Skip to content

Commit de47c0d

Browse files
matejakmatejak
authored
Merge pull request #1428 from vojtapolasek/symlink_probe_offline_tests
Tests for symlink probe in offline mode
2 parents 2c04d93 + e98d7b6 commit de47c0d

File tree

4 files changed

+231
-1
lines changed

4 files changed

+231
-1
lines changed

‎tests/offline_mode/CMakeLists.txt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
add_oscap_test("test_offline_mode_system_info.sh")
22
add_oscap_test("test_offline_mode_textfilecontent54.sh")
3-

‎tests/probes/symlink/CMakeLists.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
if(ENABLE_PROBES_UNIX)
22
add_oscap_test("all.sh")
3+
add_oscap_test("test_offline_mode_symlink.sh")
4+
set_tests_properties("probes/symlink/test_offline_mode_symlink.sh" PROPERTIES WILL_FAIL true)
35
endif()

‎tests/probes/symlink/test_offline_mode_symlink.sh

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2015 Red Hat Inc., Durham, North Carolina.
4+
# All Rights Reserved.
5+
#
6+
# OpenScap Probes Test Suite.
7+
8+
. $builddir/tests/test_common.sh
9+
10+
set -e -o pipefail
11+
12+
function test_offline_mode_symlink {
13+
probecheck "symlink" || return 255
14+
15+
DF="test_offline_mode_symlink.xml"
16+
RF="offline_mode_results.xml"
17+
18+
rm -f $RF
19+
20+
tmpdir=$(mktemp -t -d "test_offline_mode_symlink.XXXXXX")
21+
touch $tmpdir/some_file
22+
touch $tmpdir/file_to_remove
23+
ln -s /some_file $tmpdir/normal_symlink
24+
ln -s some_file $tmpdir/normal_symlink_relative
25+
ln -s /file_to_remove $tmpdir/broken_symlink
26+
ln -s file_to_remove $tmpdir/broken_symlink_relative
27+
rm -f $tmpdir/file_to_remove
28+
ln -s /circular_symlink $tmpdir/circular_symlink
29+
touch $tmpdir/other_file
30+
ln -s /other_file $tmpdir/middle_symlink
31+
ln -s /middle_symlink $tmpdir/chained_symlink
32+
mkdir $tmpdir/etc
33+
touch $tmpdir/etc/shadow
34+
ln -s /etc/shadow $tmpdir/etc/passwd
35+
touch $tmpdir/file_in_root
36+
ln -s ../../../../../file_in_root $tmpdir/path_traversal_symlink
37+
ln -s ./some_file $tmpdir/symlink_with_dot_in_path
38+
#temporary ugly solution trying to ensure that files don't exist before being created
39+
rm -f /tmp/symlinktarget
40+
touch /tmp/symlinktarget
41+
rm -f /tmp/symlinktest
42+
ln -s /tmp/symlinktarget /tmp/symlinktest
43+
44+
45+
46+
bash ${srcdir}/test_offline_mode_symlink.xml.sh "" > "$DF"
47+
export OSCAP_PROBE_ROOT="$tmpdir"
48+
$OSCAP oval eval --results $RF $DF
49+
50+
result=$RF
51+
52+
rm -f $DF
53+
rm -f /tmp/symlinktest
54+
rm -f /tmp/symlinktarget
55+
rm -rf $tmpdir
56+
57+
p='oval_results/results/system/oval_system_characteristics/'
58+
assert_exists 12 $p'collected_objects/object'
59+
assert_exists 6 $p'collected_objects/object[@flag="complete"]'
60+
assert_exists 6 $p'system_data/unix-sys:symlink_item'
61+
assert_exists 6 $p'system_data/unix-sys:symlink_item[@status="exists"]'
62+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/normal_symlink'"]'
63+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/normal_symlink_relative'"]'
64+
assert_exists 3 $p'system_data/unix-sys:symlink_item/unix-sys:canonical_path[text()="/some_file"]'
65+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/chained_symlink'"]'
66+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:canonical_path[text()="/other_file"]'
67+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/etc/passwd'"]'
68+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:canonical_path[text()="/etc/shadow"]'
69+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/path_traversal_symlink'"]'
70+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:canonical_path[text()="/file_in_root"]'
71+
assert_exists 1 $p'system_data/unix-sys:symlink_item/unix-sys:filepath[text()="'/symlink_with_dot_in_path'"]'
72+
assert_exists 3 $p'collected_objects/object[@flag="error"]'
73+
assert_exists 3 $p'collected_objects/object[@flag="does not exist"]'
74+
assert_exists 6 $p'collected_objects/object/message'
75+
76+
rm -f $RF
77+
78+
}
79+
80+
test_init "test_offline_mode_symlink.log"
81+
82+
test_run "test_offline_mode_symlink" test_offline_mode_symlink
83+
84+
test_exit
85+

