Compare commits

..

No commits in common. "main" and "rawhide" have entirely different histories.

7 changed files with 29 additions and 62 deletions

View file

@ -1,2 +0,0 @@
gef config gef.disable_color True
got-audit --all

View file

@ -1,13 +0,0 @@
summary: Audit the GOT for signs of tampering
description: |
Pointers in the server process GOT will be checked to ensure that
each function pointer's value is within a shared object file
that exports a symbol of that name, and that no shared object
files export conflicting symbols.
contact: Gordon Messmer <gordon.messmer@gmail.com>
require+:
- gdb-gef # needed to test got-audit
- nginx
test: ./runtest.sh
framework: beakerlib

View file

@ -1,41 +0,0 @@
#!/bin/bash
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/nginx/Sanity/got-audit
# Description: Check pointers in the server process GOT for signs of tampering
# Author: Gordon Messmer <gordon.messmer@gmail.com>
#
# Include Beaker environment
. /usr/share/beakerlib/beakerlib.sh || exit 1
rlJournalStart
rlPhaseStartSetup
rlServiceStart nginx
rlRun "TestDir=\$(pwd)"
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
rlRun "pushd $TmpDir"
rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
rlPhaseEnd
rlPhaseStartTest "Run GEF got-audit"
rlRun "SERVICE_PID=\$( systemctl show --property=MainPID nginx.service | cut -f2 -d= )"
rlRun "echo SERVICE_PID is '$SERVICE_PID'"
[ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
# Basic test: ensure that at least one symbol is found in libc.so,
# to verify that the report looks plausible.
rlAssertGrep " : /.*/libc.so" "$auditfile"
# Ensure the got-audit did not report any errors
rlAssertNotGrep " :: ERROR" "$auditfile"
rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt"
rlPhaseEnd
rlPhaseStartCleanup
rlServiceRestore nginx
rlRun "popd"
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

View file

@ -0,0 +1,11 @@
component:
- nginx
tag:
- TIPfail_Apps
- Tier1
- ci-tier-1
relevancy: |
product = rhel && distro < rhel-8 : False
distro = rhel-alt : False
extra-nitrate: TC#0334132
extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context

View file

@ -6,7 +6,7 @@ description: |
(service will be for example: nginx14-nginx or just nginx)
Author: Ondrej Ptak <optak@redhat.com>
contact: Iveta Cesalova <icesalov@redhat.com>
contact: None <icesalov@redhat.com>
component:
- nginx
test: ./runtest.sh
@ -18,5 +18,5 @@ recommend:
duration: 1m
enabled: true
tier: '1'
tag:
- Tier1
extra-summary: /CoreOS/nginx/Sanity/daemon-selinux-context
extra-task: /CoreOS/nginx/Sanity/daemon-selinux-context

View file

@ -0,0 +1,12 @@
component:
- nginx
tag:
- TIPpass
- TIPpass_Apps
- Tier1
- ci-tier-1
relevancy: |
product = rhel && distro < rhel-8 : False
distro = rhel-alt : False
extra-nitrate: TC#0326941
extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test

View file

@ -1,6 +1,6 @@
summary: What the test does
description: ''
contact: Iveta Cesalova <icesalov@redhat.com>
contact: None <icesalov@redhat.com>
component:
- nginx
test: ./runtest.sh
@ -16,5 +16,5 @@ recommend:
duration: 5m
enabled: true
tier: '1'
tag:
- Tier1
extra-summary: /CoreOS/nginx/Sanity/nginx-sanity-test
extra-task: /CoreOS/nginx/Sanity/nginx-sanity-test