From 35bcda6a9b40b4de9cdb81760e7d3f466b4c1d96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Wed, 5 Jan 2022 20:32:48 +0100 Subject: [PATCH 1/2] tests: Rework 'find' calls with multiple file type filters Fedora has a recent enough `find` command to be able to use the `-type f,d` option but that is not yet supported by `find` on RHEL. We can not use `-type f -type d` instead as this filters on entries being both a file and a directory which never happens. Thus we must explicitely duplicate the entire filters and actions and use `-o` to OR them. This reworks the tests using that option to be compatible on both FCOS and RHCOS. We can drop this change once RHCOS moves to RHEL 9. This also includes `/usr` in the file-directory-permissions test and tries to figure out which package the offending files/dires come from. Fixes: https://github.com/coreos/fedora-coreos-config/commit/dac1f6835e1e730409a4062c6562ece32bddaee1 --- tests/kola/files/file-directory-permissions | 6 ++++-- tests/kola/files/setgid | 3 ++- tests/kola/files/setuid | 3 ++- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/kola/files/file-directory-permissions b/tests/kola/files/file-directory-permissions index 08e86f4464..bfd880f079 100755 --- a/tests/kola/files/file-directory-permissions +++ b/tests/kola/files/file-directory-permissions @@ -5,9 +5,11 @@ set -xeuo pipefail . $KOLA_EXT_DATA/commonlib.sh -list="$(find /etc -type f -type d -perm /022)" +list="$(find /usr /etc -type f -perm /022 -o -type d -perm /022)" + if [[ -n "${list}" ]]; then - find /etc -type f -type d -perm /022 -print0 | xargs -0 ls -al + find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 ls -al + find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 rpm -qf fatal "found files or directories with 'g+w' or 'o+w' permission" fi ok "no files with 'g+w' or 'o+w' permission found in /etc" diff --git a/tests/kola/files/setgid b/tests/kola/files/setgid index fd738e34ba..b777dd1326 100755 --- a/tests/kola/files/setgid +++ b/tests/kola/files/setgid @@ -10,6 +10,7 @@ list_setgid_files=( '/usr/libexec/openssh/ssh-keysign' '/usr/libexec/utempter/utempter' ) + unknown_setgid_files="" while IFS= read -r -d '' e; do found="false" @@ -22,7 +23,7 @@ while IFS= read -r -d '' e; do if [[ "${found}" == "false" ]]; then unknown_setgid_files+=" ${e}" fi -done< <(find /usr /etc -type f,d -perm /2000 -print0) +done< <(find /usr /etc -type f -perm /2000 -print0 -o -type d -perm /2000 -print0) if [[ -n "${unknown_setgid_files}" ]]; then echo "SetGID:${unknown_setgid_files}" diff --git a/tests/kola/files/setuid b/tests/kola/files/setuid index 4393fb234b..337e78d222 100755 --- a/tests/kola/files/setuid +++ b/tests/kola/files/setuid @@ -24,6 +24,7 @@ list_setuid_files=( '/usr/sbin/pam_timestamp_check' '/usr/sbin/unix_chkpwd' ) + unknown_setuid_files="" while IFS= read -r -d '' e; do found="false" @@ -36,7 +37,7 @@ while IFS= read -r -d '' e; do if [[ "${found}" == "false" ]]; then unknown_setuid_files+=" ${e}" fi -done< <(find /usr /etc -type f,d -perm /4000 -print0) +done< <(find /usr /etc -type f -perm /4000 -print0 -o -type d -perm /4000 -print0) if [[ -n "${unknown_setuid_files}" ]]; then echo "SetUID:${unknown_setuid_files}" From 62c17179b00a313f96e22d130b60b34092e960e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timoth=C3=A9e=20Ravier?= Date: Thu, 27 Jan 2022 17:40:30 +0100 Subject: [PATCH 2/2] tests: Add exclude lists for RHCOS --- tests/kola/files/file-directory-permissions | 37 +++++++++++++++++++-- tests/kola/files/setuid | 22 ++++++++++++ 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/tests/kola/files/file-directory-permissions b/tests/kola/files/file-directory-permissions index bfd880f079..43d38f8537 100755 --- a/tests/kola/files/file-directory-permissions +++ b/tests/kola/files/file-directory-permissions @@ -5,9 +5,42 @@ set -xeuo pipefail . $KOLA_EXT_DATA/commonlib.sh -list="$(find /usr /etc -type f -perm /022 -o -type d -perm /022)" +# List of known files and directories with group write permission +list_known=() -if [[ -n "${list}" ]]; then +# List of known files and directories with group write permission (RHCOS only) +list_known_rhcos=( + '/usr/share/licenses/publicsuffix-list-dafsa/COPYING' +) + +is_fcos="false" +if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then + is_fcos="true" +fi + +unknown="" +while IFS= read -r -d '' e; do + found="false" + for k in "${list_known[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + if [[ "${is_fcos}" == "false" ]]; then + for k in "${list_known_rhcos[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + fi + if [[ "${found}" == "false" ]]; then + unknown+=" ${e}" + fi +done< <(find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0) + +if [[ -n "${unknown}" ]]; then find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 ls -al find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 rpm -qf fatal "found files or directories with 'g+w' or 'o+w' permission" diff --git a/tests/kola/files/setuid b/tests/kola/files/setuid index 337e78d222..0efd5d1148 100755 --- a/tests/kola/files/setuid +++ b/tests/kola/files/setuid @@ -25,6 +25,20 @@ list_setuid_files=( '/usr/sbin/unix_chkpwd' ) +# List of known files and directories with SetUID bit set (RHCOS only) +list_setuid_files_rhcos=( + '/usr/libexec/dbus-1/dbus-daemon-launch-helper' + '/usr/libexec/sssd/krb5_child' + '/usr/libexec/sssd/ldap_child' + '/usr/libexec/sssd/proxy_child' + '/usr/libexec/sssd/selinux_child' +) + +is_fcos="false" +if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then + is_fcos="true" +fi + unknown_setuid_files="" while IFS= read -r -d '' e; do found="false" @@ -34,6 +48,14 @@ while IFS= read -r -d '' e; do break fi done + if [[ "${is_fcos}" == "false" ]]; then + for k in "${list_setuid_files_rhcos[@]}"; do + if [[ "${k}" == "${e}" ]]; then + found="true" + break + fi + done + fi if [[ "${found}" == "false" ]]; then unknown_setuid_files+=" ${e}" fi