From f5bd75fb574b9be80879fda5a889ddfd2b706248 Mon Sep 17 00:00:00 2001

From: Lennart Poettering <lennart@poettering.net>

Date: Thu, 8 Nov 2018 09:32:17 +0100

Subject: [PATCH] analyze: add new security verb

(cherry picked from commit ec16f3b6dd8b03e3ce6eff1fa9f21432208ef42b)

Conflicts:

	src/analyze/analyze.c

Resolves: #1689832

---

 src/analyze/analyze-security.c | 2078 ++++++++++++++++++++++++++++++++

 src/analyze/analyze-security.h |   12 +

 src/analyze/analyze.c          |   16 +

 src/analyze/meson.build        |    2 +

 src/basic/format-table.c       |    1 -

 src/basic/macro.h              |   13 +-

 src/basic/terminal-util.c      |   53 +-

 src/basic/terminal-util.h      |    1 +

 8 files changed, 2150 insertions(+), 26 deletions(-)

 create mode 100644 src/analyze/analyze-security.c

 create mode 100644 src/analyze/analyze-security.h

diff --git a/src/analyze/analyze-security.c b/src/analyze/analyze-security.c

new file mode 100644

index 0000000000..541fc0d97a

--- /dev/null

+++ b/src/analyze/analyze-security.c

@@ -0,0 +1,2078 @@

+/* SPDX-License-Identifier: LGPL-2.1+ */

+

+#include <sched.h>

+#include <sys/utsname.h>

+

+#include "analyze-security.h"

+#include "bus-error.h"

+#include "bus-unit-util.h"

+#include "bus-util.h"

+#include "env-util.h"

+#include "format-table.h"

+#include "in-addr-util.h"

+#include "locale-util.h"

+#include "macro.h"

+#include "parse-util.h"

+#include "path-util.h"

+#include "seccomp-util.h"

+#include "set.h"

+#include "stdio-util.h"

+#include "strv.h"

+#include "terminal-util.h"

+#include "unit-def.h"

+#include "unit-name.h"

+

+struct security_info {

+        char *id;

+        char *type;

+        char *load_state;

+        char *fragment_path;

+        bool default_dependencies;

+

+        uint64_t ambient_capabilities;

+        uint64_t capability_bounding_set;

+

+        char *user;

+        char **supplementary_groups;

+        bool dynamic_user;

+

+        bool ip_address_deny_all;

+        bool ip_address_allow_localhost;

+        bool ip_address_allow_other;

+

+        char *keyring_mode;

+        bool lock_personality;

+        bool memory_deny_write_execute;

+        bool no_new_privileges;

+        char *notify_access;

+

+        bool private_devices;

+        bool private_mounts;

+        bool private_network;

+        bool private_tmp;

+        bool private_users;

+

+        bool protect_control_groups;

+        bool protect_kernel_modules;

+        bool protect_kernel_tunables;

+

+        char *protect_home;

+        char *protect_system;

+

+        bool remove_ipc;

+

+        bool restrict_address_family_inet;

+        bool restrict_address_family_unix;

+        bool restrict_address_family_netlink;

+        bool restrict_address_family_packet;

+        bool restrict_address_family_other;

+

+        uint64_t restrict_namespaces;

+        bool restrict_realtime;

+

+        char *root_directory;

+        char *root_image;

+

+        bool delegate;

+        char *device_policy;

+        bool device_allow_non_empty;

+

+        char **system_call_architectures;

+

+        bool system_call_filter_whitelist;

+        Set *system_call_filter;

+

+        uint32_t _umask;

+};

+

+struct security_assessor {

+        const char *id;

+        const char *description_good;

+        const char *description_bad;

+        const char *description_na;

+        const char *url;

+        uint64_t weight;

+        uint64_t range;

+        int (*assess)(const struct security_assessor *a, const struct security_info *info, const void *data, uint64_t *ret_badness, char **ret_description);

+        size_t offset;

+        uint64_t parameter;

+        bool default_dependencies_only;

+};

+

+static void security_info_free(struct security_info *i) {

+        if (!i)

+                return;

+

+        free(i->id);

+        free(i->type);

+        free(i->load_state);

+        free(i->fragment_path);

+

+        free(i->user);

+

+        free(i->protect_home);

+        free(i->protect_system);

+

+        free(i->root_directory);

+        free(i->root_image);

+

+        free(i->keyring_mode);

+        free(i->notify_access);

+

+        free(i->device_policy);

+

+        strv_free(i->supplementary_groups);

+        strv_free(i->system_call_architectures);

+

+        set_free_free(i->system_call_filter);

+}

+

+static bool security_info_runs_privileged(const struct security_info *i)  {

+        assert(i);

+

+        if (STRPTR_IN_SET(i->user, "0", "root"))

+                return true;

+

+        if (i->dynamic_user)

+                return false;

+

+        return isempty(i->user);

+}

+

+static int assess_bool(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        const bool *b = data;

+

+        assert(b);

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = a->parameter ? *b : !*b;

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_user(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        _cleanup_free_ char *d = NULL;

+        uint64_t b;

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (streq_ptr(info->user, NOBODY_USER_NAME)) {

+                d = strdup("Service runs under as '" NOBODY_USER_NAME "' user, which should not be used for services");

+                b = 9;

+        } else if (info->dynamic_user && !STR_IN_SET(info->user, "0", "root")) {

+                d = strdup("Service runs under a transient non-root user identity");

+                b = 0;

+        } else if (info->user && !STR_IN_SET(info->user, "0", "root", "")) {

+                d = strdup("Service runs under a static non-root user identity");

+                b = 0;

+        } else {

+                *ret_badness = 10;

+                *ret_description = NULL;

+                return 0;

+        }

+

+        if (!d)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = TAKE_PTR(d);

+

+        return 0;

+}

+

+static int assess_protect_home(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        const char *description;

+        uint64_t badness;

+        char *copy;

+        int r;

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        badness = 10;

+        description = "Service has full access to home directories";

+

+        r = parse_boolean(info->protect_home);

+        if (r < 0) {

+                if (streq_ptr(info->protect_home, "read-only")) {

+                        badness = 5;

+                        description = "Service has read-only access to home directories";

+                } else if (streq_ptr(info->protect_home, "tmpfs")) {

+                        badness = 1;

+                        description = "Service has access to fake empty home directories";

+                }

+        } else if (r > 0) {

+                badness = 0;

+                description = "Service has no access to home directories";

+        }

+

+        copy = strdup(description);

+        if (!copy)

+                return log_oom();

+

+        *ret_badness = badness;

+        *ret_description = copy;

+

+        return 0;

+}

+

+static int assess_protect_system(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        const char *description;

+        uint64_t badness;

+        char *copy;

+        int r;

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        badness = 10;

+        description = "Service has full access the OS file hierarchy";

+

+        r = parse_boolean(info->protect_system);

+        if (r < 0) {

+                if (streq_ptr(info->protect_system, "full")) {

+                        badness = 3;

+                        description = "Service has very limited write access to OS file hierarchy";

+                } else if (streq_ptr(info->protect_system, "strict")) {

+                        badness = 0;

+                        description = "Service has strict read-only access to the OS file hierarchy";

+                }

+        } else if (r > 0) {

+                badness = 5;

+                description = "Service has limited write access to the OS file hierarchy";

+        }

+

+        copy = strdup(description);

+        if (!copy)

+                return log_oom();

+

+        *ret_badness = badness;

+        *ret_description = copy;

+

+        return 0;

+}

+

+static int assess_root_directory(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness =

+                (isempty(info->root_directory) ||

+                 path_equal(info->root_directory, "/")) &&

+                (isempty(info->root_image) ||

+                 path_equal(info->root_image, "/"));

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_capability_bounding_set(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = !!(info->capability_bounding_set & a->parameter);

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_umask(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        char *copy = NULL;

+        const char *d;

+        uint64_t b;

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (!FLAGS_SET(info->_umask, 0002)) {

+                d = "Files created by service are world-writable by default";

+                b = 10;

+        } else if (!FLAGS_SET(info->_umask, 0004)) {

+                d = "Files created by service are world-readable by default";

+                b = 5;

+        } else if (!FLAGS_SET(info->_umask, 0020)) {

+                d = "Files created by service are group-writable by default";

+                b = 2;

+        } else if (!FLAGS_SET(info->_umask, 0040)) {

+                d = "Files created by service are group-readable by default";

+                b = 1;

+        } else {

+                d = "Files created by service are accessible only by service's own user by default";

+                b = 0;

+        }

+

+        copy = strdup(d);

+        if (!copy)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = copy;

+

+        return 0;

+}

+

+static int assess_keyring_mode(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = !streq_ptr(info->keyring_mode, "private");

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_notify_access(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = streq_ptr(info->notify_access, "all");

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_remove_ipc(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (security_info_runs_privileged(info))

+                *ret_badness = UINT64_MAX;

+        else

+                *ret_badness = !info->remove_ipc;

+

+        *ret_description = NULL;

+        return 0;

+}

+

+static int assess_supplementary_groups(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (security_info_runs_privileged(info))

+                *ret_badness = UINT64_MAX;

+        else

+                *ret_badness = !strv_isempty(info->supplementary_groups);

+

+        *ret_description = NULL;

+        return 0;

+}

+

+static int assess_restrict_namespaces(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = !!(info->restrict_namespaces & a->parameter);

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static int assess_system_call_architectures(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        char *d;

+        uint64_t b;

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (strv_isempty(info->system_call_architectures)) {

+                b = 10;

+                d = strdup("Service may execute system calls with all ABIs");

+        } else if (strv_equal(info->system_call_architectures, STRV_MAKE("native"))) {

+                b = 0;

+                d = strdup("Service may execute system calls only with native ABI");

+        } else {

+                b = 8;

+                d = strdup("Service may execute system calls with multiple ABIs");

+        }

+

+        if (!d)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = d;

+

+        return 0;

+}

+

+static bool syscall_names_in_filter(Set *s, bool whitelist, const SyscallFilterSet *f) {

+        const char *syscall;

+

+        NULSTR_FOREACH(syscall, f->value) {

+                bool b;

+

+                if (syscall[0] == '@') {

+                        const SyscallFilterSet *g;

+                        assert_se(g = syscall_filter_set_find(syscall));

+                        b = syscall_names_in_filter(s, whitelist, g);

+                } else {

+#if HAVE_SECCOMP

+                        int id;

+

+                        /* Let's see if the system call actually exists on this platform, before complaining */

+                        id = seccomp_syscall_resolve_name(syscall);

+                        if (id < 0)

+                                continue;

+#endif

+

+                        b = set_contains(s, syscall);

+                }

+

+                if (whitelist == b) {

+                        log_debug("Offending syscall filter item: %s", syscall);

+                        return true; /* bad! */

+                }

+        }

+

+        return false;

+}

+

+static int assess_system_call_filter(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        const SyscallFilterSet *f;

+        char *d = NULL;

+        uint64_t b;

+

+        assert(a);

+        assert(info);

+        assert(ret_badness);

+        assert(ret_description);

+

+        assert(a->parameter < _SYSCALL_FILTER_SET_MAX);

+        f = syscall_filter_sets + a->parameter;

+

+        if (!info->system_call_filter_whitelist && set_isempty(info->system_call_filter)) {

+                d = strdup("Service does not filter system calls");

+                b = 10;

+        } else {

+                bool bad;

+

+                log_debug("Analyzing system call filter, checking against: %s", f->name);

+                bad = syscall_names_in_filter(info->system_call_filter, info->system_call_filter_whitelist, f);

+                log_debug("Result: %s", bad ? "bad" : "good");

+

+                if (info->system_call_filter_whitelist) {

+                        if (bad) {

+                                (void) asprintf(&d, "System call whitelist defined for service, and %s is included", f->name);

+                                b = 9;

+                        } else {

+                                (void) asprintf(&d, "System call whitelist defined for service, and %s is not included", f->name);

+                                b = 0;

+                        }

+                } else {

+                        if (bad) {

+                                (void) asprintf(&d, "System call blacklist defined for service, and %s is not included", f->name);

+                                b = 10;

+                        } else {

+                                (void) asprintf(&d, "System call blacklist defined for service, and %s is included", f->name);

+                                b = 5;

+                        }

+                }

+        }

+

+        if (!d)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = d;

+

+        return 0;

+}

+

+static int assess_ip_address_allow(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        char *d = NULL;

+        uint64_t b;

+

+        assert(info);

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (!info->ip_address_deny_all) {

+                d = strdup("Service does not define an IP address whitelist");

+                b = 10;

+        } else if (info->ip_address_allow_other) {

+                d = strdup("Service defines IP address whitelist with non-localhost entries");

+                b = 5;

+        } else if (info->ip_address_allow_localhost) {

+                d = strdup("Service defines IP address whitelits with only localhost entries");

+                b = 2;

+        } else {

+                d = strdup("Service blocks all IP address ranges");

+                b = 0;

+        }

+

+        if (!d)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = d;

+

+        return 0;

+}

+

+static int assess_device_allow(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        char *d = NULL;

+        uint64_t b;

+

+        assert(info);

+        assert(ret_badness);

+        assert(ret_description);

+

+        if (STRPTR_IN_SET(info->device_policy, "strict", "closed")) {

+

+                if (info->device_allow_non_empty) {

+                        d = strdup("Service has a device ACL with some special devices");

+                        b = 5;

+                } else {

+                        d = strdup("Service has a minimal device ACL");

+                        b = 0;

+                }

+        } else {

+                d = strdup("Service has no device ACL");

+                b = 10;

+        }

+

+        if (!d)

+                return log_oom();

+

+        *ret_badness = b;

+        *ret_description = d;

+

+        return 0;

+}

+

+static int assess_ambient_capabilities(

+                const struct security_assessor *a,

+                const struct security_info *info,

+                const void *data,

+                uint64_t *ret_badness,

+                char **ret_description) {

+

+        assert(ret_badness);

+        assert(ret_description);

+

+        *ret_badness = info->ambient_capabilities != 0;

+        *ret_description = NULL;

+

+        return 0;

+}

+

+static const struct security_assessor security_assessor_table[] = {

+        {

+                .id = "User=/DynamicUser=",

+                .description_bad = "Service runs as root user",

+                .url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#User=",

+                .weight = 2000,

+                .range = 10,

+                .assess = assess_user,

+        },

+        {

+                .id = "SupplementaryGroups=",

+                .description_good = "Service has no supplementary groups",

+                .description_bad = "Service runs with supplementary groups",

+                .description_na = "Service runs as root, option does not matter",

+                .url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#SupplementaryGroups=",

+                .weight = 200,

+                .range = 1,

+                .assess = assess_supplementary_groups,

+        },

+        {

+                .id = "PrivateDevices=",

+                .description_good = "Service has no access to hardware devices",

+                .description_bad = "Service potentially has access to hardware devices",

+                .url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateDevices=",

+                .weight = 1000,

+                .range = 1,

+                .assess = assess_bool,

+                .offset = offsetof(struct security_info, private_devices),

+        },

+        {

+                .id = "PrivateMounts=",

+                .description_good = "Service cannot install system mounts",