tests from internal repo
This commit is contained in:
pdancak
parent
0dde6486a2
commit
f06986684f
7 changed files with 462 additions and 0 deletions
28
Regression/authd-PIE-and-RELRO-check/main.fmf
Normal file
28
Regression/authd-PIE-and-RELRO-check/main.fmf
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
summary: Test for BZ#1092568 (authd - PIE and RELRO check)
|
||||
description: |
|
||||
Bug summary: authd - PIE and RELRO check
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1092568
|
||||
contact: Petr Dancak <pdancak@redhat.com>
|
||||
component:
|
||||
- authd
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
recommend:
|
||||
- authd
|
||||
- elfutils
|
||||
duration: 20m
|
||||
enabled: true
|
||||
tag:
|
||||
- NoRHEL4
|
||||
- NoRHEL5
|
||||
- TIPpass
|
||||
link:
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1092568
|
||||
adjust:
|
||||
- enabled: false
|
||||
when: distro < rhel-7
|
||||
continue: false
|
||||
extra-nitrate: TC#0498223
|
||||
extra-summary: /CoreOS/authd/Regression/authd-PIE-and-RELRO-check
|
||||
extra-task: /CoreOS/authd/Regression/authd-PIE-and-RELRO-check
|
||||
id: 27cccd17-0a1b-434e-91e9-037a71e1e1d8
|
||||
54
Regression/authd-PIE-and-RELRO-check/runtest.sh
Executable file
54
Regression/authd-PIE-and-RELRO-check/runtest.sh
Executable file
|
|
@ -0,0 +1,54 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/authd/Regression/authd-PIE-and-RELRO-check
|
||||
# Description: Test for BZ#1092568 (authd - PIE and RELRO check)
|
||||
# Author: Robin Hack <rhack@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="authd"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
# Check ELF program header
|
||||
rlRun -s "eu-readelf --program-headers /usr/sbin/in.authd"
|
||||
rlAssertGrep "GNU_RELRO" "$rlRun_LOG"
|
||||
rlAssertGrep "RELRO" "$rlRun_LOG"
|
||||
rlRun -s "eu-readelf --dynamic /usr/sbin/in.authd"
|
||||
rlAssertGrep "BIND_NOW" "$rlRun_LOG"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
31
Regression/authd-nouser-error-check/main.fmf
Normal file
31
Regression/authd-nouser-error-check/main.fmf
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
summary: Test for fixed bug 1722492
|
||||
description: ''
|
||||
contact: Petr Dancak <pdancak@redhat.com>
|
||||
component:
|
||||
- authd
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
recommend:
|
||||
- nmap-ncat
|
||||
- authd
|
||||
duration: 5m
|
||||
enabled: true
|
||||
tag:
|
||||
- NoRHEL4
|
||||
- NoRHEL5
|
||||
- TIPpass_Apps
|
||||
link:
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1722492
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1730802
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731985
|
||||
adjust:
|
||||
- enabled: false
|
||||
when: distro == rhel-4, rhel-5
|
||||
continue: false
|
||||
- enabled: false
|
||||
when: arch == s390x
|
||||
continue: false
|
||||
extra-nitrate: TC#0602331
|
||||
extra-summary: /CoreOS/authd/Regression/authd-nouser-error-check
|
||||
extra-task: /CoreOS/authd/Regression/authd-nouser-error-check
|
||||
id: 282ae194-7f15-4a58-a143-ee07078bdf53
|
||||
56
Regression/authd-nouser-error-check/runtest.sh
Executable file
56
Regression/authd-nouser-error-check/runtest.sh
Executable file
|
|
@ -0,0 +1,56 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/authd/Regression/bz1722492-a-few-descriptive-words
|
||||
# Description: Test for fixed bug 1722492
|
||||
# Author: Petr Dancak <pdancak@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="authd"
|
||||
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
DESTPORT="12345"
|
||||
SRCPORT="23456"
|
||||
rlRun "systemctl start auth.socket" 0 "start auth.socket"
|
||||
rlRun "ncat -4 --chat -l $DESTPORT > /dev/null &"
|
||||
rlRun "cat /dev/random | ncat -4 -p $SRCPORT localhost $DESTPORT > /dev/null &"
|
||||
rlRun "echo -n $SRCPORT,$DESTPORT | ncat -4 localhost 113 | grep -q NO-USER" 1
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "kill -9 `pidof ncat`"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
28
Regression/authd-returns-a-negative-uid/main.fmf
Normal file
28
Regression/authd-returns-a-negative-uid/main.fmf
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
summary: Test for BZ#965857 (authd returns a negative uid)
|
||||
description: |
|
||||
Bug summary: authd returns a negative uid
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=965857
|
||||
contact: Petr Dancak <pdancak@redhat.com>
|
||||
component:
|
||||
- authd
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
recommend:
|
||||
- authd
|
||||
- gcc
|
||||
duration: 5m
|
||||
enabled: true
|
||||
tag:
|
||||
- TIPpass
|
||||
- TIPpass_Apps
|
||||
link:
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=994118
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=965857
|
||||
adjust:
|
||||
- enabled: false
|
||||
when: distro < rhel-8
|
||||
continue: false
|
||||
extra-nitrate: TC#0301567
|
||||
extra-summary: /CoreOS/authd/Regression/authd-returns-a-negative-uid
|
||||
extra-task: /CoreOS/authd/Regression/authd-returns-a-negative-uid
|
||||
id: ae7d42fd-067b-49ee-8957-b883582a52d2
|
||||
202
Regression/authd-returns-a-negative-uid/reproducer.c
Normal file
202
Regression/authd-returns-a-negative-uid/reproducer.c
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
/*
|
||||
Modified version of Modified version of origin reproducer
|
||||
Modified by: Robin Hack <rhack@redhat.com>
|
||||
Modified Modified by: Petr Dancak <pdancak@redhat.com>
|
||||
*/
|
||||
#define _GNU_SOURCE
|
||||
|
||||
#include <arpa/inet.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
#include <semaphore.h>
|
||||
#include <sys/ipc.h>
|
||||
#include <sys/shm.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
|
||||
typedef struct shared {
|
||||
sem_t lock;
|
||||
int client_port;
|
||||
sem_t lock_client;
|
||||
} shared_t;
|
||||
|
||||
#define SHMSZ sizeof(shared_t)
|
||||
|
||||
static int magic_port = 10001;
|
||||
|
||||
static key_t mem_key = 66666;
|
||||
|
||||
void run_client (void)
|
||||
{
|
||||
#ifdef MORE_EVIL
|
||||
setuid (-1);
|
||||
#endif
|
||||
int shmid = 0;
|
||||
shared_t *shm = NULL;
|
||||
if ((shmid = shmget(mem_key, SHMSZ, 0666)) < 0) {
|
||||
perror("child shmget");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) {
|
||||
perror("child shmat");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
sem_wait (&shm->lock_client);
|
||||
|
||||
int client_fd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
if ( client_fd < 0) {
|
||||
perror ("choild socket");
|
||||
exit (1);
|
||||
}
|
||||
struct sockaddr_in client;
|
||||
memset (&client, 0, sizeof (client));
|
||||
client.sin_family = AF_INET;
|
||||
client.sin_port = htons(magic_port);
|
||||
inet_pton(AF_INET, "127.0.0.1", &client.sin_addr);
|
||||
|
||||
int conn = connect(client_fd, (struct sockaddr *) &client, sizeof(client));
|
||||
if (conn < 0) {
|
||||
perror ("child connect");
|
||||
}
|
||||
|
||||
sem_wait (&shm->lock_client);
|
||||
}
|
||||
|
||||
void run_authd (void)
|
||||
{
|
||||
int shmid = 0;
|
||||
shared_t *shm = NULL;
|
||||
if ((shmid = shmget(mem_key, SHMSZ, 0666)) < 0) {
|
||||
perror("child shmget");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) {
|
||||
perror("child shmat");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
sem_wait (&shm->lock);
|
||||
printf("run authd under: UID: %d, EUID: %d\n", (int) getuid(), (int) geteuid());
|
||||
|
||||
char *cmd = NULL;
|
||||
asprintf (&cmd, "echo \"%d,%d\" | `which in.authd` -t60 --xerror --os -E", shm->client_port, magic_port);
|
||||
printf ("%s\n", cmd);
|
||||
system (cmd);
|
||||
free (cmd);
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
int server_fd, val = 1;
|
||||
int ret = -66;
|
||||
|
||||
if (argc != 2) {
|
||||
return (1);
|
||||
}
|
||||
|
||||
/* allocate shared memory */
|
||||
int shmid;
|
||||
shared_t *shm = NULL;
|
||||
if ((shmid = shmget(mem_key, SHMSZ, IPC_CREAT | 0666)) < 0) {
|
||||
perror("shmget");
|
||||
exit(1);
|
||||
}
|
||||
if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) {
|
||||
perror("shmat");
|
||||
exit(1);
|
||||
}
|
||||
if (sem_init(&shm->lock, 1, 0) < 0) {
|
||||
return (11);
|
||||
}
|
||||
|
||||
if (sem_init(&shm->lock_client, 1, 0) < 0) {
|
||||
return (11);
|
||||
}
|
||||
/* we need fork before setuid */
|
||||
const int pid = fork ();
|
||||
if (pid < 0) {
|
||||
return (10);
|
||||
}
|
||||
|
||||
if (pid == 0) {
|
||||
run_authd ();
|
||||
exit (0);
|
||||
}
|
||||
|
||||
const int pid_client = fork ();
|
||||
if (pid_client < 0) {
|
||||
return (10);
|
||||
}
|
||||
|
||||
if (pid_client == 0) {
|
||||
run_client ();
|
||||
exit (0);
|
||||
}
|
||||
|
||||
const int uid = atoi(argv[1]);
|
||||
if (setuid(uid) == -1) {
|
||||
perror ("setuid failed");
|
||||
return (2);
|
||||
}
|
||||
printf("UID: %d, EUID: %d\n", (int) getuid(), (int) geteuid());
|
||||
|
||||
server_fd = socket(AF_INET, SOCK_STREAM, 0);
|
||||
if (server_fd == -1) {
|
||||
perror ("socket");
|
||||
return (3);
|
||||
}
|
||||
|
||||
// reuse if in TIME_WAIT
|
||||
if (setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val))) {
|
||||
perror ("setsockopt");
|
||||
return (4);
|
||||
}
|
||||
|
||||
struct sockaddr_in server;
|
||||
int server_size = sizeof (server);
|
||||
memset(&server, 0, server_size);
|
||||
server.sin_family = AF_INET;
|
||||
server.sin_port = htons(magic_port);
|
||||
server.sin_addr.s_addr = htonl(INADDR_ANY);
|
||||
if (bind(server_fd, (struct sockaddr *) &server, sizeof(server))) {
|
||||
perror ("bind");
|
||||
return (5);
|
||||
}
|
||||
|
||||
if (listen(server_fd, 10)) {
|
||||
perror ("listen");
|
||||
return (6);
|
||||
}
|
||||
|
||||
//run_client ();
|
||||
sem_post (&shm->lock_client);
|
||||
|
||||
int conn_fd = accept (server_fd, (struct sockaddr *) &server, &server_size);
|
||||
if (conn_fd < 0) {
|
||||
ret = -7;
|
||||
goto finish;
|
||||
}
|
||||
|
||||
ret = 0;
|
||||
finish:
|
||||
shm->client_port = ntohs(server.sin_port);
|
||||
/* unlock semaphore */
|
||||
sem_post (&shm->lock);
|
||||
waitpid (pid, NULL, 0);
|
||||
sem_post (&shm->lock_client);
|
||||
waitpid (pid_client, NULL, 0);
|
||||
sem_destroy (&shm->lock);
|
||||
close (conn_fd);
|
||||
if (close(server_fd)) {
|
||||
return (7);
|
||||
}
|
||||
|
||||
return (ret);
|
||||
}
|
||||
63
Regression/authd-returns-a-negative-uid/runtest.sh
Executable file
63
Regression/authd-returns-a-negative-uid/runtest.sh
Executable file
|
|
@ -0,0 +1,63 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/authd/Regression/bz965857-authd-returns-a-negative-uid
|
||||
# Description: Test for BZ#965857 (authd returns a negative uid)
|
||||
# Author: Robin Hack <rhack@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="authd"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TESTDIR=\${PWD}"
|
||||
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "gcc -o ${TmpDir}/reproducer ./reproducer.c -lpthread"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Without negative UID"
|
||||
rlRun "./reproducer 0 > TESTOUT" 0 "Trying good argument"
|
||||
rlAssertNotGrep "ERROR :NO-USER" "TESTOUT"
|
||||
rlAssertNotGrep "ERROR :X-UID" "TESTOUT"
|
||||
rlAssertGrep "USERID : OTHER" "TESTOUT"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "WITH negative UID"
|
||||
rlRun "./reproducer -1 > TESTOUT" 2 "Trying bad argument"
|
||||
rlAssertNotGrep "ERROR :NO-USER" "TESTOUT"
|
||||
rlAssertNotGrep "ERROR :X-UID" "TESTOUT"
|
||||
rlAssertNotGrep "USERID : OTHER" "TESTOUT"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
Loading…
Add table
Add a link
Reference in a new issue