removing old and not functional tests
This commit is contained in:
Petr Sklenar
parent
598c60cf2d
commit
adea6f7c8b
4 changed files with 0 additions and 229 deletions
|
|
@ -1,66 +0,0 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/bind/Regression/bz441495_privileges
|
||||
# Description: Test for bz441495 (No reason for bind binaries to be protected)
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
#
|
||||
# This test is a port of original written by psklenar to RHEL6.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/bind/Regression/bz441495_privileges
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include $(realpath /usr/share/rhts/lib/rhts-make.include)
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Martin Cermak <mcermak@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for bz441495 (No reason for bind binaries to be protected)" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind bind-chroot caching-nameserver bind-utils" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Bug: 441495" >> $(METADATA)
|
||||
|
||||
[ -x /usr/bin/rhts-lint ] && rhts-lint $(METADATA)
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
PURPOSE of /CoreOS/bind/Regression/bz441495_privileges
|
||||
Description: Test for bz441495 (No reason for bind binaries to be protected)
|
||||
Author: Martin Cermak <mcermak@redhat.com>
|
||||
Bug summary: No reason for bind binaries to be protected
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=441495
|
||||
|
||||
Description:
|
||||
|
||||
This test is a port of original written by psklenar to RHEL6
|
||||
|
||||
I set up a new RHEL 5 nameserver today, and the named user is unable to use rndc
|
||||
(despite having permission to read the rndc.conf/rndc.key files). I realized
|
||||
that the rndc binary (and all of the other binaries from the bind RPM) are only
|
||||
readable by root.
|
||||
|
||||
There is no reason for this protection, as none of the binaries are
|
||||
setuid/setgid or contain private information (especially since anyone could
|
||||
build their own copy of bind, even from the RHEL SRPM, to get the same rndc
|
||||
functionality). This permission setting just means that access cannot be
|
||||
delegated, which is actually less secure (as now more system operation can only
|
||||
be done as root).
|
||||
|
||||
This is also an issue with the Fedora bind RPM, although there some (but not
|
||||
all) binaries have been changed to world-readable/executable (see BZ 200465 and
|
||||
BZ 427826 for example).
|
||||
|
||||
Description of test (psklenar):
|
||||
|
||||
- all executables in bind packages (yum list |grep '^bind', caching-nameserver)
|
||||
should be readable/executable by others - check it.
|
||||
- also check that configuration files (/etc/named*, /etc/rndc.*, /var/named/*
|
||||
subtree) are non-readable by others
|
||||
- don't neglect this step, it is important to have config files hidden! (I might
|
||||
omit something, it's unlikely but might happen)
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
summary: Test for bz441495 (No reason for bind binaries to be protected)
|
||||
description: |-
|
||||
Bug summary: No reason for bind binaries to be protected
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=441495
|
||||
|
||||
Description:
|
||||
|
||||
This test is a port of original written by psklenar to RHEL6
|
||||
|
||||
I set up a new RHEL 5 nameserver today, and the named user is unable to use rndc
|
||||
(despite having permission to read the rndc.conf/rndc.key files). I realized
|
||||
that the rndc binary (and all of the other binaries from the bind RPM) are only
|
||||
readable by root.
|
||||
|
||||
There is no reason for this protection, as none of the binaries are
|
||||
setuid/setgid or contain private information (especially since anyone could
|
||||
build their own copy of bind, even from the RHEL SRPM, to get the same rndc
|
||||
functionality). This permission setting just means that access cannot be
|
||||
delegated, which is actually less secure (as now more system operation can only
|
||||
be done as root).
|
||||
|
||||
This is also an issue with the Fedora bind RPM, although there some (but not
|
||||
all) binaries have been changed to world-readable/executable (see BZ 200465 and
|
||||
BZ 427826 for example).
|
||||
|
||||
Description of test (psklenar):
|
||||
|
||||
- all executables in bind packages (yum list |grep '^bind', caching-nameserver)
|
||||
should be readable/executable by others - check it.
|
||||
- also check that configuration files (/etc/named*, /etc/rndc.*, /var/named/*
|
||||
subtree) are non-readable by others
|
||||
- don't neglect this step, it is important to have config files hidden! (I might
|
||||
omit something, it's unlikely but might happen)
|
||||
contact: Petr Sklenar <psklenar@redhat.com>
|
||||
component:
|
||||
- bind
|
||||
test: ./runtest.sh
|
||||
require:
|
||||
- bind
|
||||
- bind-chroot
|
||||
- caching-nameserver
|
||||
- bind-utils
|
||||
duration: 5m
|
||||
enabled: true
|
||||
tag:
|
||||
- TIPfail_infra
|
||||
- TIPpass
|
||||
- Tier2
|
||||
tier: '2'
|
||||
extra-summary: /CoreOS/bind/Regression/bz441495_privileges
|
||||
extra-task: /CoreOS/bind/Regression/bz441495_privileges
|
||||
extra-nitrate: TC#0126562
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Regression/bz441495_privileges
|
||||
# Description: Test for bz441495 (No reason for bind binaries to be protected)
|
||||
# Author: Martin Cermak <mcermak@redhat.com>
|
||||
#
|
||||
# This test is a port of original written by psklenar to RHEL6.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include rhts environment
|
||||
. /usr/bin/rhts-environment.sh
|
||||
. /usr/lib/beakerlib/beakerlib.sh
|
||||
|
||||
PACKAGE="bind"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
|
||||
if rpm -q bind97; then
|
||||
rlAssertRpm bind97-chroot
|
||||
rlAssertRpm bind97-utils
|
||||
else
|
||||
rlAssertRpm bind-chroot
|
||||
rlAssertRpm bind-utils
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlLog "Checking privileges of executables..."
|
||||
for pkgitem in `rpm -ql bind | grep "/usr/sbin"`; do
|
||||
if [ -f $pkgitem ] && [ -x $pkgitem ]; then
|
||||
rlRun "ls -Hla $pkgitem | grep \"^-rwxr-xr-x\""
|
||||
rlRun "[ -u $pkgitem ]" 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Since rhel8 Thu Jul 12 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.3-15
|
||||
# Use new config file named-chroot.files for chroot setup (#1429656)
|
||||
ls -Hla /etc/named* | grep -v "\.key$" | grep "^-rw-r--r--.*named-chroot" > list2
|
||||
ls -Hla /etc/named* /etc/rndc.* | grep -v "\.key$" | grep "^-" > list1
|
||||
ls -Hla /etc/named* /etc/rndc.* | grep -v "\.key$" | grep "^-rw-r-----" >> list2
|
||||
rlRun "diff list1 list2" 0 "Checking privileges of configs, logs and other related files."
|
||||
|
||||
ls -dHla /var/named | grep "^d" > list1
|
||||
ls -dHla /var/named | grep "^drwxr[w-]x--[T-]" > list2
|
||||
rlRun "diff list1 list2" 0 "Checking privileges of /var/named directory."
|
||||
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalEnd
|
||||
Loading…
Add table
Add a link
Reference in a new issue