73 lines
1.3 KiB
Go
73 lines
1.3 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
udev_test.go
|
|
*/
|
|
|
|
package scanner
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/CarterPerez-dev/sentinel/pkg/types"
|
|
)
|
|
|
|
func TestUdevScanner_BackdoorRule(t *testing.T) {
|
|
u := &UdevScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(), "udev", "backdoor.rules",
|
|
)
|
|
|
|
findings := u.scanRuleFile(path)
|
|
if len(findings) == 0 {
|
|
t.Fatal("backdoor udev rule produced no findings")
|
|
}
|
|
|
|
hasHighOrAbove := false
|
|
for _, f := range findings {
|
|
if f.Severity >= types.SeverityHigh {
|
|
hasHighOrAbove = true
|
|
}
|
|
}
|
|
|
|
if !hasHighOrAbove {
|
|
t.Error("expected high+ severity for curl|sh in RUN+=")
|
|
}
|
|
}
|
|
|
|
func TestExtractRunDirective(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
line string
|
|
want string
|
|
}{
|
|
{
|
|
name: "quoted directive",
|
|
line: `ACTION=="add", RUN+="/bin/bash -c 'echo test'"`,
|
|
want: "/bin/bash -c 'echo test'",
|
|
},
|
|
{
|
|
name: "no run directive",
|
|
line: `ACTION=="add", SUBSYSTEM=="usb"`,
|
|
want: "",
|
|
},
|
|
{
|
|
name: "unquoted directive",
|
|
line: `RUN+=/usr/bin/payload`,
|
|
want: "/usr/bin/payload",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
got := extractRunDirective(tt.line)
|
|
if got != tt.want {
|
|
t.Errorf(
|
|
"extractRunDirective(%q) = %q, want %q",
|
|
tt.line, got, tt.want,
|
|
)
|
|
}
|
|
})
|
|
}
|
|
}
|