Compare commits
No commits in common. "main" and "rawhide" have entirely different histories.
10 changed files with 2 additions and 256 deletions
|
|
@ -1,45 +0,0 @@
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# Makefile of /CoreOS/httpd/Sanity/got-audit
|
|
||||||
# Description: Ensure pointers in the server process GOT match expected values
|
|
||||||
# Author: Gordon Messmer <gordon.messmer@gmail.com>
|
|
||||||
#
|
|
||||||
|
|
||||||
export TEST=/CoreOS/httpd/Sanity/got-audit
|
|
||||||
export TESTVERSION=1.0
|
|
||||||
|
|
||||||
BUILT_FILES=
|
|
||||||
|
|
||||||
FILES=$(METADATA) runtest.sh Makefile got-audit.gdb
|
|
||||||
|
|
||||||
.PHONY: all install download clean
|
|
||||||
|
|
||||||
run: $(FILES) build
|
|
||||||
./runtest.sh
|
|
||||||
|
|
||||||
build: $(BUILT_FILES)
|
|
||||||
test -x runtest.sh || chmod a+x runtest.sh
|
|
||||||
|
|
||||||
clean:
|
|
||||||
rm -f *~ $(BUILT_FILES)
|
|
||||||
|
|
||||||
|
|
||||||
-include /usr/share/rhts/lib/rhts-make.include
|
|
||||||
|
|
||||||
$(METADATA): Makefile
|
|
||||||
@echo "Owner: Gordon Messmer <gordon.messmer@gmail.com>" > $(METADATA)
|
|
||||||
@echo "Name: $(TEST)" >> $(METADATA)
|
|
||||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
|
||||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
|
||||||
@echo "Description: Ensure pointers in the server process GOT match expected values" >> $(METADATA)
|
|
||||||
@echo "Type: Sanity" >> $(METADATA)
|
|
||||||
@echo "TestTime: 5m" >> $(METADATA)
|
|
||||||
@echo "RunFor: httpd" >> $(METADATA)
|
|
||||||
@echo "Requires: httpd gdb-gef" >> $(METADATA)
|
|
||||||
@echo "Priority: Normal" >> $(METADATA)
|
|
||||||
@echo "License: GPLv2+" >> $(METADATA)
|
|
||||||
@echo "Confidential: yes" >> $(METADATA)
|
|
||||||
@echo "Destructive: no" >> $(METADATA)
|
|
||||||
@echo "Releases: " >> $(METADATA)
|
|
||||||
|
|
||||||
rhts-lint $(METADATA)
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
gef config gef.disable_color True
|
|
||||||
got-audit --all
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
summary: Audit the GOT for signs of tampering
|
|
||||||
description: |
|
|
||||||
Pointers in the server process GOT will be checked to ensure that
|
|
||||||
each function pointer's value is within a shared object file
|
|
||||||
that exports a symbol of that name, and that no shared object
|
|
||||||
files export conflicting symbols.
|
|
||||||
contact: Gordon Messmer <gordon.messmer@gmail.com>
|
|
||||||
require+:
|
|
||||||
- gdb-gef # needed to test got-audit
|
|
||||||
test: ./runtest.sh
|
|
||||||
framework: beakerlib
|
|
||||||
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# runtest.sh of /CoreOS/httpd/Sanity/got-audit
|
|
||||||
# Description: Check pointers in the server process GOT for signs of tampering
|
|
||||||
# Author: Gordon Messmer <gordon.messmer@gmail.com>
|
|
||||||
#
|
|
||||||
|
|
||||||
# Include Beaker environment
|
|
||||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
||||||
|
|
||||||
rlJournalStart
|
|
||||||
rlPhaseStartSetup
|
|
||||||
rlServiceStart httpd
|
|
||||||
rlRun "TestDir=\$(pwd)"
|
|
||||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
||||||
rlRun "pushd $TmpDir"
|
|
||||||
rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartTest "Run GEF got-audit"
|
|
||||||
rlRun "SERVICE_PID=\$( systemctl show --property=MainPID httpd.service | cut -f2 -d= )"
|
|
||||||
rlRun "echo SERVICE_PID is '$SERVICE_PID'"
|
|
||||||
[ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
|
|
||||||
rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
|
|
||||||
# Basic test: ensure that at least one symbol is found in libc.so,
|
|
||||||
# to verify that the report looks plausible.
|
|
||||||
rlAssertGrep " : /.*/libc.so" "$auditfile"
|
|
||||||
# Ensure the got-audit did not report any errors
|
|
||||||
rlAssertNotGrep " :: ERROR" "$auditfile"
|
|
||||||
rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt"
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartCleanup
|
|
||||||
rlServiceRestore httpd
|
|
||||||
rlRun "popd"
|
|
||||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
||||||
rlPhaseEnd
|
|
||||||
rlJournalPrintText
|
|
||||||
rlJournalEnd
|
|
||||||
|
|
@ -48,13 +48,7 @@ rlJournalStart
|
||||||
rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\
|
rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\
|
||||||
0 "getting selinux context of rpm's files ($httpHTTPD)"
|
0 "getting selinux context of rpm's files ($httpHTTPD)"
|
||||||
fi
|
fi
|
||||||
rlFileSubmit files_context.log
|
rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log
|
||||||
# handle sbin merge by checking if /usr/sbin is a symlink
|
|
||||||
if test -L /usr/sbin; then
|
|
||||||
rlAssertGrep "httpd_exec_t.*/usr/bin/httpd" files_context.log
|
|
||||||
else
|
|
||||||
rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log
|
|
||||||
fi
|
|
||||||
rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log
|
rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log
|
||||||
rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log
|
rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log
|
||||||
rlPhaseEnd
|
rlPhaseEnd
|
||||||
|
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
summary: Smoke test for htcacheclean service
|
|
||||||
description: ''
|
|
||||||
component:
|
|
||||||
- httpd
|
|
||||||
test: ./runtest.sh
|
|
||||||
framework: beakerlib
|
|
||||||
require:
|
|
||||||
- library(httpd/http)
|
|
||||||
- httpd
|
|
||||||
duration: 1m
|
|
||||||
enabled: true
|
|
||||||
tag:
|
|
||||||
- Tier1
|
|
||||||
tier: '1'
|
|
||||||
adjust:
|
|
||||||
- enabled: false
|
|
||||||
when: distro < rhel-10, centos-stream-10
|
|
||||||
continue: false
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# runtest.sh htcacheclean test
|
|
||||||
# Description: Smoke test of htcacheclean
|
|
||||||
# Author: Joe Orton <jorton@redhat.com>
|
|
||||||
#
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# Copyright (c) 2022 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# This copyrighted material is made available to anyone wishing
