diff --git a/Sanity/got-audit/got-audit.gdb b/Sanity/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/Sanity/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/Sanity/got-audit/main.fmf b/Sanity/got-audit/main.fmf new file mode 100644 index 0000000..d425d77 --- /dev/null +++ b/Sanity/got-audit/main.fmf @@ -0,0 +1,13 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit + - nginx +test: ./runtest.sh +framework: beakerlib + diff --git a/Sanity/got-audit/runtest.sh b/Sanity/got-audit/runtest.sh new file mode 100755 index 0000000..95c8cf1 --- /dev/null +++ b/Sanity/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/nginx/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart nginx + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID nginx.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore nginx + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/core/daemon-selinux-context/TC#0334132.fmf b/core/daemon-selinux-context/TC#0334132.fmf deleted file mode 100644 index cca01fd..0000000 --- a/core/daemon-selinux-context/TC#0334132.fmf +++ /dev/null @@ -1,11 +0,0 @@ -component: -- nginx -tag: -- TIPfail_Apps -- Tier1 -- ci-tier-1 -relevancy: | - product = rhel && distro < rhel-8 : False - distro = rhel-alt : False -extra-nitrate: TC#0334132 -extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context diff --git a/core/daemon-selinux-context/main.fmf b/core/daemon-selinux-context/main.fmf index f483965..65f662c 100644 --- a/core/daemon-selinux-context/main.fmf +++ b/core/daemon-selinux-context/main.fmf @@ -6,7 +6,7 @@ description: | (service will be for example: nginx14-nginx or just nginx) Author: Ondrej Ptak -contact: None +contact: Iveta Cesalova component: - nginx test: ./runtest.sh @@ -18,5 +18,5 @@ recommend: duration: 1m enabled: true tier: '1' -extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context -extra-task: /CoreOS/nginx/Sanity/daemon-selinux-context +tag: +- Tier1 diff --git a/core/nginx-sanity-test/TC#0326941.fmf b/core/nginx-sanity-test/TC#0326941.fmf deleted file mode 100644 index 2d30fdd..0000000 --- a/core/nginx-sanity-test/TC#0326941.fmf +++ /dev/null @@ -1,12 +0,0 @@ -component: -- nginx -tag: -- TIPpass -- TIPpass_Apps -- Tier1 -- ci-tier-1 -relevancy: | - product = rhel && distro < rhel-8 : False - distro = rhel-alt : False -extra-nitrate: TC#0326941 -extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test diff --git a/core/nginx-sanity-test/main.fmf b/core/nginx-sanity-test/main.fmf index 7143fba..24c6221 100644 --- a/core/nginx-sanity-test/main.fmf +++ b/core/nginx-sanity-test/main.fmf @@ -1,6 +1,6 @@ summary: What the test does description: '' -contact: None +contact: Iveta Cesalova component: - nginx test: ./runtest.sh @@ -16,5 +16,5 @@ recommend: duration: 5m enabled: true tier: '1' -extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test -extra-task: /CoreOS/nginx/Sanity/nginx-sanity-test +tag: +- Tier1