Skip harden link and setuid tests on EL5

Makefile

@@ -14,7 +14,7 @@ MODULE_SOURCES := \
 	sysctl.c \
 	hijacks.c
 
-TESTS := tests/mmap-mprotect-test tests/sysctl-restrict_setuid-test
+TESTS := tests/mmap-mprotect-test scripts/setuid-test
 
 KBUILD_DIR=$(shell sh ./scripts/find_kernel_src.sh)
 UNAME=$(shell uname -r)

scripts/setuid-test.c

@@ -0,0 +1,17 @@
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+
+int main(int argc, char *argv[]) {
+
+	int ret = setuid(0);
+
+	if (0 == ret)
+		return 0;
+	else
+		return 1;
+
+}
+

tests/sysctl-harden_hardlinks.sh

@@ -8,6 +8,17 @@ if [ -f /proc/sys/fs/protected_hardlinks ]; then
 	exit -1
 fi
 
+kversion=$(uname -r | cut -d - -f 1)
+kmajor=$(echo $kversion | cut -d . -f 1)
+kminor=$(echo $kversion | cut -d . -f 2)
+krel=$(echo $kversion | cut -d . -f 3)
+
+# no harden support in EL5
+if [ $kmajor -lt 3 ] && [ $krel -lt 19 ]; then
+	echo "hardlink protection not supported in this kernel"
+	exit -1
+fi
+
 # make sure it's off
 sysctl tpe.extras.harden_hardlinks=0
 

tests/sysctl-harden_symlink.sh

@@ -8,6 +8,17 @@ if [ -f /proc/sys/fs/protected_symlinks ]; then
         exit -1
 fi
 
+kversion=$(uname -r | cut -d - -f 1)
+kmajor=$(echo $kversion | cut -d . -f 1)
+kminor=$(echo $kversion | cut -d . -f 2)
+krel=$(echo $kversion | cut -d . -f 3)
+
+# no harden support in EL5
+if [ $kmajor -lt 3 ] && [ $krel -lt 19 ]; then
+        echo "symlink protection not supported in this kernel"
+        exit -1
+fi
+
 # make sure it's off
 sysctl tpe.extras.harden_symlink=0
 

tests/sysctl-restrict_setuid.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+
+uid=$1
+
+kversion=$(uname -r | cut -d - -f 1)
+kmajor=$(echo $kversion | cut -d . -f 1)
+kminor=$(echo $kversion | cut -d . -f 2)
+krel=$(echo $kversion | cut -d . -f 3)
+
+# no harden support in EL5
+if [ $kmajor -lt 3 ] && [ $krel -lt 19 ]; then
+	echo "setuid protection not supported in this kernel"
+	exit -1
+fi
+
+# make sure it's off
+sysctl tpe.extras.restrict_setuid=0
+
+cp $(dirname $0)/../scripts/setuid-test /bin/tpebintest
+chown root:root /bin/tpebintest
+chmod 4755 /bin/tpebintest
+
+# exec should work
+
+sudo -u "#$uid" /bin/tpebintest
+
+if [ $? != 0 ]; then
+	echo "/bin/tpebintest could NOT setuid"
+	ret=1
+fi
+
+# now turn it on
+
+sysctl tpe.extras.restrict_setuid=1
+
+# exec should'nt work now
+
+sudo -u "#$uid" /bin/tpebintest
+
+if [ $? == 0 ]; then
+	echo "/bin/tpebintest could setuid"
+	ret=1
+fi
+
+# now turn it back off
+
+sysctl tpe.extras.restrict_setuid=0
+
+rm -rf /bin/tpebintest
+
+exit $ret
+