diff --git a/tests/kola/files/file-directory-permissions b/tests/kola/files/file-directory-permissions index 08e86f4464..43d38f8537 100755 --- a/tests/kola/files/file-directory-permissions +++ b/tests/kola/files/file-directory-permissions @@ -5,9 +5,44 @@ set -xeuo pipefail . $KOLA_EXT_DATA/commonlib.sh -list="$(find /etc -type f -type d -perm /022)" -if [[ -n "${list}" ]]; then - find /etc -type f -type d -perm /022 -print0 | xargs -0 ls -al +# List of known files and directories with group write permission +list_known=() + +# List of known files and directories with group write permission (RHCOS only) +list_known_rhcos=( + '/usr/share/licenses/publicsuffix-list-dafsa/COPYING' +) + +is_fcos="false" +if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then + is_fcos="true" +fi + +unknown="" +while IFS= read -r -d '' e; do + found="false" + for k in "${list_known[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + if [[ "${is_fcos}" == "false" ]]; then + for k in "${list_known_rhcos[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + fi + if [[ "${found}" == "false" ]]; then + unknown+=" ${e}" + fi +done< <(find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0) + +if [[ -n "${unknown}" ]]; then + find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 ls -al + find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 rpm -qf fatal "found files or directories with 'g+w' or 'o+w' permission" fi ok "no files with 'g+w' or 'o+w' permission found in /etc" diff --git a/tests/kola/files/setgid b/tests/kola/files/setgid index fd738e34ba..b777dd1326 100755 --- a/tests/kola/files/setgid +++ b/tests/kola/files/setgid @@ -10,6 +10,7 @@ list_setgid_files=( '/usr/libexec/openssh/ssh-keysign' '/usr/libexec/utempter/utempter' ) + unknown_setgid_files="" while IFS= read -r -d '' e; do found="false" @@ -22,7 +23,7 @@ while IFS= read -r -d '' e; do if [[ "${found}" == "false" ]]; then unknown_setgid_files+=" ${e}" fi -done< <(find /usr /etc -type f,d -perm /2000 -print0) +done< <(find /usr /etc -type f -perm /2000 -print0 -o -type d -perm /2000 -print0) if [[ -n "${unknown_setgid_files}" ]]; then echo "SetGID:${unknown_setgid_files}" diff --git a/tests/kola/files/setuid b/tests/kola/files/setuid index 4393fb234b..0efd5d1148 100755 --- a/tests/kola/files/setuid +++ b/tests/kola/files/setuid @@ -24,6 +24,21 @@ list_setuid_files=( '/usr/sbin/pam_timestamp_check' '/usr/sbin/unix_chkpwd' ) + +# List of known files and directories with SetUID bit set (RHCOS only) +list_setuid_files_rhcos=( + '/usr/libexec/dbus-1/dbus-daemon-launch-helper' + '/usr/libexec/sssd/krb5_child' + '/usr/libexec/sssd/ldap_child' + '/usr/libexec/sssd/proxy_child' + '/usr/libexec/sssd/selinux_child' +) + +is_fcos="false" +if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then + is_fcos="true" +fi + unknown_setuid_files="" while IFS= read -r -d '' e; do found="false" @@ -33,10 +48,18 @@ while IFS= read -r -d '' e; do break fi done + if [[ "${is_fcos}" == "false" ]]; then + for k in "${list_setuid_files_rhcos[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + fi if [[ "${found}" == "false" ]]; then unknown_setuid_files+=" ${e}" fi -done< <(find /usr /etc -type f,d -perm /4000 -print0) +done< <(find /usr /etc -type f -perm /4000 -print0 -o -type d -perm /4000 -print0) if [[ -n "${unknown_setuid_files}" ]]; then echo "SetUID:${unknown_setuid_files}"