test_hardening.py 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114
  1. import os
  2. import json
  3. import infra.basetest
  4. class TestHardeningBase(infra.basetest.BRTest):
  5. config = \
  6. """
  7. BR2_powerpc64=y
  8. BR2_powerpc_e5500=y
  9. BR2_TOOLCHAIN_EXTERNAL=y
  10. BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
  11. BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
  12. BR2_TOOLCHAIN_EXTERNAL_URL="https://toolchains.bootlin.com/downloads/releases/toolchains/powerpc64-e5500/tarballs/powerpc64-e5500--glibc--stable-2018.02-2.tar.bz2"
  13. BR2_TOOLCHAIN_EXTERNAL_GCC_6=y
  14. BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_1=y
  15. BR2_TOOLCHAIN_EXTERNAL_CUSTOM_GLIBC=y
  16. BR2_TOOLCHAIN_EXTERNAL_CXX=y
  17. BR2_PACKAGE_LIGHTTPD=y
  18. BR2_PACKAGE_HOST_CHECKSEC=y
  19. # BR2_TARGET_ROOTFS_TAR is not set
  20. """
  21. checksec_files = ["usr/sbin/lighttpd", "bin/busybox"]
  22. def checksec_run(self, target_file):
  23. filepath = os.path.join(self.builddir, "target", target_file)
  24. cmd = ["host/bin/checksec", "--format=json",
  25. "--file={}".format(filepath)]
  26. # Checksec is being used for elf file analysis only. There are no
  27. # assumptions of target/run-time checks as part of this testing.
  28. ret = infra.run_cmd_on_host(self.builddir, cmd)
  29. return json.loads(ret)
  30. class TestRelro(TestHardeningBase):
  31. config = TestHardeningBase.config + \
  32. """
  33. BR2_RELRO_FULL=y
  34. """
  35. def test_run(self):
  36. for f in self.checksec_files:
  37. out = self.checksec_run(f)
  38. filepath = os.path.join(self.builddir, "target", f)
  39. self.assertEqual(out[filepath]["relro"], "full")
  40. self.assertEqual(out[filepath]["pie"], "yes")
  41. class TestRelroPartial(TestHardeningBase):
  42. config = TestHardeningBase.config + \
  43. """
  44. BR2_RELRO_PARTIAL=y
  45. """
  46. def test_run(self):
  47. for f in self.checksec_files:
  48. out = self.checksec_run(f)
  49. filepath = os.path.join(self.builddir, "target", f)
  50. self.assertEqual(out[filepath]["relro"], "partial")
  51. self.assertEqual(out[filepath]["pie"], "no")
  52. class TestSspNone(TestHardeningBase):
  53. config = TestHardeningBase.config + \
  54. """
  55. BR2_SSP_NONE=y
  56. """
  57. def test_run(self):
  58. for f in self.checksec_files:
  59. out = self.checksec_run(f)
  60. filepath = os.path.join(self.builddir, "target", f)
  61. self.assertEqual(out[filepath]["canary"], "no")
  62. class TestSspStrong(TestHardeningBase):
  63. config = TestHardeningBase.config + \
  64. """
  65. BR2_SSP_STRONG=y
  66. """
  67. def test_run(self):
  68. for f in self.checksec_files:
  69. out = self.checksec_run(f)
  70. filepath = os.path.join(self.builddir, "target", f)
  71. self.assertEqual(out[filepath]["canary"], "yes")
  72. class TestFortifyNone(TestHardeningBase):
  73. config = TestHardeningBase.config + \
  74. """
  75. BR2_FORTIFY_SOURCE_NONE=y
  76. """
  77. def test_run(self):
  78. for f in self.checksec_files:
  79. out = self.checksec_run(f)
  80. filepath = os.path.join(self.builddir, "target", f)
  81. self.assertEqual(out[filepath]["fortified"], "0")
  82. class TestFortifyConserv(TestHardeningBase):
  83. config = TestHardeningBase.config + \
  84. """
  85. BR2_FORTIFY_SOURCE_1=y
  86. """
  87. def test_run(self):
  88. for f in self.checksec_files:
  89. out = self.checksec_run(f)
  90. filepath = os.path.join(self.builddir, "target", f)
  91. self.assertNotEqual(out[filepath]["fortified"], "0")