Skip to content

Commit 3d77a3a

Browse files
chris-rockchris-rock
committed
Fixes dev-sec#86 by deferring the execution of permissions to profile execution instead of profile initialisation
Signed-off-by: Christoph Hartmann <[email protected]>
1 parent 83d031e commit 3d77a3a

File tree

3 files changed

+86
-46
lines changed

3 files changed

+86
-46
lines changed

‎controls/os_spec.rb‎

Lines changed: 6 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -20,55 +20,17 @@
2020
log_dir_group = 'root'
2121
log_dir_group = 'syslog' if os.name == 'ubuntu' && os[:release].to_i >= 14
2222
login_defs_umask = attribute('login_defs_umask', default: os.redhat? ? '077' : '027', description: 'Default umask to set in login.defs')
23+
2324
login_defs_passmaxdays = attribute('login_defs_passmaxdays', default: '60', description: 'Default password maxdays to set in login.defs')
2425
login_defs_passmindays = attribute('login_defs_passmindays', default: '7', description: 'Default password mindays to set in login.defs')
2526
login_defs_passwarnage = attribute('login_defs_passwarnage', default: '7', description: 'Default password warnage (days) to set in login.defs')
27+
2628
shadow_group = 'root'
2729
shadow_group = 'shadow' if os.debian? || os.suse?
30+
2831
blacklist = attribute(
2932
'blacklist',
30-
default: [
31-
# blacklist as provided by NSA
32-
'/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
33-
# sshd must not use host-based authentication (see ssh cookbook)
34-
'/usr/libexec/openssh/ssh-keysign',
35-
'/usr/lib/openssh/ssh-keysign',
36-
# misc others
37-
'/sbin/netreport', # not normally required for user
38-
'/usr/sbin/usernetctl', # modify interfaces via functional accounts
39-
# connecting to ...
40-
'/usr/sbin/userisdnctl', # no isdn...
41-
'/usr/sbin/pppd', # no ppp / dsl ...
42-
# lockfile
43-
'/usr/bin/lockfile',
44-
'/usr/bin/mail-lock',
45-
'/usr/bin/mail-unlock',
46-
'/usr/bin/mail-touchlock',
47-
'/usr/bin/dotlockfile',
48-
# need more investigation, blacklist for now
49-
'/usr/bin/arping',
50-
'/usr/sbin/arping',
51-
'/usr/sbin/uuidd',
52-
'/usr/bin/mtr', # investigate current state...
53-
'/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state...
54-
'/usr/lib/pt_chown', # pseudo-tty, needed?
55-
'/usr/lib/eject/dmcrypt-get-device',
56-
'/usr/lib/mc/cons.saver' # midnight commander screensaver
57-
# from Ubuntu xenial, need to investigate
58-
# '/sbin/unix_chkpwd',
59-
# '/sbin/pam_extrausers_chkpwd',
60-
# '/usr/lib/x86_64-linux-gnu/utempter/utempter',
61-
# '/usr/sbin/postdrop',
62-
# '/usr/sbin/postqueue',
63-
# '/usr/bin/ssh-agent',
64-
# '/usr/bin/mlocate',
65-
# '/usr/bin/crontab',
66-
# '/usr/bin/screen',
67-
# '/usr/bin/expiry',
68-
# '/usr/bin/wall',
69-
# '/usr/bin/chage',
70-
# '/usr/bin/bsd-write'
71-
],
33+
default: suid_blacklist.default,
7234
description: 'blacklist of suid/sgid program on system'
7335
)
7436

@@ -193,10 +155,8 @@
193155
title 'Check for SUID/ SGID blacklist'
194156
desc 'Find blacklisted SUID and SGID files to ensure that no rogue SUID and SGID files have been introduced into the system'
195157

196-
output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' ! -path \'/var/lib/lxd/containers/*\' -print 2>/dev/null | grep -v \'^find:\'')
197-
diff = output.stdout.split(/\r?\n/) & blacklist
198-
describe diff do
199-
it { should be_empty }
158+
describe suid_check(blacklist) do
159+
its('diff') { should be_empty }
200160
end
201161
end
202162

‎libraries/suid_blacklist.rb‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# encoding: utf-8
2+
3+
# author: Christoph Hartmann
4+
5+
class SUIDBlacklist < Inspec.resource(1)
6+
name 'suid_blacklist'
7+
desc 'The suid_blacklist resoruce returns the default suid blacklist'
8+
9+
def default
10+
[
11+
# blacklist as provided by NSA
12+
'/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
13+
# sshd must not use host-based authentication (see ssh cookbook)
14+
'/usr/libexec/openssh/ssh-keysign',
15+
'/usr/lib/openssh/ssh-keysign',
16+
# misc others
17+
'/sbin/netreport', # not normally required for user
18+
'/usr/sbin/usernetctl', # modify interfaces via functional accounts
19+
# connecting to ...
20+
'/usr/sbin/userisdnctl', # no isdn...
21+
'/usr/sbin/pppd', # no ppp / dsl ...
22+
# lockfile
23+
'/usr/bin/lockfile',
24+
'/usr/bin/mail-lock',
25+
'/usr/bin/mail-unlock',
26+
'/usr/bin/mail-touchlock',
27+
'/usr/bin/dotlockfile',
28+
# need more investigation, blacklist for now
29+
'/usr/bin/arping',
30+
'/usr/sbin/arping',
31+
'/usr/sbin/uuidd',
32+
'/usr/bin/mtr', # investigate current state...
33+
'/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state...
34+
'/usr/lib/pt_chown', # pseudo-tty, needed?
35+
'/usr/lib/eject/dmcrypt-get-device',
36+
'/usr/lib/mc/cons.saver' # midnight commander screensaver
37+
# from Ubuntu xenial, need to investigate
38+
# '/sbin/unix_chkpwd',
39+
# '/sbin/pam_extrausers_chkpwd',
40+
# '/usr/lib/x86_64-linux-gnu/utempter/utempter',
41+
# '/usr/sbin/postdrop',
42+
# '/usr/sbin/postqueue',
43+
# '/usr/bin/ssh-agent',
44+
# '/usr/bin/mlocate',
45+
# '/usr/bin/crontab',
46+
# '/usr/bin/screen',
47+
# '/usr/bin/expiry',
48+
# '/usr/bin/wall',
49+
# '/usr/bin/chage',
50+
# '/usr/bin/bsd-write'
51+
]
52+
end
53+
end

‎libraries/suid_check.rb‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# encoding: utf-8
2+
3+
# author: Christoph Hartmann
4+
5+
class SUIDCheck < Inspec.resource(1)
6+
name 'suid_check'
7+
desc 'Use the suid_check resource to verify the current SUID/SGID against a blacklist'
8+
example "
9+
describe suid_check(blacklist) do
10+
its('diff') { should be_empty }
11+
end
12+
"
13+
14+
def initialize(blacklist = nil)
15+
blacklist = default if blacklist.nil?
16+
@blacklist = blacklist
17+
end
18+
19+
def permissions
20+
output = inspec.command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' ! -path \'/var/lib/lxd/containers/*\' -print 2>/dev/null | grep -v \'^find:\'')
21+
output.stdout.split(/\r?\n/)
22+
end
23+
24+
def diff
25+
permissions & @blacklist
26+
end
27+
end

0 commit comments

Comments
 (0)