Modify path_check script.

- Read PATH variable in the target script, and compare with predefined
RO directories.
- No need to define all predefiend dirs, only partials are also allowed.

Change-Id: I0905676c2c3d04c75b5333eceadf6fd439fc25ea

diff --git a/test/path_check_test/path_check.sh b/test/path_check_test/path_check.sh
index 9796627036526c4dbcaeee7d0de01d8a73a82d04..1370e4c1b30cd09e397c226df96be92f979c9fc2 100644 (file)
--- a/test/path_check_test/path_check.sh
+++ b/test/path_check_test/path_check.sh
@@ -6,12 +6,14 @@ result_file="/opt/share/security-config/result/path_check.result"
 log_file="/opt/share/security-config/log/path_check.log"
 exception_file="/usr/share/security-config/test/path_check_test/path_exception.list"
 script_list_path="/opt/share/security-config/log/script_file_list"
+path_list=("bin" "sbin" "usr" "etc")
+tmp_path="/tmp/pathtest.sh"
 
 # Check whether this file is one of exception lists.
 # args : $1 = file path
 function CHECK_EXCEPTION
 {
-       temp=$(grep $1 <<< cat $exception_file)
+       temp=$(/usr/bin/grep $1 <<< /usr/bin/cat $exception_file)
        if [ -n "$temp" ]
        then
                return 1
@@ -23,16 +25,24 @@ function CHECK_EXCEPTION
 # args : $1 = file path
 function PATH_CHECK
 {
-       filtered_line=$(grep "PATH=" $1 | grep "[^a-z A-Z]/bin" | grep "[^a-z A-Z]/sbin" | grep "/usr/bin" | grep "/usr/sbin")
-       if [ "$filtered_line" == "" ]
-       then
-               CHECK_EXCEPTION $1 # exception check
-               if [ "$?" == 0 ]
+       /usr/bin/cat $1 | /usr/bin/grep "PATH=" > $tmp_path
+       PATH="/opt:/unexist" # set unallowed directories in PATH variable. This should be reset in the target script.
+       source $tmp_path
+       IFS=':' read -ra path_array <<< "$PATH"
+       PATH="/usr/bin:/bin:/usr/sbin:/sbin"
+       for item in "${path_array[@]}"; do
+               root_dir_item="$(/usr/bin/echo $item | /usr/bin/cut -d '/' -f2)"
+               if [ "$(/usr/bin/echo "${path_list[@]}" | /usr/bin/fgrep --word-regexp "$root_dir_item")" == "" ]
                then
-                       rpm_path=$(/usr/bin/rpm -qf $1)
-                       echo "$1,""$rpm_path" >> $log_file                                      
+                       CHECK_EXCEPTION $1 # exception check
+                       if [ "$?" == 0 ]
+                       then
+                               rpm_path=$(/usr/bin/rpm -qf $1)
+                               echo "$1,""$rpm_path" >> $log_file
+                       fi
+                       return
                fi
-       fi
+       done
 }
 
 # Main Check function : find shell scripts in the system.
@@ -41,7 +51,7 @@ function CHECK
        find / -type f -executable 2>/dev/null | xargs $utl_path/file | grep "shell script" | cut -d ":" -f1 >> $script_list_path
        while read script_file_line
        do
-               PATH_CHECK $script_file_line            
+               PATH_CHECK $script_file_line
        done < $script_list_path
 }
 
@@ -74,4 +84,5 @@ then
        rm $script_list_path
 fi
 
+rm $tmp_path
 /bin/echo "PATH CHECK FINISHED!"