Skip to content

generalise vendor-specific glob and fixture paths #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
V33RU merged 1 commit into from
Sep 9, 2026
Merged

generalise vendor-specific glob and fixture paths #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion hardax/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
# VERSION & CONSTANTS
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

__version__ = "6.2.1"
__version__ = "6.2.2"

REQUIRED_CHECK_KEYS = {"category", "label", "command", "safe_pattern", "level", "description"}

Expand Down
4 changes: 2 additions & 2 deletions hardax/commands/bluetooth.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1161,10 +1161,10 @@
"id": "BT-114",
"category": "BLUETOOTH",
"label": "Bluetooth Profile Toggle Helper Not Shell-Executable",
"command": "S=$(ls -l /vendor/bin/bluetooth_sink_role /vendor/bin/*bt_role* /vendor/bin/*bluetooth*role* 2>/dev/null); if [ -z \"$S\" ]; then if ls /vendor/bin >/dev/null 2>&1; then echo \"NO_PROFILE_TOGGLE_HELPER\"; else echo \"UNMEASURED /vendor/bin not listable\"; fi; else printf '%s\\n' \"$S\" | grep -E '^-...(.)?.?x' && echo \"SHELL_EXECUTABLE_TOGGLE_HELPER\" || echo \"TOGGLE_HELPER_RESTRICTED\"; fi",
"command": "S=$(ls -l /vendor/bin/*bt*role* /vendor/bin/*bluetooth*role* /vendor/bin/*bt_profile* 2>/dev/null); if [ -z \"$S\" ]; then if ls /vendor/bin >/dev/null 2>&1; then echo \"NO_PROFILE_TOGGLE_HELPER\"; else echo \"UNMEASURED /vendor/bin not listable\"; fi; else printf '%s\\n' \"$S\" | grep -E '^-...(.)?.?x' && echo \"SHELL_EXECUTABLE_TOGGLE_HELPER\" || echo \"TOGGLE_HELPER_RESTRICTED\"; fi",
"safe_pattern": "^(NO_PROFILE_TOGGLE_HELPER|TOGGLE_HELPER_RESTRICTED)$",
"level": "warning",
"description": "Some vendor images ship a helper script that flips Bluetooth profiles by writing persist.bluetooth.profile.* properties and broadcasting an unbond intent. When that script is group or world executable, any shell on the device can change which Bluetooth profiles the platform exposes and can force-clear existing bonds, without going through settings or any permission check.",
"description": "Some vendor images ship a helper that flips Bluetooth profiles by writing persist.bluetooth.profile.* properties and broadcasting an unbond intent. When that helper is group or world executable, any shell on the device can change which Bluetooth profiles the platform exposes and can force-clear existing bonds, without going through settings or any permission check.",
"remediation": "Restrict the helper to root only (0700, root:root) or remove it from production images and perform profile selection at build time.",
"empty_is_safe": false
},
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"

[project]
name = "hardax"
version = "6.2.1"
version = "6.2.2"
description = "Hardening Audit eXaminer: security configuration auditor for Android-based devices (POS, IoT, automotive, medical, kiosk)"
readme = "README.md"
requires-python = ">=3.10"
Expand Down
16 changes: 8 additions & 8 deletions tests/test_evidence_and_capability.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,12 +289,12 @@ def _run_against(check, table, tmp_path):
CONTAINER_TABLE = (
"/dev/block/dm-15 /system_ext ext4 ro,seclabel 0 0\n"
"/dev/block/dm-17 /vendor ext4 ro,seclabel 0 0\n"
"overlay /data/cb/containers/a/overlay_rootfs overlay "
"rw,lowerdir=/mnt/vendor/cb/containers/a/ro,"
"upperdir=/data/cb/containers/a/overlay_rootfs,"
"workdir=/data/cb/containers/a/work 0 0\n"
"overlay /data/cb/containers/b/overlay_rootfs overlay rw,lowerdir=/x 0 0\n"
"overlay /data/cb/containers/c/overlay_rootfs overlay rw,lowerdir=/x 0 0\n"
"overlay /data/rt/containers/a/overlay_rootfs overlay "
"rw,lowerdir=/mnt/vendor/rt/containers/a/ro,"
"upperdir=/data/rt/containers/a/overlay_rootfs,"
"workdir=/data/rt/containers/a/work 0 0\n"
"overlay /data/rt/containers/b/overlay_rootfs overlay rw,lowerdir=/x 0 0\n"
"overlay /data/rt/containers/c/overlay_rootfs overlay rw,lowerdir=/x 0 0\n"
)

REMOUNT_TABLE = (
Expand All @@ -307,7 +307,7 @@ def _run_against(check, table, tmp_path):

def test_container_overlays_are_not_an_adb_remount(tmp_path):
"""Observed on an Android 13 device running containerised services: three
overlay mounts under /data/<runtime>/containers/*/overlay_rootfs were
overlay mounts under a container runtime's writable layer were
reported CRITICAL as "adb remount active, dm-verity bypassed".

The old command was `mount | grep -c '^overlay'`, which counts overlays
Expand Down Expand Up @@ -366,7 +366,7 @@ def test_inventory_lists_where_each_overlay_sits(tmp_path):
out, safe = _run_against(chk, CONTAINER_TABLE, tmp_path)
assert safe, out
assert out.count("overlay_at ") == 3
assert "/data/cb/containers/a/overlay_rootfs" in out
assert "/data/rt/containers/a/overlay_rootfs" in out
assert "count=3" in out


Expand Down
Loading