‎tests/probes/symlink/test_offline_mode_symlink.xml.sh

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
#!/bin/bash
2+
3+
cat <<EOF
4+
<?xml version="1.0"?>
5+
<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
6+
<generator>
7+
<oval:schema_version>5.11</oval:schema_version>
8+
<oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>
9+
</generator>
10+
11+
<definitions>
12+
<definition class="compliance" version="1" id="oval:x:def:1">
13+
<metadata>
14+
<title>x</title>
15+
<description>x</description>
16+
<affected family="unix">
17+
<platform>x</platform>
18+
</affected>
19+
</metadata>
20+
<criteria>
21+
<criterion test_ref="oval:x:tst:1" comment="correct symlink"/>
22+
<criterion test_ref="oval:x:tst:2" comment="points to a broken symlink, target deleted"/>
23+
<criterion test_ref="oval:x:tst:3" comment="points to nonexisting file, not a symlink"/>
24+
<criterion test_ref="oval:x:tst:4" comment="is a regular file, not a symlink"/>
25+
<criterion test_ref="oval:x:tst:5" comment="circular symlink"/>
26+
<criterion test_ref="oval:x:tst:6" comment="two chained symlinks pointing to an existing file"/>
27+
<criterion test_ref="oval:x:tst:7" comment="symlink to an existing file, but the file name is well-known and should produce error if ran outside the container"/>
28+
<criterion test_ref="oval:x:tst:8" comment="valid symlink with relative path"/>
29+
<criterion test_ref="oval:x:tst:9" comment="broken symlink with relative path"/>
30+
<criterion test_ref="oval:x:tst:10" comment="valid symlink with lots of .. in the path, tests if we can't get out of the container"/>
31+
<criterion test_ref="oval:x:tst:11" comment="symlink with . in the path"/>
32+
<criterion test_ref="oval:x:tst:12" comment="tests for a symlink which exists only outside the container"/>
33+
</criteria>
34+
</definition>
35+
</definitions>
36+
37+
<tests>
38+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:1" version="1">
39+
<unix:object object_ref="oval:1:obj:1"/>
40+
<unix:state state_ref="oval:1:ste:1"/>
41+
</unix:symlink_test>
42+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:2" version="1">
43+
<unix:object object_ref="oval:1:obj:2"/>
44+
</unix:symlink_test>
45+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:3" version="1">
46+
<unix:object object_ref="oval:1:obj:3"/>
47+
</unix:symlink_test>
48+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:4" version="1">
49+
<unix:object object_ref="oval:1:obj:4"/>
50+
</unix:symlink_test>
51+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:5" version="1">
52+
<unix:object object_ref="oval:1:obj:5"/>
53+
</unix:symlink_test>
54+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:6" version="1">
55+
<unix:object object_ref="oval:1:obj:6"/>
56+
<unix:state state_ref="oval:1:ste:6"/>
57+
</unix:symlink_test>
58+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:7" version="1">
59+
<unix:object object_ref="oval:1:obj:7"/>
60+
<unix:state state_ref="oval:1:ste:7"/>
61+
</unix:symlink_test>
62+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:8" version="1">
63+
<unix:object object_ref="oval:1:obj:8"/>
64+
</unix:symlink_test>
65+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:9" version="1">
66+
<unix:object object_ref="oval:1:obj:9"/>
67+
</unix:symlink_test>
68+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:10" version="1">
