From 09057e47540dbaac7c076982ebf1698e7e6686fd Mon Sep 17 00:00:00 2001 From: "Liu,Bijun" Date: Wed, 8 Jan 2020 16:55:16 +0800 Subject: [PATCH] add SDL test cases --- tests/Makefile | 2 +- tests/exec.sh | 7 ++++ tests/flink/flink-security.bats | 53 +++++++++++++++++++++++++ tests/flink/flink.bats | 0 tests/memcached/memcached-security.bats | 53 +++++++++++++++++++++++++ tests/nginx/nginx-security.bats | 53 +++++++++++++++++++++++++ tests/python/python-security.bats | 53 +++++++++++++++++++++++++ tests/redis/redis-security.bats | 53 +++++++++++++++++++++++++ tests/ruby/ruby-security.bats | 53 +++++++++++++++++++++++++ tests/security.bash | 51 ++++++++++++++++++++++++ 10 files changed, 377 insertions(+), 1 deletion(-) create mode 100755 tests/exec.sh create mode 100755 tests/flink/flink-security.bats mode change 100644 => 100755 tests/flink/flink.bats create mode 100755 tests/memcached/memcached-security.bats create mode 100755 tests/nginx/nginx-security.bats create mode 100755 tests/python/python-security.bats create mode 100755 tests/redis/redis-security.bats create mode 100755 tests/ruby/ruby-security.bats create mode 100644 tests/security.bash diff --git a/tests/Makefile b/tests/Makefile index b4939cc..3dfa4a4 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -9,7 +9,7 @@ all: .PHONY: $(test_units) $(test_units): - cd $@; bats -t $@.bats + sh exec.sh $@ .NOTPARALLEL: tests tests: $(test_units) diff --git a/tests/exec.sh b/tests/exec.sh new file mode 100755 index 0000000..475c181 --- /dev/null +++ b/tests/exec.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash +TEST_UNITS=$1 +cd $TEST_UNITS +bats -t $TEST_UNITS.bats +if [ -f $TEST_UNITS-security.bats ];then + bats -t $TEST_UNITS-security.bats +fi diff --git a/tests/flink/flink-security.bats b/tests/flink/flink-security.bats new file mode 100755 index 0000000..75504c7 --- /dev/null +++ b/tests/flink/flink-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name flink-server --detach clearlinux/flink jobmanager + run check_container_status flink-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/flink + [ "$output" == "pass" ] + + # stop the container + docker rm -f flink-server + sleep 3 + run check_container_status flink-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name flink-server --detach clearlinux/flink jobmanager + run check_container_status flink-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/flink + [ "$output" == "pass" ] + + # stop the container + docker rm -f flink-server + sleep 3 + run check_container_status flink-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name flink-server --detach --security-opt=no-new-privileges clearlinux/flink jobmanager + run check_container_status flink-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/flink + [ "$output" == "pass" ] + + # stop the container + docker rm -f flink-server + sleep 3 + run check_container_status flink-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/flink/flink.bats b/tests/flink/flink.bats old mode 100644 new mode 100755 diff --git a/tests/memcached/memcached-security.bats b/tests/memcached/memcached-security.bats new file mode 100755 index 0000000..ccfbf1f --- /dev/null +++ b/tests/memcached/memcached-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name memcached-server --detach clearlinux/memcached + run check_container_status memcached-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/memcached + [ "$output" == "pass" ] + + # stop the container + docker rm -f memcached-server + sleep 3 + run check_container_status memcached-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name memcached-server --detach clearlinux/memcached + run check_container_status memcached-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/memcached + [ "$output" == "pass" ] + + # stop the container + docker rm -f memcached-server + sleep 3 + run check_container_status memcached-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name memcached-server --detach --security-opt=no-new-privileges clearlinux/memcached + run check_container_status memcached-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/memcached + [ "$output" == "pass" ] + + # stop the container + docker rm -f memcached-server + sleep 3 + run check_container_status memcached-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/nginx/nginx-security.bats b/tests/nginx/nginx-security.bats new file mode 100755 index 0000000..094e92a --- /dev/null +++ b/tests/nginx/nginx-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name nginx-server --detach clearlinux/nginx + run check_container_status nginx-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/nginx + [ "$output" == "pass" ] + + # stop the container + docker rm -f nginx-server + sleep 3 + run check_container_status nginx-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name nginx-server --detach clearlinux/nginx + run check_container_status nginx-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/nginx + [ "$output" == "pass" ] + + # stop the container + docker rm -f nginx-server + sleep 3 + run check_container_status nginx-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name nginx-server --detach --security-opt=no-new-privileges clearlinux/nginx + run check_container_status nginx-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/nginx + [ "$output" == "pass" ] + + # stop the container + docker rm -f nginx-server + sleep 3 + run check_container_status