130 lines
2.4 KiB
Go
130 lines
2.4 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
systemd_test.go
|
|
*/
|
|
|
|
package scanner
|
|
|
|
import (
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"github.com/CarterPerez-dev/sentinel/pkg/types"
|
|
)
|
|
|
|
func testdataDir() string {
|
|
_, file, _, _ := runtime.Caller(0)
|
|
return filepath.Join(
|
|
filepath.Dir(file),
|
|
"..", "..", "testdata",
|
|
)
|
|
}
|
|
|
|
func TestSystemdScanner_CleanService(t *testing.T) {
|
|
s := &SystemdScanner{}
|
|
findings := s.analyzeUnit(
|
|
filepath.Join(
|
|
testdataDir(), "systemd", "clean-service.service",
|
|
),
|
|
mitreSystemd,
|
|
)
|
|
|
|
suspicious := filterSuspicious(findings)
|
|
if len(suspicious) > 0 {
|
|
t.Errorf(
|
|
"clean service produced %d suspicious findings, want 0",
|
|
len(suspicious),
|
|
)
|
|
for _, f := range suspicious {
|
|
t.Logf(" finding: %s (%s)", f.Title, f.Evidence)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSystemdScanner_SuspiciousService(t *testing.T) {
|
|
s := &SystemdScanner{}
|
|
findings := s.analyzeUnit(
|
|
filepath.Join(
|
|
testdataDir(),
|
|
"systemd",
|
|
"suspicious-service.service",
|
|
),
|
|
mitreSystemd,
|
|
)
|
|
|
|
suspicious := filterSuspicious(findings)
|
|
if len(suspicious) == 0 {
|
|
t.Fatal("suspicious service produced no findings")
|
|
}
|
|
|
|
foundCurl := false
|
|
foundTmp := false
|
|
for _, f := range suspicious {
|
|
if f.Severity >= types.SeverityHigh {
|
|
foundCurl = true
|
|
}
|
|
if f.Severity >= types.SeverityMedium {
|
|
foundTmp = true
|
|
}
|
|
}
|
|
|
|
if !foundCurl {
|
|
t.Error("expected high-severity finding for curl|sh")
|
|
}
|
|
if !foundTmp {
|
|
t.Error("expected finding for /tmp path")
|
|
}
|
|
}
|
|
|
|
func TestSystemdScanner_TimerMITRE(t *testing.T) {
|
|
s := &SystemdScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(),
|
|
"systemd",
|
|
"timer-backdoor.timer",
|
|
)
|
|
findings := s.analyzeUnit(path, mitreTimer)
|
|
|
|
for _, f := range findings {
|
|
if f.MITRE != mitreTimer {
|
|
t.Errorf(
|
|
"timer finding MITRE = %q, want %q",
|
|
f.MITRE, mitreTimer,
|
|
)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSystemdScanner_PathUnit(t *testing.T) {
|
|
s := &SystemdScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(),
|
|
"systemd",
|
|
"watch-beacon.path",
|
|
)
|
|
findings := s.analyzeUnit(path, mitrePath)
|
|
|
|
for _, f := range findings {
|
|
if f.MITRE != mitrePath {
|
|
t.Errorf(
|
|
"path unit MITRE = %q, want %q",
|
|
f.MITRE, mitrePath,
|
|
)
|
|
}
|
|
}
|
|
}
|
|
|
|
func filterSuspicious(
|
|
findings []types.Finding,
|
|
) []types.Finding {
|
|
var result []types.Finding
|
|
for _, f := range findings {
|
|
if f.Severity >= types.SeverityMedium &&
|
|
f.Title != "Recently modified unit file" {
|
|
result = append(result, f)
|
|
}
|
|
}
|
|
return result
|
|
}
|