69+
<unix:object object_ref="oval:1:obj:10"/>
70+
<unix:state state_ref="oval:1:ste:10"/>
71+
</unix:symlink_test>
72+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:11" version="1">
73+
<unix:object object_ref="oval:1:obj:11"/>
74+
<unix:state state_ref="oval:1:ste:11"/>
75+
</unix:symlink_test>
76+
<unix:symlink_test check="all" check_existence="all_exist" comment="x" id="oval:x:tst:12" version="1">
77+
<unix:object object_ref="oval:1:obj:12"/>
78+
</unix:symlink_test>
79+
</tests>
80+
81+
<objects>
82+
<unix:symlink_object id="oval:1:obj:1" version="1">
83+
<unix:filepath>$1/normal_symlink</unix:filepath>
84+
</unix:symlink_object>
85+
<unix:symlink_object id="oval:1:obj:2" version="1">
86+
<unix:filepath>$1/broken_symlink</unix:filepath>
87+
</unix:symlink_object>
88+
<unix:symlink_object id="oval:1:obj:3" version="1">
89+
<unix:filepath>/etc/does_not_exist</unix:filepath>
90+
</unix:symlink_object>
91+
<unix:symlink_object id="oval:1:obj:4" version="1">
92+
<unix:filepath>$1/some_file</unix:filepath>
93+
</unix:symlink_object>
94+
<unix:symlink_object id="oval:1:obj:5" version="1">
95+
<unix:filepath>$1/circular_symlink</unix:filepath>
96+
</unix:symlink_object>
97+
<unix:symlink_object id="oval:1:obj:6" version="1">
98+
<unix:filepath>$1/chained_symlink</unix:filepath>
99+
</unix:symlink_object>
100+
<unix:symlink_object id="oval:1:obj:7" version="1">
101+
<unix:filepath>/etc/passwd</unix:filepath>
102+
</unix:symlink_object>
103+
<unix:symlink_object id="oval:1:obj:8" version="1">
104+
<unix:filepath>/normal_symlink_relative</unix:filepath>
105+
</unix:symlink_object>
106+
<unix:symlink_object id="oval:1:obj:9" version="1">
107+
<unix:filepath>/broken_symlink_relative</unix:filepath>
108+
</unix:symlink_object>
109+
<unix:symlink_object id="oval:1:obj:10" version="1">
110+
<unix:filepath>/path_traversal_symlink</unix:filepath>
111+
</unix:symlink_object>
112+
<unix:symlink_object id="oval:1:obj:11" version="1">
113+
<unix:filepath>/symlink_with_dot_in_path</unix:filepath>
114+
</unix:symlink_object>
115+
<unix:symlink_object id="oval:1:obj:12" version="1">
116+
<unix:filepath>/tmp/symlinktest</unix:filepath>
117+
</unix:symlink_object>
118+
</objects>
119+
120+
<states>
121+
<unix:symlink_state id="oval:1:ste:1" version="1">
122+
<unix:filepath>$1/normal_symlink</unix:filepath>
123+
<unix:canonical_path>$1/some_file</unix:canonical_path>
124+
</unix:symlink_state>
125+
<unix:symlink_state id="oval:1:ste:6" version="1">
126+
<unix:filepath>$1/chained_symlink</unix:filepath>
127+
<unix:canonical_path>$1/other_file</unix:canonical_path>
128+
</unix:symlink_state>
129+
<unix:symlink_state id="oval:1:ste:7" version="1">
130+
<unix:filepath>$1/etc/passwd</unix:filepath>
131+
<unix:canonical_path>$1/etc/shadow</unix:canonical_path>
132+
</unix:symlink_state>
133+
<unix:symlink_state id="oval:1:ste:10" version="1">
134+
<unix:filepath>$1/path_traversal_symlink</unix:filepath>
135+
<unix:canonical_path>$1/file_in_root</unix:canonical_path>
136+
</unix:symlink_state>
137+
<unix:symlink_state id="oval:1:ste:11" version="1">
138+
<unix:filepath>$1/symlink_with_dot_in_path</unix:filepath>
139+
<unix:canonical_path>$1/some_file</unix:canonical_path>
140+
</unix:symlink_state>
141+
</states>
142+
143+
</oval_definitions>
144+
EOF

0 commit comments

Comments
 (0)