#61 Change strings check to match double-slash directory separator
Closed 4 years ago by plautrba. Opened 4 years ago by zpytela.
tests/ zpytela/selinux match-doubleslash  into  master

@@ -61,8 +61,8 @@ 

          rlSESearchRule "allow sshd_t var_run_t : dir { write add_name } [ ]"

          rlSESearchRule "type_transition sshd_t var_run_t : dir pam_var_run_t"

          rlSESearchRule "allow sshd_t pam_var_run_t : dir { create } [ ]"

-         rlRun "strings /usr/sbin/pam_timestamp_check | grep ${TIMESTAMP_DIR}"

-         rlRun "strings /usr/lib64/security/pam_timestamp.so | grep ${TIMESTAMP_DIR}"

+         rlRun "strings /usr/sbin/pam_timestamp_check | sed \"s|//*|/|g\" | grep ${TIMESTAMP_DIR}"

+         rlRun "strings /usr/lib64/security/pam_timestamp.so | sed \"s|//*|/|g\" | grep ${TIMESTAMP_DIR}"

      rlPhaseEnd

  

      rlPhaseStartTest "real scenario -- confined users"

Change the strings check verifying if /usr/sbin/pam_timestamp_check and
/usr/lib64/security/pam_timestamp.so contain the /run/pam_timestamp string
to match also two slashes in a row.

See the following output:

# strings /usr/lib64/security/pam_timestamp.so | grep /run/
/var/run//pam_timestamp
/var/run//pam_timestamp/_pam_timestamp_key

Thanks. But it would be better to use the original approach used in the original test from @mmalik

TIMESTAMP_DIR=${TIMESTAMP_DIR:-"/run//pam_timestamp"}

I though it's a typo a dropped double // I'm sorry it's my fault.

Btw you could make sed command readable using other separater than /:

sed "s|run//|run/|"

Thanks. But it would be better to use the original approach used in the original test from @mmalik
TIMESTAMP_DIR=${TIMESTAMP_DIR:-"/run//pam_timestamp"}

I though it's a typo a dropped double // I'm sorry it's my fault.

In that case when changing it back please don't forget to add a comment explaining why the double slash is needed, so that we don't repeat history again ;)

@zpytela Thanks again for the reporting and sorry for the complication. I've created a new PR with @mmalik 's original approach - https://src.fedoraproject.org/tests/selinux/pull-request/64

Pull-Request has been closed by plautrba

4 years ago

Pull-Request has been reopened by plautrba

4 years ago

@zpytela please update the sed command in order not to use unnecessary escape \

Maybe it would be enough to use just sed 's|//|/|'

While we are at it, we could make it even more robust and replace all consecutive slashes with just one: sed 's|//*|/|g'

I changed the expressions to make the command more readable for majority of readers. (Personally, I am used to reading those ugly ones.

rebased onto 3f52d01

4 years ago

Pull-Request has been closed by plautrba

4 years ago
Metadata