From abd72bf8e37dc9eb7428b9d03e2bb2c49e28df06 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Sun, 28 Jul 2024 00:24:42 -0700 Subject: [PATCH 1/3] Examine the server process GOT for signs of tampering. --- Sanity/got-audit/Makefile | 45 ++++++++++++++++++++++++++++++++++ Sanity/got-audit/got-audit.gdb | 2 ++ Sanity/got-audit/main.fmf | 12 +++++++++ Sanity/got-audit/runtest.sh | 41 +++++++++++++++++++++++++++++++ 4 files changed, 100 insertions(+) create mode 100644 Sanity/got-audit/Makefile create mode 100644 Sanity/got-audit/got-audit.gdb create mode 100644 Sanity/got-audit/main.fmf create mode 100755 Sanity/got-audit/runtest.sh diff --git a/Sanity/got-audit/Makefile b/Sanity/got-audit/Makefile new file mode 100644 index 0000000..15a1eca --- /dev/null +++ b/Sanity/got-audit/Makefile @@ -0,0 +1,45 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/nginx/Sanity/got-audit +# Description: Ensure pointers in the server process GOT match expected values +# Author: Gordon Messmer +# + +export TEST=/CoreOS/nginx/Sanity/got-audit +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile got-audit.gdb + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +-include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Gordon Messmer " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Ensure pointers in the server process GOT match expected values" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: nginx" >> $(METADATA) + @echo "Requires: nginx gdb-gef" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: yes" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: " >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/Sanity/got-audit/got-audit.gdb b/Sanity/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/Sanity/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/Sanity/got-audit/main.fmf b/Sanity/got-audit/main.fmf new file mode 100644 index 0000000..552c5ef --- /dev/null +++ b/Sanity/got-audit/main.fmf @@ -0,0 +1,12 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit +test: ./runtest.sh +framework: beakerlib + diff --git a/Sanity/got-audit/runtest.sh b/Sanity/got-audit/runtest.sh new file mode 100755 index 0000000..95c8cf1 --- /dev/null +++ b/Sanity/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/nginx/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart nginx + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID nginx.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore nginx + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From fda9a01ac8e2d41927c8625999d9d83361196cd5 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Wed, 31 Jul 2024 10:14:15 -0700 Subject: [PATCH 2/3] Review feedback. --- Sanity/got-audit/Makefile | 45 --------------------------------------- Sanity/got-audit/main.fmf | 1 + 2 files changed, 1 insertion(+), 45 deletions(-) delete mode 100644 Sanity/got-audit/Makefile diff --git a/Sanity/got-audit/Makefile b/Sanity/got-audit/Makefile deleted file mode 100644 index 15a1eca..0000000 --- a/Sanity/got-audit/Makefile +++ /dev/null @@ -1,45 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/nginx/Sanity/got-audit -# Description: Ensure pointers in the server process GOT match expected values -# Author: Gordon Messmer -# - -export TEST=/CoreOS/nginx/Sanity/got-audit -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile got-audit.gdb - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - --include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Gordon Messmer " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Ensure pointers in the server process GOT match expected values" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) - @echo "RunFor: nginx" >> $(METADATA) - @echo "Requires: nginx gdb-gef" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2+" >> $(METADATA) - @echo "Confidential: yes" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: " >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/Sanity/got-audit/main.fmf b/Sanity/got-audit/main.fmf index 552c5ef..d425d77 100644 --- a/Sanity/got-audit/main.fmf +++ b/Sanity/got-audit/main.fmf @@ -7,6 +7,7 @@ description: | contact: Gordon Messmer require+: - gdb-gef # needed to test got-audit + - nginx test: ./runtest.sh framework: beakerlib From 2c2dd401934f2f2daeccf1924f2c8a520b1bc362 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 1 Aug 2024 08:47:41 +0200 Subject: [PATCH 3/3] Removing TC# fmf files --- core/daemon-selinux-context/TC#0334132.fmf | 11 ----------- core/daemon-selinux-context/main.fmf | 6 +++--- core/nginx-sanity-test/TC#0326941.fmf | 12 ------------ core/nginx-sanity-test/main.fmf | 6 +++--- 4 files changed, 6 insertions(+), 29 deletions(-) delete mode 100644 core/daemon-selinux-context/TC#0334132.fmf delete mode 100644 core/nginx-sanity-test/TC#0326941.fmf diff --git a/core/daemon-selinux-context/TC#0334132.fmf b/core/daemon-selinux-context/TC#0334132.fmf deleted file mode 100644 index cca01fd..0000000 --- a/core/daemon-selinux-context/TC#0334132.fmf +++ /dev/null @@ -1,11 +0,0 @@ -component: -- nginx -tag: -- TIPfail_Apps -- Tier1 -- ci-tier-1 -relevancy: | - product = rhel && distro < rhel-8 : False - distro = rhel-alt : False -extra-nitrate: TC#0334132 -extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context diff --git a/core/daemon-selinux-context/main.fmf b/core/daemon-selinux-context/main.fmf index f483965..65f662c 100644 --- a/core/daemon-selinux-context/main.fmf +++ b/core/daemon-selinux-context/main.fmf @@ -6,7 +6,7 @@ description: | (service will be for example: nginx14-nginx or just nginx) Author: Ondrej Ptak -contact: None +contact: Iveta Cesalova component: - nginx test: ./runtest.sh @@ -18,5 +18,5 @@ recommend: duration: 1m enabled: true tier: '1' -extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context -extra-task: /CoreOS/nginx/Sanity/daemon-selinux-context +tag: +- Tier1 diff --git a/core/nginx-sanity-test/TC#0326941.fmf b/core/nginx-sanity-test/TC#0326941.fmf deleted file mode 100644 index 2d30fdd..0000000 --- a/core/nginx-sanity-test/TC#0326941.fmf +++ /dev/null @@ -1,12 +0,0 @@ -component: -- nginx -tag: -- TIPpass -- TIPpass_Apps -- Tier1 -- ci-tier-1 -relevancy: | - product = rhel && distro < rhel-8 : False - distro = rhel-alt : False -extra-nitrate: TC#0326941 -extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test diff --git a/core/nginx-sanity-test/main.fmf b/core/nginx-sanity-test/main.fmf index 7143fba..24c6221 100644 --- a/core/nginx-sanity-test/main.fmf +++ b/core/nginx-sanity-test/main.fmf @@ -1,6 +1,6 @@ summary: What the test does description: '' -contact: None +contact: Iveta Cesalova component: - nginx test: ./runtest.sh @@ -16,5 +16,5 @@ recommend: duration: 5m enabled: true tier: '1' -extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test -extra-task: /CoreOS/nginx/Sanity/nginx-sanity-test +tag: +- Tier1