Skip to content

Commit ecfd082

Browse files
maanyagoenkamaanyagoenka
committed
systemd-analyze: add new 'security' option to allow user to choose custom requirements
A new option --security-policy= is added to work with the 'security' verb in order to enable users to create and pass in a JSON file consisting of user defined requirements against which to compare the specified unit file(s). These requirements then serve as the measure of security threats for the file instead of the initial hard coded set of requirements that the 'security' verb of systemd-analyze relied on. Example Run: A snapshot of the user defined testfile.json file is shown below instead of the complete file for readability purposes. { "PrivateDevices": {"description_good": "Service has no access to hardware devices", "description_bad": "Service potentially has access to hardware devices", "weight": 1000, "range": 1 }, "PrivateMounts": {"description_good": "Service cannot install system mounts", "description_bad": "Service may install system mounts", "weight": 1000, "range": 1 }, "PrivateNetwork": {"description_good": "Service has no access to the host's network", "description_bad": "Service has access to the host's network", "weight": 2500, "range": 1 }, "PrivateTmp": {"description_good": "Service has no access to other software's temporary files", "description_bad": "Service has access to other software's temporary files", "weight": 1000, "range": 1 }, "PrivateUsers": {"description_good": "Service does not have access to other users", "description_bad": "Service has access to other users", "weight": 1000, "range": 1 } } 1. I created the jsontest.service file in order to test the --security-policy= option as follows: maanya-goenka@debian:~/systemd (custom-security)$ cat<<EOF>jsontest.service > [Service] > ExecStart = echo hello > PrivateNetwork = yes > PrivateDevices = yes > PrivateMounts = yes > EOF The security analysis table outputted below has been truncated to include only the first few lines for readability. maanya-goenka@debian:~/systemd (custom-security)$ sudo build/systemd-analyze security --root= --offline=true --security-policy=src/analyze/testfile.json jsontest.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. NAME DESCRIPTION ✓ PrivateNetwork Service has no access to the host's network ✗ UserOrDynamicUser Service runs as root user ✗ CapabilityBoundingSet_CAP_SET_UID_GID_PCAP Service may change UID/GID identities/capabilities ✓ PrivateMounts Service cannot install system mounts ✓ PrivateDevices Service has no access to hardware devices → Overall exposure level for jsontest.service: 8.3 EXPOSED 🙁 maanya-goenka@debian:~/systemd (custom-security)$ echo $? 0 2. In order to ensure that the JSON data was actually being correctly parsed, I made some changes to the JSON file, specifically to the id "PrivateNetwork" as follows: Before: -------- "PrivateNetwork": {"description_good": "Service has no access to the host's network", "description_bad": "Service has access to the host's network", "weight": 2500, "range": 1 } After: -------- "PrivateNetwork": {"description_good": "Service runs without access to host network", "description_bad": "Service has access to the host's network", "weight": 6000, "range": 1 } As expected, the new description for the description_good field of the Private Network id was updated in the analysis table outputted below and the overall exposure level of the unit file decreased because the weight assigned to 'Private Network' (which is set to yes) increased from 2500 to 6000. maanya-goenka@debian:~/systemd (custom-security)$ sudo build/systemd-analyze security --root= --offline=true --security-policy=src/analyze/testfile.json jsontest.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. NAME DESCRIPTION ✓ PrivateNetwork Service runs without access to the host's network ✗ UserOrDynamicUser Service runs as root user ✗ CapabilityBoundingSet_CAP_SET_UID_GID_PCAP Service may change UID/GID identities/capabilities ✓ PrivateMounts Service cannot install system mounts ✓ PrivateDevices Service has no access to hardware devices → Overall exposure level for jsontest.service: 7.8 EXPOSED 🙁 maanya-goenka@debian:~/systemd (custom-security)$ echo $? 0 3. When paired with security's --threshold= option, systemd-analyze exits with a non-zero error status indicating that the overall exposure level for the unit file (=78) is greater than the set threshold (=70). The same jsontest.service file is used for the demo run below: maanya-goenka@debian:~/systemd (custom-security)$ sudo build/systemd-analyze security --root= --offline=true --security-policy=src/analyze/testfile.json --threshold=70 jsontest.service /usr/lib/systemd/system/plymouth-start.service:15: Unit configured to use KillMode=none. This is unsafe, as it disables systemd's process lifecycle management for the service. Please update your service to use a safer KillMode=, such as 'mixed' or 'control-group'. Support for KillMode=none is deprecated and will eventually be removed. /usr/lib/systemd/system/gdm.service:30: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether. /usr/lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly. NAME DESCRIPTION ✓ PrivateNetwork Service runs without access to host network ✗ UserOrDynamicUser Service runs as root user ✗ CapabilityBoundingSet_CAP_SET_UID_GID_PCAP Service may change UID/GID identities/capabilities ✓ PrivateMounts Service cannot install system mounts ✓ PrivateDevices Service has no access to hardware devices → Overall exposure level for jsontest.service: 7.8 EXPOSED 🙁 maanya-goenka@debian:~/systemd (custom-security)$ echo $? 1 new option
1 parent 37b3e13 commit ecfd082

