4692 2013-06-12 10:04:21 +0000 [QA] - verify - Security Tools - consider fedora/gentoo runtime security tools 2013-07-30 13:53:51 +0000 1 1 10 QA/Testing Test Plans/Suite test-plans/suite 1.5 x86 Multiple VERIFIED FIXED High enhancement 1.5 M3 1584 1 alexandru.c.georgescu corneliux.stoicescu andrei.adrianx.dinu corneliux.stoicescu razvanx.ionescu richard.purdie sgw sh88ting.star --- --- --- oldest_to_newest 33825 0 alexandru.c.georgescu 2013-06-12 10:04:21 +0000 Added to track feature verification for Bug 1584 - Security Tools - consider fedora/gentoo runtime security tools 34274 1 corneliux.stoicescu 2013-07-02 09:36:28 +0000 In order to create test cases with pax-utils, we need to determine what binaries we will scan and what issues we will ignore. The ' scanelf ' utility prints out information specific to the ELF structure of a binary. Running the proposed scripts from the pax-utils documentation on a core-image-sato with the -q option set(Only output 'bad' things), we get the following output: * Scanning for PaX markings issues: root@qemux86-64:/# scanelf -mxqR / * Scanning for GNU_STACK/PT_LOAD markings issues: root@qemux86-64:/# scanelf -meqR / --- --- RWX /boot/vmlinux-3.8.13-yocto-standard * Scanning for TEXTREL information issues: root@qemux86-64:/# scanelf -mtqR / * Scanning for RPATH information issues: root@qemux86-64:/# scanelf -mrqR / * Scanning for BIND information issues: root@qemux86-64:/# scanelf -mbqR / LAZY /sbin/mount.nfs LAZY /usr/lib/vte/gnome-pty-helper LAZY /usr/lib/dbus/dbus-daemon-launch-helper LAZY /usr/bin/newgrp.shadow LAZY /usr/bin/apm LAZY /usr/bin/su LAZY /usr/bin/chsh.shadow LAZY /usr/bin/expiry LAZY /usr/bin/chfn.shadow LAZY /usr/bin/sudo LAZY /usr/bin/gpasswd LAZY /usr/bin/chage LAZY /usr/bin/passwd.shadow LAZY /bin/tinylogin LAZY /bin/busybox Please note that an empty output means we have no issues. There are also scan options for the following ELF fields: - SONAME information issues - NEEDED information issues - INTERP information issues Test cases have been made for the above: https://bugzilla.yoctoproject.org/tr_list_cases.cgi?searchstr=meta-security%3A%20PAX&current_tab=case&summary_type=anywordssubstr&summary=meta-security%3A%20PAX&field-1-0-0=summary&type-1-0-0=anywordssubstr&value-1-0-0=meta-security%3A%20PAX 35157 2 corneliux.stoicescu 2013-07-30 10:11:15 +0000 Feature is verified. 35158 3 corneliux.stoicescu 2013-07-30 10:12:08 +0000 Setting this also to verified. 35169 4 corneliux.stoicescu 2013-07-30 13:53:51 +0000 Test cases for redhat-security added: https://bugzilla.yoctoproject.org/tr_show_case.cgi?case_id=782 https://bugzilla.yoctoproject.org/tr_show_case.cgi?case_id=781