|
|
||||||
# to use, modify, copy, or redistribute it subject to the terms
|
|
||||||
# and conditions of the GNU General Public License version 2.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be
|
|
||||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
||||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
||||||
# PURPOSE. See the GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public
|
|
||||||
# License along with this program; if not, write to the Free
|
|
||||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
||||||
# Boston, MA 02110-1301, USA.
|
|
||||||
#
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
|
|
||||||
# Include rhts environment
|
|
||||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
||||||
|
|
||||||
PACKAGES="${PACKAGES:-httpd}"
|
|
||||||
REQUIRES=${REQUIRES:-}
|
|
||||||
|
|
||||||
rlJournalStart
|
|
||||||
rlPhaseStartSetup
|
|
||||||
rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
|
|
||||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
||||||
rlRun "pushd $TmpDir"
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartTest
|
|
||||||
rlRun -l "systemctl preset htcacheclean"
|
|
||||||
rlRun -s -l "systemctl is-enabled htcacheclean" 1
|
|
||||||
rlAssertGrep disabled $rlRun_LOG
|
|
||||||
|
|
||||||
# Check for warning for missing [Install]
|
|
||||||
rlRun -s -l "systemctl enable htcacheclean" 0 "Enable htcacheclean service"
|
|
||||||
rlAssertNotGrep 'The unit files have no installation config' $rlRun_LOG
|
|
||||||
|
|
||||||
rlRun -s -l "systemctl is-enabled htcacheclean"
|
|
||||||
rlAssertGrep enabled $rlRun_LOG
|
|
||||||
|
|
||||||
rlRun "systemctl start htcacheclean" 0 "Start htcacheclean service"
|
|
||||||
rlRun "sleep 5"
|
|
||||||
rlRun "systemctl stop htcacheclean" 0 "Stop htcacheclean service"
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartCleanup
|
|
||||||
rlRun "popd"
|
|
||||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
||||||
rlPhaseEnd
|
|
||||||
rlJournalEnd
|
|
||||||
rlJournalPrintText
|
|
||||||
|
|
@ -6,6 +6,7 @@ test: ./runtest.sh
|
||||||
framework: beakerlib
|
framework: beakerlib
|
||||||
require:
|
require:
|
||||||
- library(httpd/http)
|
- library(httpd/http)
|
||||||
|
- library(database/mysql)
|
||||||
- library(database/mariadb)
|
- library(database/mariadb)
|
||||||
- library(php/utils)
|
- library(php/utils)
|
||||||
- httpd
|
- httpd
|
||||||
|
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
summary: Smoke test for httpd-init service
|
|
||||||
description: ''
|
|
||||||
component:
|
|
||||||
- httpd
|
|
||||||
test: ./runtest.sh
|
|
||||||
framework: beakerlib
|
|
||||||
require:
|
|
||||||
- library(httpd/http)
|
|
||||||
- httpd
|
|
||||||
- mod_ssl
|
|
||||||
duration: 1m
|
|
||||||
enabled: true
|
|
||||||
tag:
|
|
||||||
- Tier1
|
|
||||||
tier: '1'
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# runtest.sh htcacheclean test
|
|
||||||
# Description: Smoke test of htcacheclean
|
|
||||||
# Author: Joe Orton <jorton@redhat.com>
|
|
||||||
#
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
#
|
|
||||||
# Copyright (c) 2022 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# This copyrighted material is made available to anyone wishing
|
|
||||||
# to use, modify, copy, or redistribute it subject to the terms
|
|
||||||
# and conditions of the GNU General Public License version 2.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be
|
|
||||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
||||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
||||||
# PURPOSE. See the GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public
|
|
||||||
# License along with this program; if not, write to the Free
|
|
||||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
||||||
# Boston, MA 02110-1301, USA.
|
|
||||||
#
|
|
||||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
||||||
|
|
||||||
# Include rhts environment
|
|
||||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
||||||
|
|
||||||
PACKAGES="${PACKAGES:-httpd mod_ssl}"
|
|
||||||
REQUIRES=${REQUIRES:-}
|
|
||||||
|
|
||||||
rlJournalStart
|
|
||||||
rlPhaseStartSetup
|
|
||||||
rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
|
|
||||||
rlRun "rm -vf /dhparams.pem /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key"
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartTest
|
|
||||||
rlRun "systemctl start httpd"
|
|
||||||
rlAssertNotExists /dhparams.pem
|
|
||||||
rlAssertExists /etc/pki/tls/certs/localhost.crt
|
|
||||||
rlAssertExists /etc/pki/tls/private/localhost.key
|
|
||||||
rlPhaseEnd
|
|
||||||
|
|
||||||
rlPhaseStartCleanup
|
|
||||||
rlRun "systemctl stop httpd"
|
|
||||||
rlPhaseEnd
|
|
||||||
rlJournalEnd
|
|
||||||
rlJournalPrintText
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue