diff --git a/Regression/authd-PIE-and-RELRO-check/main.fmf b/Regression/authd-PIE-and-RELRO-check/main.fmf new file mode 100644 index 0000000..d98d821 --- /dev/null +++ b/Regression/authd-PIE-and-RELRO-check/main.fmf @@ -0,0 +1,28 @@ +summary: Test for BZ#1092568 (authd - PIE and RELRO check) +description: | + Bug summary: authd - PIE and RELRO check + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1092568 +contact: Petr Dancak +component: + - authd +test: ./runtest.sh +framework: beakerlib +recommend: + - authd + - elfutils +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1092568 +adjust: + - enabled: false + when: distro < rhel-7 + continue: false +extra-nitrate: TC#0498223 +extra-summary: /CoreOS/authd/Regression/authd-PIE-and-RELRO-check +extra-task: /CoreOS/authd/Regression/authd-PIE-and-RELRO-check +id: 27cccd17-0a1b-434e-91e9-037a71e1e1d8 diff --git a/Regression/authd-PIE-and-RELRO-check/runtest.sh b/Regression/authd-PIE-and-RELRO-check/runtest.sh new file mode 100755 index 0000000..57a9b2d --- /dev/null +++ b/Regression/authd-PIE-and-RELRO-check/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/authd/Regression/authd-PIE-and-RELRO-check +# Description: Test for BZ#1092568 (authd - PIE and RELRO check) +# Author: Robin Hack +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="authd" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + # Check ELF program header + rlRun -s "eu-readelf --program-headers /usr/sbin/in.authd" + rlAssertGrep "GNU_RELRO" "$rlRun_LOG" + rlAssertGrep "RELRO" "$rlRun_LOG" + rlRun -s "eu-readelf --dynamic /usr/sbin/in.authd" + rlAssertGrep "BIND_NOW" "$rlRun_LOG" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Regression/authd-nouser-error-check/main.fmf b/Regression/authd-nouser-error-check/main.fmf new file mode 100644 index 0000000..3a8c1aa --- /dev/null +++ b/Regression/authd-nouser-error-check/main.fmf @@ -0,0 +1,31 @@ +summary: Test for fixed bug 1722492 +description: '' +contact: Petr Dancak +component: + - authd +test: ./runtest.sh +framework: beakerlib +recommend: + - nmap-ncat + - authd +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Apps +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1722492 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1730802 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731985 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - enabled: false + when: arch == s390x + continue: false +extra-nitrate: TC#0602331 +extra-summary: /CoreOS/authd/Regression/authd-nouser-error-check +extra-task: /CoreOS/authd/Regression/authd-nouser-error-check +id: 282ae194-7f15-4a58-a143-ee07078bdf53 diff --git a/Regression/authd-nouser-error-check/runtest.sh b/Regression/authd-nouser-error-check/runtest.sh new file mode 100755 index 0000000..675774b --- /dev/null +++ b/Regression/authd-nouser-error-check/runtest.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/authd/Regression/bz1722492-a-few-descriptive-words +# Description: Test for fixed bug 1722492 +# Author: Petr Dancak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="authd" + + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + DESTPORT="12345" + SRCPORT="23456" + rlRun "systemctl start auth.socket" 0 "start auth.socket" + rlRun "ncat -4 --chat -l $DESTPORT > /dev/null &" + rlRun "cat /dev/random | ncat -4 -p $SRCPORT localhost $DESTPORT > /dev/null &" + rlRun "echo -n $SRCPORT,$DESTPORT | ncat -4 localhost 113 | grep -q NO-USER" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "kill -9 `pidof ncat`" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Regression/authd-returns-a-negative-uid/main.fmf b/Regression/authd-returns-a-negative-uid/main.fmf new file mode 100644 index 0000000..b573475 --- /dev/null +++ b/Regression/authd-returns-a-negative-uid/main.fmf @@ -0,0 +1,28 @@ +summary: Test for BZ#965857 (authd returns a negative uid) +description: | + Bug summary: authd returns a negative uid + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=965857 +contact: Petr Dancak +component: + - authd +test: ./runtest.sh +framework: beakerlib +recommend: + - authd + - gcc +duration: 5m +enabled: true +tag: + - TIPpass + - TIPpass_Apps +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=994118 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965857 +adjust: + - enabled: false + when: distro < rhel-8 + continue: false +extra-nitrate: TC#0301567 +extra-summary: /CoreOS/authd/Regression/authd-returns-a-negative-uid +extra-task: /CoreOS/authd/Regression/authd-returns-a-negative-uid +id: ae7d42fd-067b-49ee-8957-b883582a52d2 diff --git a/Regression/authd-returns-a-negative-uid/reproducer.c b/Regression/authd-returns-a-negative-uid/reproducer.c new file mode 100644 index 0000000..c710aaf --- /dev/null +++ b/Regression/authd-returns-a-negative-uid/reproducer.c @@ -0,0 +1,202 @@ +/* +Modified version of Modified version of origin reproducer +Modified by: Robin Hack +Modified Modified by: Petr Dancak +*/ +#define _GNU_SOURCE + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +typedef struct shared { + sem_t lock; + int client_port; + sem_t lock_client; +} shared_t; + +#define SHMSZ sizeof(shared_t) + +static int magic_port = 10001; + +static key_t mem_key = 66666; + +void run_client (void) +{ +#ifdef MORE_EVIL + setuid (-1); +#endif + int shmid = 0; + shared_t *shm = NULL; + if ((shmid = shmget(mem_key, SHMSZ, 0666)) < 0) { + perror("child shmget"); + exit(1); + } + + if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) { + perror("child shmat"); + exit(1); + } + + sem_wait (&shm->lock_client); + + int client_fd = socket(AF_INET, SOCK_STREAM, 0); + if ( client_fd < 0) { + perror ("choild socket"); + exit (1); + } + struct sockaddr_in client; + memset (&client, 0, sizeof (client)); + client.sin_family = AF_INET; + client.sin_port = htons(magic_port); + inet_pton(AF_INET, "127.0.0.1", &client.sin_addr); + + int conn = connect(client_fd, (struct sockaddr *) &client, sizeof(client)); + if (conn < 0) { + perror ("child connect"); + } + + sem_wait (&shm->lock_client); +} + +void run_authd (void) +{ + int shmid = 0; + shared_t *shm = NULL; + if ((shmid = shmget(mem_key, SHMSZ, 0666)) < 0) { + perror("child shmget"); + exit(1); + } + + if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) { + perror("child shmat"); + exit(1); + } + + sem_wait (&shm->lock); + printf("run authd under: UID: %d, EUID: %d\n", (int) getuid(), (int) geteuid()); + + char *cmd = NULL; + asprintf (&cmd, "echo \"%d,%d\" | `which in.authd` -t60 --xerror --os -E", shm->client_port, magic_port); + printf ("%s\n", cmd); + system (cmd); + free (cmd); +} + +int main(int argc, char **argv) +{ + int server_fd, val = 1; + int ret = -66; + + if (argc != 2) { + return (1); + } + + /* allocate shared memory */ + int shmid; + shared_t *shm = NULL; + if ((shmid = shmget(mem_key, SHMSZ, IPC_CREAT | 0666)) < 0) { + perror("shmget"); + exit(1); + } + if ((shm = shmat(shmid, NULL, 0)) == (shared_t *) -1) { + perror("shmat"); + exit(1); + } + if (sem_init(&shm->lock, 1, 0) < 0) { + return (11); + } + + if (sem_init(&shm->lock_client, 1, 0) < 0) { + return (11); + } + /* we need fork before setuid */ + const int pid = fork (); + if (pid < 0) { + return (10); + } + + if (pid == 0) { + run_authd (); + exit (0); + } + + const int pid_client = fork (); + if (pid_client < 0) { + return (10); + } + + if (pid_client == 0) { + run_client (); + exit (0); + } + + const int uid = atoi(argv[1]); + if (setuid(uid) == -1) { + perror ("setuid failed"); + return (2); + } + printf("UID: %d, EUID: %d\n", (int) getuid(), (int) geteuid()); + + server_fd = socket(AF_INET, SOCK_STREAM, 0); + if (server_fd == -1) { + perror ("socket"); + return (3); + } + + // reuse if in TIME_WAIT + if (setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val))) { + perror ("setsockopt"); + return (4); + } + + struct sockaddr_in server; + int server_size = sizeof (server); + memset(&server, 0, server_size); + server.sin_family = AF_INET; + server.sin_port = htons(magic_port); + server.sin_addr.s_addr = htonl(INADDR_ANY); + if (bind(server_fd, (struct sockaddr *) &server, sizeof(server))) { + perror ("bind"); + return (5); + } + + if (listen(server_fd, 10)) { + perror ("listen"); + return (6); + } + + //run_client (); + sem_post (&shm->lock_client); + + int conn_fd = accept (server_fd, (struct sockaddr *) &server, &server_size); + if (conn_fd < 0) { + ret = -7; + goto finish; + } + + ret = 0; +finish: + shm->client_port = ntohs(server.sin_port); + /* unlock semaphore */ + sem_post (&shm->lock); + waitpid (pid, NULL, 0); + sem_post (&shm->lock_client); + waitpid (pid_client, NULL, 0); + sem_destroy (&shm->lock); + close (conn_fd); + if (close(server_fd)) { + return (7); + } + + return (ret); +} diff --git a/Regression/authd-returns-a-negative-uid/runtest.sh b/Regression/authd-returns-a-negative-uid/runtest.sh new file mode 100755 index 0000000..730bd16 --- /dev/null +++ b/Regression/authd-returns-a-negative-uid/runtest.sh @@ -0,0 +1,63 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/authd/Regression/bz965857-authd-returns-a-negative-uid +# Description: Test for BZ#965857 (authd returns a negative uid) +# Author: Robin Hack +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="authd" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TESTDIR=\${PWD}" + + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "gcc -o ${TmpDir}/reproducer ./reproducer.c -lpthread" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest "Without negative UID" + rlRun "./reproducer 0 > TESTOUT" 0 "Trying good argument" + rlAssertNotGrep "ERROR :NO-USER" "TESTOUT" + rlAssertNotGrep "ERROR :X-UID" "TESTOUT" + rlAssertGrep "USERID : OTHER" "TESTOUT" + rlPhaseEnd + + rlPhaseStartTest "WITH negative UID" + rlRun "./reproducer -1 > TESTOUT" 2 "Trying bad argument" + rlAssertNotGrep "ERROR :NO-USER" "TESTOUT" + rlAssertNotGrep "ERROR :X-UID" "TESTOUT" + rlAssertNotGrep "USERID : OTHER" "TESTOUT" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd