From 6fd4e804c274bf0b840e0a0d046e388c8ead12bb Mon Sep 17 00:00:00 2001
From: Gordon Messmer <gordon.messmer@gmail.com>
Date: Thu, 1 Aug 2024 12:02:59 -0700
Subject: [PATCH] Examine the server process GOT for signs of tampering.

---
 Sanity/got-audit/got-audit.gdb |  2 ++
 Sanity/got-audit/main.fmf      | 12 ++++++++++
 Sanity/got-audit/runtest.sh    | 41 ++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)
 create mode 100644 Sanity/got-audit/got-audit.gdb
 create mode 100644 Sanity/got-audit/main.fmf
 create mode 100755 Sanity/got-audit/runtest.sh

diff --git a/Sanity/got-audit/got-audit.gdb b/Sanity/got-audit/got-audit.gdb
new file mode 100644
index 0000000..6661297
--- /dev/null
+++ b/Sanity/got-audit/got-audit.gdb
@@ -0,0 +1,2 @@
+gef config gef.disable_color True
+got-audit --all
diff --git a/Sanity/got-audit/main.fmf b/Sanity/got-audit/main.fmf
new file mode 100644
index 0000000..552c5ef
--- /dev/null
+++ b/Sanity/got-audit/main.fmf
@@ -0,0 +1,12 @@
+summary: Audit the GOT for signs of tampering
+description: |
+  Pointers in the server process GOT will be checked to ensure that
+  each function pointer's value is within a shared object file
+  that exports a symbol of that name, and that no shared object
+  files export conflicting symbols.
+contact: Gordon Messmer <gordon.messmer@gmail.com>
+require+:
+  - gdb-gef           # needed to test got-audit
+test: ./runtest.sh
+framework: beakerlib
+
diff --git a/Sanity/got-audit/runtest.sh b/Sanity/got-audit/runtest.sh
new file mode 100755
index 0000000..b2dface
--- /dev/null
+++ b/Sanity/got-audit/runtest.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/cups/Sanity/got-audit
+#   Description: Check pointers in the server process GOT for signs of tampering
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlServiceStart cups
+        rlRun "TestDir=\$(pwd)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Run GEF got-audit"
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID cups.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceRestore cups
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd