config()
+            assert sph.get_config()[option] == charm_config[option]
+
+    def test_render_sudo_conf(self, sph, tmpdir):
+        # Default config
+        content = sph.render_sudo_conf()
+        expected_content = 'Plugin sudo_pair sudo_pair.so binary_path={} ' \
+                       'user_prompt_path={} ' \
+                       'pair_prompt_path={} socket_dir={} gids_enforced={}'.format(tmpdir.join('/usr/bin/sudo_approve'),
+                                                                                   tmpdir.join('/etc/sudo_pair.prompt.user'),
+                                                                                   tmpdir.join('/etc/sudo_pair.prompt.pair'),
+                                                                                   tmpdir.join('/var/run/sudo_pair'),
+                                                                                   '0')
+        assert expected_content in content
+
+
+        # Gid exempted
+        groups_exempted = grp.getgrgid(os.getgid()).gr_name
+        charm_config = {
+            'groups_enforced': 'root',
+            'groups_exempted': groups_exempted,
+            'bypass_cmds': '',
+            'bypass_group': '',
+            'auto_approve': True
+        }
+
+        sph.set_charm_config(charm_config)
+        expected_content = \
+            'Plugin sudo_pair sudo_pair.so binary_path={} user_prompt_path={} ' \
+            'pair_prompt_path={} socket_dir={} gids_enforced={} gids_exempted={}'.format(
+                tmpdir.join('/usr/bin/sudo_approve'),
+                tmpdir.join('/etc/sudo_pair.prompt.user'),
+                tmpdir.join('/etc/sudo_pair.prompt.pair'),
+                tmpdir.join('/var/run/sudo_pair'), '0', os.getgid())
+
+        content = sph.render_sudo_conf()
+        assert expected_content in content
+
+        # Groups enforced
+        groups_enforced = 'root,' + grp.getgrgid(os.getgid()).gr_name
+        charm_config = {
+            'groups_enforced': groups_enforced,
+            'groups_exempted': '',
+            'bypass_cmds': '',
+            'bypass_group': '',
+            'auto_approve': True
+        }
+        sph.set_charm_config(charm_config)
+        expected_content = 'Plugin sudo_pair sudo_pair.so binary_path={} user_prompt_path={} ' \
+                           'pair_prompt_path={} socket_dir={} gids_enforced={}'.format(
+            tmpdir.join('/usr/bin/sudo_approve'),
+            tmpdir.join('/etc/sudo_pair.prompt.user'),
+            tmpdir.join('/etc/sudo_pair.prompt.pair'),
+            tmpdir.join('/var/run/sudo_pair'), '0,' + str(os.getgid()))
+        content = sph.render_sudo_conf()
+        assert expected_content in content
+
+    def test_render_bypass_cmds(self, sph, tmpdir):
+        # Root bypass /bin/ls
+        expected_content = '%root ALL = (ALL) NOLOG_OUTPUT: /bin/ls'
+        charm_config = {
+            'groups_enforced': 'root',
+            'groups_exempted': '',
+            'bypass_cmds': '/bin/ls',
+            'bypass_group': 'root',
+            'auto_approve': True
+        }
+        sph.set_charm_config(charm_config)
+        content = sph.render_bypass_cmds()
+        assert expected_content in content
+
+    def test_render_sudo_approve(self, sph, tmpdir):
+        # Auto Approve true
+        expected_content = 'echo ${log_line} >> /var/log/sudo_pair.log'
+        socket_dir = tmpdir.join('/var/run/sudo_pair')
+        expected_content_socket_dir = 'declare -r SUDO_SOCKET_PATH="{}"'.format(socket_dir)
+        content = sph.render_sudo_approve()
+        assert expected_content in content
+        assert expected_content_socket_dir in content
+
+        # Auto Approve false
+        expected_content = 'echo "You can\'t approve your own session."'
+        charm_config = {
+            'groups_enforced': 'root',
+            'groups_exempted': '',
+            'bypass_cmds': '/bin/ls',
+            'bypass_group': 'root',
+            'auto_approve': False
+        }
+        sph.set_charm_config(charm_config)
+        content = sph.render_sudo_approve()
+        assert expected_content in content
+
+    def test_create_socket_dir(self, sph, tmpdir):
+        sph.create_socket_dir()
+        assert os.path.exists(tmpdir.join('/var/run/sudo_pair'))
+
+    def test_install_sudo_pair_so(self, sph, tmpdir):
+        sph.install_sudo_pair_so()
+        assert filecmp.cmp('./files/sudo_pair.so', tmpdir.join('/usr/lib/sudo/sudo_pair.so'))
+
+    def test_copy_user_prompt(self, sph, tmpdir):
+        sph.copy_user_prompt()
+        assert filecmp.cmp('./files/sudo.prompt.user', tmpdir.join('/etc/sudo_pair.prompt.user'))
+
+    def test_copy_pair_prompt(self, sph, tmpdir):
+        sph.copy_pair_prompt()
+        assert filecmp.cmp('./files/sudo.prompt.pair', tmpdir.join('/etc/sudo_pair.prompt.pair'))
+
+    def test_copy_sudoers(self, sph, tmpdir):
+        sph.copy_sudoers()
+        assert filecmp.cmp('./files/sudoers', tmpdir.join('/etc/sudoers'))
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..3750c4a
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,17 @@
+[tox]
+skipsdist=True
+envlist = unit, functional
+skip_missing_interpreters = True
+
+[testenv]
+basepython = python3.6
+
+[testenv:unit]
+commands = pytest -v --ignore {toxinidir}/tests/amulet --ignore {toxinidir}/tests/functional
+deps = -r{toxinidir}/tests/unit/requirements.txt
+setenv = PYTHONPATH={toxinidir}/lib
+
+[testenv:functional]
+passenv = HOME
+commands = pytest -v --ignore {toxinidir}/tests/unit --ignore {toxinidir}/tests/amulet
+deps = -r{toxinidir}/tests/functional/requirements.txt