clearlinux/dockerfiles
2
0
Fork 0
mirror of https://github.com/clearlinux/dockerfiles.git synced 2026-08-19 04:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

add SDL test cases

Browse Source
This commit is contained in:
Liu,Bijun
2020-01-08 16:55:16 +08:00
committed by qzheng527
parent b93034c44a
commit 09057e4754
10 changed files with 377 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Makefile
+1 -1
View File
@@ -9,7 +9,7 @@ all:
.PHONY: $(test_units)
$(test_units):
cd $@; bats -t $@.bats
sh exec.sh $@
.NOTPARALLEL: tests
tests: $(test_units)
tests/exec.sh
Executable
+7
View File
@@ -0,0 +1,7 @@
#!/usr/bin/env bash
TEST_UNITS=$1
cd $TEST_UNITS
bats -t $TEST_UNITS.bats
if [ -f $TEST_UNITS-security.bats ];then
bats -t $TEST_UNITS-security.bats
fi
tests/flink/flink-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name flink-server --detach clearlinux/flink jobmanager
run check_container_status flink-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/flink
[ "$output" == "pass" ]
# stop the container
docker rm -f flink-server
sleep 3
run check_container_status flink-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name flink-server --detach clearlinux/flink jobmanager
run check_container_status flink-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/flink
[ "$output" == "pass" ]
# stop the container
docker rm -f flink-server
sleep 3
run check_container_status flink-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name flink-server --detach --security-opt=no-new-privileges clearlinux/flink jobmanager
run check_container_status flink-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/flink
[ "$output" == "pass" ]
# stop the container
docker rm -f flink-server
sleep 3
run check_container_status flink-server
[ "$status" -eq 1 ]
}
tests/flink/flink.bats
Regular → Executable
View File
tests/memcached/memcached-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name memcached-server --detach clearlinux/memcached
run check_container_status memcached-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/memcached
[ "$output" == "pass" ]
# stop the container
docker rm -f memcached-server
sleep 3
run check_container_status memcached-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name memcached-server --detach clearlinux/memcached
run check_container_status memcached-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/memcached
[ "$output" == "pass" ]
# stop the container
docker rm -f memcached-server
sleep 3
run check_container_status memcached-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name memcached-server --detach --security-opt=no-new-privileges clearlinux/memcached
run check_container_status memcached-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/memcached
[ "$output" == "pass" ]
# stop the container
docker rm -f memcached-server
sleep 3
run check_container_status memcached-server
[ "$status" -eq 1 ]
}
tests/nginx/nginx-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name nginx-server --detach clearlinux/nginx
run check_container_status nginx-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/nginx
[ "$output" == "pass" ]
# stop the container
docker rm -f nginx-server
sleep 3
run check_container_status nginx-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name nginx-server --detach clearlinux/nginx
run check_container_status nginx-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/nginx
[ "$output" == "pass" ]
# stop the container
docker rm -f nginx-server
sleep 3
run check_container_status nginx-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name nginx-server --detach --security-opt=no-new-privileges clearlinux/nginx
run check_container_status nginx-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/nginx
[ "$output" == "pass" ]
# stop the container
docker rm -f nginx-server
sleep 3
run check_container_status nginx-server
[ "$status" -eq 1 ]
}
tests/python/python-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name python-server --detach clearlinux/python sleep 60
run check_container_status python-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/python
[ "$output" == "pass" ]
# stop the container
docker rm -f python-server
sleep 3
run check_container_status python-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name python-server --detach clearlinux/python sleep 60
run check_container_status python-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/python
[ "$output" == "pass" ]
# stop the container
docker rm -f python-server
sleep 3
run check_container_status python-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name python-server --detach --security-opt=no-new-privileges clearlinux/python sleep 60
run check_container_status python-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/python
[ "$output" == "pass" ]
# stop the container
docker rm -f python-server
sleep 3
run check_container_status python-server
[ "$status" -eq 1 ]
}
tests/redis/redis-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name redis-server --detach clearlinux/redis
run check_container_status redis-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/redis
[ "$output" == "pass" ]
# stop the container
docker rm -f redis-server
sleep 3
run check_container_status redis-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name redis-server --detach clearlinux/redis
run check_container_status redis-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/redis
[ "$output" == "pass" ]
# stop the container
docker rm -f redis-server
sleep 3
run check_container_status redis-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name redis-server --detach --security-opt=no-new-privileges clearlinux/redis
run check_container_status redis-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/redis
[ "$output" == "pass" ]
# stop the container
docker rm -f redis-server
sleep 3
run check_container_status redis-server
[ "$status" -eq 1 ]
}
tests/ruby/ruby-security.bats
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bats
# Copyright (C) 2018 Intel Corporation
# SPDX-License-Identifier: Apache-2.0
load ../utils
load ../security
@test "SDL T1191 test" {
# start container first
docker run --name ruby-server --detach clearlinux/ruby
run check_container_status ruby-server
[ "$status" -eq 0 ]
run Test_SDL_T1191 clearlinux/ruby
[ "$output" == "pass" ]
# stop the container
docker rm -f ruby-server
sleep 3
run check_container_status ruby-server
[ "$status" -eq 1 ]
}
@test "SDL T1195 test" {
# start container first
docker run --name ruby-server --detach clearlinux/ruby
run check_container_status ruby-server
[ "$status" -eq 0 ]
run Test_SDL_T1195 clearlinux/ruby
[ "$output" == "pass" ]
# stop the container
docker rm -f ruby-server
sleep 3
run check_container_status ruby-server
[ "$status" -eq 1 ]
}
@test "SDL T1215 test" {
# start container first
docker run --name ruby-server --detach --security-opt=no-new-privileges clearlinux/ruby
run check_container_status ruby-server
[ "$status" -eq 0 ]
run Test_SDL_T1215 clearlinux/ruby
[ "$output" == "pass" ]
# stop the container
docker rm -f ruby-server
sleep 3
run check_container_status ruby-server
[ "$status" -eq 1 ]
}
tests/security.bash
+51
View File
@@ -0,0 +1,51 @@
# Defines helper functions used across a variety of tests.
#Start security test
#SDL_T1191:Test if Linux Kernel Capabilities are restricted within containers (Docker)
Test_SDL_T1191() {
if [ -n $1 ]; then
local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'`
else
echo "Couldn't get container ID for image $1"
fi
local t1191=`docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}' | grep $container_id`
local t1191_result=`echo $t1191 | awk -F"=" '{print $2}'`
if [ "$t1191_result" == "false" ];then
echo "pass"
else
echo "fail"
fi
}
#SDL_T1195: Test if SSH is running within containers (Docker)
Test_SDL_T1195() {
if [ -n $1 ]; then
local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'`
else
echo "Couldn't get container ID for image $1"
fi
t1195=`docker exec $container_id ps -el | grep -i ssh`
if [ "$t1195" == "" ];then
echo "pass"
else
echo "fail"
fi
}
#SDL_T1215: Verify that containers are restricted from acquiring additional privileges (Docker)
Test_SDL_T1215() {
if [ -n $1 ]; then
local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'`
else
echo "Couldn't get container ID for image $1"
fi
t1215=`docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' | grep $container_id`
t1215_result=`echo $t1215 | awk -F"=" '{print $2}'`
if [ "$t1215_result" == "[no-new-privileges]" ];then
echo "pass"
else
echo "fail"
fi
}