| Summary: | [QA] - verify - Security Tools - consider fedora/gentoo runtime security tools | ||
|---|---|---|---|
| Product: | [QA/Testing] Test Plans/Suite | Reporter: | Alexandru Georgescu <alexandru.c.georgescu> |
| Component: | test-plans/suite | Assignee: | Stoicescu Cornel <corneliux.stoicescu> |
| Status: | VERIFIED FIXED | QA Contact: | |
| Severity: | enhancement | ||
| Priority: | High | CC: | andrei.adrianx.dinu, corneliux.stoicescu, razvanx.ionescu, richard.purdie, sgw, sh88ting.star |
| Version: | 1.5 | ||
| Target Milestone: | 1.5 M3 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | --- | |
| Bug Depends on: | 1584 | ||
| Bug Blocks: | |||
|
Description
Alexandru Georgescu
2013-06-12 10:04:21 UTC
In order to create test cases with pax-utils, we need to determine what binaries we will scan and what issues we will ignore. The ' scanelf ' utility prints out information specific to the ELF structure of a binary. Running the proposed scripts from the pax-utils documentation on a core-image-sato with the -q option set(Only output 'bad' things), we get the following output: * Scanning for PaX markings issues: root@qemux86-64:/# scanelf -mxqR / * Scanning for GNU_STACK/PT_LOAD markings issues: root@qemux86-64:/# scanelf -meqR / --- --- RWX /boot/vmlinux-3.8.13-yocto-standard * Scanning for TEXTREL information issues: root@qemux86-64:/# scanelf -mtqR / * Scanning for RPATH information issues: root@qemux86-64:/# scanelf -mrqR / * Scanning for BIND information issues: root@qemux86-64:/# scanelf -mbqR / LAZY /sbin/mount.nfs LAZY /usr/lib/vte/gnome-pty-helper LAZY /usr/lib/dbus/dbus-daemon-launch-helper LAZY /usr/bin/newgrp.shadow LAZY /usr/bin/apm LAZY /usr/bin/su LAZY /usr/bin/chsh.shadow LAZY /usr/bin/expiry LAZY /usr/bin/chfn.shadow LAZY /usr/bin/sudo LAZY /usr/bin/gpasswd LAZY /usr/bin/chage LAZY /usr/bin/passwd.shadow LAZY /bin/tinylogin LAZY /bin/busybox Please note that an empty output means we have no issues. There are also scan options for the following ELF fields: - SONAME information issues - NEEDED information issues - INTERP information issues Test cases have been made for the above: https://bugzilla.yoctoproject.org/tr_list_cases.cgi?searchstr=meta-security%3A%20PAX¤t_tab=case&summary_type=anywordssubstr&summary=meta-security%3A%20PAX&field-1-0-0=summary&type-1-0-0=anywordssubstr&value-1-0-0=meta-security%3A%20PAX Feature is verified. Setting this also to verified. Test cases for redhat-security added: https://bugzilla.yoctoproject.org/tr_show_case.cgi?case_id=782 https://bugzilla.yoctoproject.org/tr_show_case.cgi?case_id=781 |