diff --git a/Regression/bz441495_privileges/Makefile b/Regression/bz441495_privileges/Makefile deleted file mode 100644 index 28e31f9..0000000 --- a/Regression/bz441495_privileges/Makefile +++ /dev/null @@ -1,66 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/bind/Regression/bz441495_privileges -# Description: Test for bz441495 (No reason for bind binaries to be protected) -# Author: Martin Cermak -# -# This test is a port of original written by psklenar to RHEL6. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/bind/Regression/bz441495_privileges -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include $(realpath /usr/share/rhts/lib/rhts-make.include) - -$(METADATA): Makefile - @echo "Owner: Martin Cermak " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test for bz441495 (No reason for bind binaries to be protected)" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: bind" >> $(METADATA) - @echo "Requires: bind bind-chroot caching-nameserver bind-utils" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Bug: 441495" >> $(METADATA) - - [ -x /usr/bin/rhts-lint ] && rhts-lint $(METADATA) diff --git a/Regression/bz441495_privileges/PURPOSE b/Regression/bz441495_privileges/PURPOSE deleted file mode 100644 index df01fa1..0000000 --- a/Regression/bz441495_privileges/PURPOSE +++ /dev/null @@ -1,34 +0,0 @@ -PURPOSE of /CoreOS/bind/Regression/bz441495_privileges -Description: Test for bz441495 (No reason for bind binaries to be protected) -Author: Martin Cermak -Bug summary: No reason for bind binaries to be protected -Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=441495 - -Description: - -This test is a port of original written by psklenar to RHEL6 - -I set up a new RHEL 5 nameserver today, and the named user is unable to use rndc -(despite having permission to read the rndc.conf/rndc.key files). I realized -that the rndc binary (and all of the other binaries from the bind RPM) are only -readable by root. - -There is no reason for this protection, as none of the binaries are -setuid/setgid or contain private information (especially since anyone could -build their own copy of bind, even from the RHEL SRPM, to get the same rndc -functionality). This permission setting just means that access cannot be -delegated, which is actually less secure (as now more system operation can only -be done as root). - -This is also an issue with the Fedora bind RPM, although there some (but not -all) binaries have been changed to world-readable/executable (see BZ 200465 and -BZ 427826 for example). - -Description of test (psklenar): - -- all executables in bind packages (yum list |grep '^bind', caching-nameserver) - should be readable/executable by others - check it. -- also check that configuration files (/etc/named*, /etc/rndc.*, /var/named/* - subtree) are non-readable by others -- don't neglect this step, it is important to have config files hidden! (I might - omit something, it's unlikely but might happen) \ No newline at end of file diff --git a/Regression/bz441495_privileges/main.fmf b/Regression/bz441495_privileges/main.fmf deleted file mode 100644 index d98113f..0000000 --- a/Regression/bz441495_privileges/main.fmf +++ /dev/null @@ -1,52 +0,0 @@ -summary: Test for bz441495 (No reason for bind binaries to be protected) -description: |- - Bug summary: No reason for bind binaries to be protected - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=441495 - - Description: - - This test is a port of original written by psklenar to RHEL6 - - I set up a new RHEL 5 nameserver today, and the named user is unable to use rndc - (despite having permission to read the rndc.conf/rndc.key files). I realized - that the rndc binary (and all of the other binaries from the bind RPM) are only - readable by root. - - There is no reason for this protection, as none of the binaries are - setuid/setgid or contain private information (especially since anyone could - build their own copy of bind, even from the RHEL SRPM, to get the same rndc - functionality). This permission setting just means that access cannot be - delegated, which is actually less secure (as now more system operation can only - be done as root). - - This is also an issue with the Fedora bind RPM, although there some (but not - all) binaries have been changed to world-readable/executable (see BZ 200465 and - BZ 427826 for example). - - Description of test (psklenar): - - - all executables in bind packages (yum list |grep '^bind', caching-nameserver) - should be readable/executable by others - check it. - - also check that configuration files (/etc/named*, /etc/rndc.*, /var/named/* - subtree) are non-readable by others - - don't neglect this step, it is important to have config files hidden! (I might - omit something, it's unlikely but might happen) -contact: Petr Sklenar -component: -- bind -test: ./runtest.sh -require: -- bind -- bind-chroot -- caching-nameserver -- bind-utils -duration: 5m -enabled: true -tag: -- TIPfail_infra -- TIPpass -- Tier2 -tier: '2' -extra-summary: /CoreOS/bind/Regression/bz441495_privileges -extra-task: /CoreOS/bind/Regression/bz441495_privileges -extra-nitrate: TC#0126562 diff --git a/Regression/bz441495_privileges/runtest.sh b/Regression/bz441495_privileges/runtest.sh deleted file mode 100755 index a7f131a..0000000 --- a/Regression/bz441495_privileges/runtest.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/bind/Regression/bz441495_privileges -# Description: Test for bz441495 (No reason for bind binaries to be protected) -# Author: Martin Cermak -# -# This test is a port of original written by psklenar to RHEL6. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/bin/rhts-environment.sh -. /usr/lib/beakerlib/beakerlib.sh - -PACKAGE="bind" - -rlJournalStart - rlPhaseStartSetup - rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - - if rpm -q bind97; then - rlAssertRpm bind97-chroot - rlAssertRpm bind97-utils - else - rlAssertRpm bind-chroot - rlAssertRpm bind-utils - fi - rlPhaseEnd - - rlPhaseStartTest - rlLog "Checking privileges of executables..." - for pkgitem in `rpm -ql bind | grep "/usr/sbin"`; do - if [ -f $pkgitem ] && [ -x $pkgitem ]; then - rlRun "ls -Hla $pkgitem | grep \"^-rwxr-xr-x\"" - rlRun "[ -u $pkgitem ]" 1 - fi - done - - # Since rhel8 Thu Jul 12 2018 Petr Menšík - 32:9.11.3-15 - # Use new config file named-chroot.files for chroot setup (#1429656) - ls -Hla /etc/named* | grep -v "\.key$" | grep "^-rw-r--r--.*named-chroot" > list2 - ls -Hla /etc/named* /etc/rndc.* | grep -v "\.key$" | grep "^-" > list1 - ls -Hla /etc/named* /etc/rndc.* | grep -v "\.key$" | grep "^-rw-r-----" >> list2 - rlRun "diff list1 list2" 0 "Checking privileges of configs, logs and other related files." - - ls -dHla /var/named | grep "^d" > list1 - ls -dHla /var/named | grep "^drwxr[w-]x--[T-]" > list2 - rlRun "diff list1 list2" 0 "Checking privileges of /var/named directory." - - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalEnd