Skip to content

Vulnix support #1717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pandapip1 wants to merge 1 commit into
base: master
Choose a base branch
from
+31 −0
Open

Vulnix support #1717

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions include/binaries
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,7 @@
veritysetup) VERITYSETUPBINARY="${BINARY}"; LogText " Found known binary: veritysetup (dm-verity setup tool) - ${BINARY}" ;;
vgdisplay) VGDISPLAYBINARY="${BINARY}"; LogText " Found known binary: vgdisplay (LVM tool) - ${BINARY}" ;;
vmtoolsd) VMWARETOOLSDBINARY="${BINARY}"; LogText " Found known binary: vmtoolsd (VMWare tools) - ${BINARY}" ;;
vulnix) VULNIXBINARY="${BINARY}"; LogText " Found known binary: vulnix (package audit tool) - ${BINARY}" ;;
wc) WCBINARY="${BINARY}"; LogText " Found known binary: wc (word count) - ${BINARY}" ;;
wget) WGETBINARY="${BINARY}"; WGETVERSION=$(${BINARY} -V 2> /dev/null | grep "^GNU Wget" | awk '{ print $3 }'); LogText "Found ${BINARY} (version ${WGETVERSION})" ;;
yum) YUMBINARY="${BINARY}"; LogText " Found known binary: yum (package manager) - ${BINARY}" ;;
Expand Down
1 change: 1 addition & 0 deletions include/consts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,6 +346,7 @@ ETC_PATHS="/etc /usr/local/etc"
VGDISPLAYBINARY=""
VMTYPE=""
VULNERABLE_PACKAGES_FOUND=0
VULNIXBINARY=""
WCBINARY=""
XARGSBINARY=""
XBPSBINARY=""
Expand Down
29 changes: 29 additions & 0 deletions include/tests_ports_packages
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,6 +414,35 @@ EOF
fi
#
#################################################################################
#
# Test : PKGS-7329
# Description : Check vulnerable packages with vulnix
if [ -n "${VULNIXBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7329 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying vulnix for vulnerable packages"
if [ ${SKIPTEST} -eq 0 ]; then
PACKAGE_AUDIT_TOOL_FOUND=1
PACKAGE_AUDIT_TOOL="vulnix"
FIND=$(${VULNIXBINARY} --system)
if [ $? -eq 0 ]; then
LogText "Result: No vulnerabilities found with vulnix"
Display --indent 2 --text "- Using vulnix to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN
else
Display --indent 2 --text "- Using vulnix to find vulnerable packages" --result "${STATUS_WARNING}" --color RED
LogText "Result: Vulnix found one or more installed packages which are vulnerable."
ReportWarning "${TEST_NO}" "Found one or more vulnerable packages installed"
LogText "List of vulnerable packages/version:"
FIND=$(echo "$FIND" | ${SEDBINARY} -n '/^[-]\{5,\}$/ { n; s/-[0-9].*$//; p }' | ${UNIQBINARY})
for PKG in ${FIND}; do
VULNERABLE_PACKAGES_FOUND=1
Report "vulnerable_package[]=${PKG}"
LogText "Vulnerable package: ${PKG}"
# Decrease hardening points for every found vulnerable package
AddHP 1 2
done
fi
fi
#
#################################################################################
#
# Test : PKGS-7330
# Description : Check vulnerable packages with Zypper
Expand Down