Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

checksec FORTIFY detection #236

Merged
merged 4 commits into from
Apr 25, 2024
Merged

checksec FORTIFY detection #236

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
edd3c8d
Update filecheck.sh (Fortify)
teoberi Apr 22, 2024
9a36b4b
Update hardening-checks.sh (Fortify)
teoberi Apr 22, 2024
7b6b249
Update build_binaries.sh (fix Fortify for "Partial" case)
teoberi Apr 25, 2024
d7a3704
Update hardening-checks.sh (fix Fortify "Partial" case)
teoberi Apr 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions src/functions/filecheck.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,10 +138,18 @@ filecheck() {
FS_cnt_unchecked=$(grep -cFxf <(sort <<< "${FS_func_libc}") <(sort <<< "${FS_func}"))
FS_cnt_total=$((FS_cnt_unchecked + FS_cnt_checked))

if [[ $FS_cnt_checked -eq $FS_cnt_total ]]; then
echo_message '\033[32mYes\033[m' 'Yes,' ' fortify_source="yes" ' '"fortify_source":"yes",'
if [[ "${FS_cnt_total}" == "0" ]]; then
echo_message "\033[32mN/A\033[m" "N/A," ' fortify_source="n/a" ' '"fortify_source":"n/a",'
else
echo_message "\033[31mNo\033[m" "No," ' fortify_source="no" ' '"fortify_source":"no",'
if [[ $FS_cnt_checked -eq $FS_cnt_total ]]; then
echo_message '\033[32mYes\033[m' 'Yes,' ' fortify_source="yes" ' '"fortify_source":"yes",'
else
if [[ "${FS_cnt_checked}" == "0" ]]; then
echo_message "\033[31mNo\033[m" "No," ' fortify_source="no" ' '"fortify_source":"no",'
else
echo_message "\033[33mPartial\033[m" "Partial," ' fortify_source="partial" ' '"fortify_source":"partial",'
slimm609 marked this conversation as resolved.
Show resolved Hide resolved
fi
fi
fi
echo_message "\t${FS_cnt_checked}\t" "${FS_cnt_checked}", "fortified=\"${FS_cnt_checked}\" " "\"fortified\":\"${FS_cnt_checked}\","
echo_message "\t${FS_cnt_total}\t\t" "${FS_cnt_total}" "fortify-able=\"${FS_cnt_total}\"" "\"fortify-able\":\"${FS_cnt_total}\""
Expand Down
16 changes: 15 additions & 1 deletion tests/hardening-checks.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ echo "Symbols validation tests passed"

#============================================

echo "Starting Foritfy check"
echo "Starting Fortify check"
# Yes
for bin in all all32 all_cl all_cl32; do
if [[ $("${PARENT}"/checksec --file="${DIR}/binaries/${bin}" --format=csv | cut -d, -f8) != "Yes" ]]; then
Expand All @@ -267,6 +267,20 @@ for bin in none none32 none_cl none_cl32; do
exit 1
fi
done
# N/A
for bin in rel.o rel32.o rel_cl.o rel_cl32.o; do
if [[ $("${PARENT}"/checksec --file="${DIR}/binaries/${bin}" --format=csv | cut -d, -f8) != "N/A" ]]; then
echo "No Fortify validation failed on \"${bin}\": $("${PARENT}"/checksec --file="${DIR}/binaries/${bin}" --format=csv | cut -d, -f8)"
exit 1
fi
done
# Partial
for bin in rel.o rel32.o rel_cl.o rel_cl32.o; do
if [[ $("${PARENT}"/checksec --file="${DIR}/binaries/${bin}" --format=csv | cut -d, -f8) != "Partial" ]]; then
echo "No Fortify validation failed on \"${bin}\": $("${PARENT}"/checksec --file="${DIR}/binaries/${bin}" --format=csv | cut -d, -f8)"
exit 1
fi
done
echo "Fortify validation tests passed"

#============================================
Expand Down
Loading