nginx-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/python/python-security.bats b/tests/python/python-security.bats new file mode 100755 index 0000000..21f8b33 --- /dev/null +++ b/tests/python/python-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name python-server --detach clearlinux/python sleep 60 + run check_container_status python-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/python + [ "$output" == "pass" ] + + # stop the container + docker rm -f python-server + sleep 3 + run check_container_status python-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name python-server --detach clearlinux/python sleep 60 + run check_container_status python-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/python + [ "$output" == "pass" ] + + # stop the container + docker rm -f python-server + sleep 3 + run check_container_status python-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name python-server --detach --security-opt=no-new-privileges clearlinux/python sleep 60 + run check_container_status python-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/python + [ "$output" == "pass" ] + + # stop the container + docker rm -f python-server + sleep 3 + run check_container_status python-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/redis/redis-security.bats b/tests/redis/redis-security.bats new file mode 100755 index 0000000..8bf5acd --- /dev/null +++ b/tests/redis/redis-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name redis-server --detach clearlinux/redis + run check_container_status redis-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/redis + [ "$output" == "pass" ] + + # stop the container + docker rm -f redis-server + sleep 3 + run check_container_status redis-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name redis-server --detach clearlinux/redis + run check_container_status redis-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/redis + [ "$output" == "pass" ] + + # stop the container + docker rm -f redis-server + sleep 3 + run check_container_status redis-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name redis-server --detach --security-opt=no-new-privileges clearlinux/redis + run check_container_status redis-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/redis + [ "$output" == "pass" ] + + # stop the container + docker rm -f redis-server + sleep 3 + run check_container_status redis-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/ruby/ruby-security.bats b/tests/ruby/ruby-security.bats new file mode 100755 index 0000000..e945954 --- /dev/null +++ b/tests/ruby/ruby-security.bats @@ -0,0 +1,53 @@ +#!/usr/bin/env bats +# Copyright (C) 2018 Intel Corporation +# SPDX-License-Identifier: Apache-2.0 + +load ../utils +load ../security + +@test "SDL T1191 test" { + # start container first + docker run --name ruby-server --detach clearlinux/ruby + run check_container_status ruby-server + [ "$status" -eq 0 ] + run Test_SDL_T1191 clearlinux/ruby + [ "$output" == "pass" ] + + # stop the container + docker rm -f ruby-server + sleep 3 + run check_container_status ruby-server + [ "$status" -eq 1 ] +} + +@test "SDL T1195 test" { + # start container first + docker run --name ruby-server --detach clearlinux/ruby + run check_container_status ruby-server + [ "$status" -eq 0 ] + run Test_SDL_T1195 clearlinux/ruby + [ "$output" == "pass" ] + + # stop the container + docker rm -f ruby-server + sleep 3 + run check_container_status ruby-server + [ "$status" -eq 1 ] +} + +@test "SDL T1215 test" { + # start container first + docker run --name ruby-server --detach --security-opt=no-new-privileges clearlinux/ruby + run check_container_status ruby-server + [ "$status" -eq 0 ] + run Test_SDL_T1215 clearlinux/ruby + [ "$output" == "pass" ] + + # stop the container + docker rm -f ruby-server + sleep 3 + run check_container_status ruby-server + [ "$status" -eq 1 ] +} + + diff --git a/tests/security.bash b/tests/security.bash new file mode 100644 index 0000000..6c8ebda --- /dev/null +++ b/tests/security.bash @@ -0,0 +1,51 @@ +# Defines helper functions used across a variety of tests. + +#Start security test +#SDL_T1191:Test if Linux Kernel Capabilities are restricted within containers (Docker) +Test_SDL_T1191() { + if [ -n $1 ]; then + local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'` + else + echo "Couldn't get container ID for image $1" + fi + local t1191=`docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}' | grep $container_id` + local t1191_result=`echo $t1191 | awk -F"=" '{print $2}'` + if [ "$t1191_result" == "false" ];then + echo "pass" + else + echo "fail" + fi +} + +#SDL_T1195: Test if SSH is running within containers (Docker) +Test_SDL_T1195() { + if [ -n $1 ]; then + local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'` + else + echo "Couldn't get container ID for image $1" + fi + t1195=`docker exec $container_id ps -el | grep -i ssh` + if [ "$t1195" == "" ];then + echo "pass" + else + echo "fail" + fi +} + +#SDL_T1215: Verify that containers are restricted from acquiring additional privileges (Docker) +Test_SDL_T1215() { + if [ -n $1 ]; then + local container_id=`docker ps --format "table {{.ID}} {{.Image}}" | grep $1 | awk '{print $1}'` + else + echo "Couldn't get container ID for image $1" + fi + t1215=`docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}' | grep $container_id` + t1215_result=`echo $t1215 | awk -F"=" '{print $2}'` + if [ "$t1215_result" == "[no-new-privileges]" ];then + echo "pass" + else + echo "fail" + fi +} + +