blob: 32c51407076b92b6799951013aff47de8a58e1ae [file] [log] [blame]
# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
import logging
import os
from autotest_lib.client.bin import test, utils
from autotest_lib.client.common_lib import error
class security_SuidBinaries(test.test):
Make sure no surprise binaries become setuid, setgid, or gain filesystem
capabilities without autotest noticing.
version = 1
def _load_baseline_file(self, basename):
"""Load the list of expected files from a given file name.
@param basename the basename of the file to load.
@returns a set containing the names of the files listed in the baseline
path = os.path.join(self.bindir, basename)
if os.path.exists(path):
with open(path) as basefile:
return set(l.strip() for l in basefile if l.strip()[0] != '#')
return set()
def _load_baseline(self, bltype):
"""Load the list of expected files for a given baseline type.
@param bltype the baseline to load.
@returns a set containing the names of the files in the board's
# Baseline common to all boards.
blname = 'baseline.' + bltype
blset = self._load_baseline_file(blname)
# Board-specific baseline.
board_blname = 'baseline.%s.%s' % (utils.get_current_board(), bltype)
blset |= self._load_baseline_file(board_blname)
return blset
def run_once(self, baseline='suid'):
Do a find on the system for setuid binaries, compare against baseline.
Fail if setuid binaries are found on the system but not on the baseline.
exclude = [ '/proc',
cmd = 'find / '
for item in exclude:
cmd += '-wholename %s -prune -o ' % (item)
cmd += '-type f '
permmask = {'suid': '4000', 'sgid': '2000'}
if baseline in permmask:
cmd += '-a -perm /%s -print' % (permmask[baseline])
elif baseline == 'fscap':
cmd += '-exec getcap {} +'
raise error.TestFail("Unknown baseline '%s'!" % (baseline))
cmd_output = utils.system_output(cmd, ignore_status=True)
observed_set = set(cmd_output.splitlines())
baseline_set = self._load_baseline(baseline)
# Report observed set for debugging.
for line in observed_set:
logging.debug('%s: %s', baseline, line)
# Fail if we find new binaries.
new = observed_set.difference(baseline_set)
if len(new) > 0:
message = 'New %s binaries: %s' % (baseline, ', '.join(new))
raise error.TestFail(message)
# Log but not fail if we find missing binaries.
missing = baseline_set.difference(observed_set)
if len(missing) > 0:
for filepath in missing:
logging.error('Missing %s binary: %s', baseline, filepath)
logging.debug('OK: %s baseline matches system', baseline)