Skip to content

tests: Rework 'find' calls with multiple file type filters #1405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
travier merged 2 commits into from
Feb 17, 2022
Merged

tests: Rework 'find' calls with multiple file type filters #1405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35bcda6
tests: Rework 'find' calls with multiple file type filters
travier Jan 5, 2022
62c1717
tests: Add exclude lists for RHCOS
travier Jan 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 38 additions & 3 deletions tests/kola/files/file-directory-permissions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,44 @@ set -xeuo pipefail

. $KOLA_EXT_DATA/commonlib.sh

list="$(find /etc -type f -type d -perm /022)"
if [[ -n "${list}" ]]; then
find /etc -type f -type d -perm /022 -print0 | xargs -0 ls -al
# List of known files and directories with group write permission
list_known=()

# List of known files and directories with group write permission (RHCOS only)
list_known_rhcos=(
'/usr/share/licenses/publicsuffix-list-dafsa/COPYING'

@cgwalters cgwalters Feb 7, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tempting to just canonicalize this in our ostree builds too.

@travier travier Feb 7, 2022

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've made https://gitlab.com/redhat/centos-stream/rpms/publicsuffix-list/-/merge_requests/2 for this one.

@travier travier Feb 7, 2022

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But indeed, we can directly fix it in openshift/os too and drop this case from the test.

)

is_fcos="false"
if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then
is_fcos="true"
fi

unknown=""
while IFS= read -r -d '' e; do
found="false"
for k in "${list_known[@]}"; do
if [[ "${k}" == "${e}" ]]; then
found="true"
break
fi
done
if [[ "${is_fcos}" == "false" ]]; then
for k in "${list_known_rhcos[@]}"; do
if [[ "${k}" == "${e}" ]]; then
found="true"
break
fi
done
fi
if [[ "${found}" == "false" ]]; then
unknown+=" ${e}"
fi
done< <(find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0)

if [[ -n "${unknown}" ]]; then
find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 ls -al
find /usr /etc -type f -perm /022 -print0 -o -type d -perm /022 -print0 | xargs -0 rpm -qf
fatal "found files or directories with 'g+w' or 'o+w' permission"
fi
ok "no files with 'g+w' or 'o+w' permission found in /etc"
3 changes: 2 additions & 1 deletion tests/kola/files/setgid
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ list_setgid_files=(
'/usr/libexec/openssh/ssh-keysign'
'/usr/libexec/utempter/utempter'
)

unknown_setgid_files=""
while IFS= read -r -d '' e; do
found="false"
Expand All @@ -22,7 +23,7 @@ while IFS= read -r -d '' e; do
if [[ "${found}" == "false" ]]; then
unknown_setgid_files+=" ${e}"
fi
done< <(find /usr /etc -type f,d -perm /2000 -print0)
done< <(find /usr /etc -type f -perm /2000 -print0 -o -type d -perm /2000 -print0)

if [[ -n "${unknown_setgid_files}" ]]; then
echo "SetGID:${unknown_setgid_files}"
Expand Down
25 changes: 24 additions & 1 deletion tests/kola/files/setuid
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,21 @@ list_setuid_files=(
'/usr/sbin/pam_timestamp_check'
'/usr/sbin/unix_chkpwd'
)

# List of known files and directories with SetUID bit set (RHCOS only)

@cgwalters cgwalters Feb 7, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is another case where we're saying "rhcos" but we really mean "rhel8".

list_setuid_files_rhcos=(
'/usr/libexec/dbus-1/dbus-daemon-launch-helper'
'/usr/libexec/sssd/krb5_child'
'/usr/libexec/sssd/ldap_child'
'/usr/libexec/sssd/proxy_child'
'/usr/libexec/sssd/selinux_child'
)

is_fcos="false"
if [[ "$(source /etc/os-release && echo "${ID}")" == "fedora" ]]; then
is_fcos="true"
fi

unknown_setuid_files=""
while IFS= read -r -d '' e; do
found="false"
Expand All @@ -33,10 +48,18 @@ while IFS= read -r -d '' e; do
break
fi
done
if [[ "${is_fcos}" == "false" ]]; then
for k in "${list_setuid_files_rhcos[@]}"; do
if [[ "${k}" == "${e}" ]]; then
found="true"
break
fi
done
fi
if [[ "${found}" == "false" ]]; then
unknown_setuid_files+=" ${e}"
fi
done< <(find /usr /etc -type f,d -perm /4000 -print0)
done< <(find /usr /etc -type f -perm /4000 -print0 -o -type d -perm /4000 -print0)

if [[ -n "${unknown_setuid_files}" ]]; then
echo "SetUID:${unknown_setuid_files}"
Expand Down