File tree

6 files changed

+387
-6
lines changed

6 files changed

+387
-6
lines changed

‎man/systemd-analyze.xml‎

Lines changed: 317 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -792,6 +792,323 @@ Service b@0.service not loaded, b.socket cannot be started.
792792
as well and its default value is 100.</para></listitem>
793793
</varlistentry>
794794

795+
<varlistentry>
796+
<term><option>--security-policy=<replaceable>PATH</replaceable></option></term>
797+
798+
<listitem><para>With <command>security</command>, allow the user to define a custom set of
799+
requirements formatted as a JSON file against which to compare the specified unit file(s)
800+
and determine their overall exposure level to security threats.</para>
801+
802+
<table>
803+
<title>Accepted Assessment Test Identifiers</title>
804+
805+
<tgroup cols='1'>
806+
<colspec colname='directive' />
807+
<thead>
808+
<row>
809+
<entry>Assessment Test Identifier</entry>
810+
</row>
811+
</thead>
812+
<tbody>
813+
<row>
814+
<entry>UserOrDynamicUser</entry>
815+
</row>
816+
<row>
817+
<entry>SupplementaryGroups</entry>
818+
</row>
819+
<row>
820+
<entry>PrivateMounts</entry>
821+
</row>
822+
<row>
823+
<entry>PrivateDevices</entry>
824+
</row>
825+
<row>
826+
<entry>PrivateTmp</entry>
827+
</row>
828+
<row>
829+
<entry>PrivateNetwork</entry>
830+
</row>
831+
<row>
832+
<entry>PrivateUsers</entry>
833+
</row>
834+
<row>
835+
<entry>ProtectControlGroups</entry>
836+
</row>
837+
<row>
838+
<entry>ProtectKernelModules</entry>
839+
</row>
840+
<row>
841+
<entry>ProtectKernelTunables</entry>
842+
</row>
843+
<row>
844+
<entry>ProtectKernelLogs</entry>
845+
</row>
846+
<row>
847+
<entry>ProtectClock</entry>
848+
</row>
849+
<row>
850+
<entry>ProtectHome</entry>
851+
</row>
852+
<row>
853+
<entry>ProtectHostname</entry>
854+
</row>
855+
<row>
856+
<entry>ProtectSystem</entry>
857+
</row>
858+
<row>
859+
<entry>RootDirectoryOrRootImage</entry>
860+
</row>
861+
<row>
862+
<entry>LockPersonality</entry>
863+
</row>
864+
<row>
865+
<entry>MemoryDenyWriteExecute</entry>
866+
</row>
867+
<row>
868+
<entry>NoNewPrivileges</entry>
869+
</row>
870+
<row>
871+
<entry>CapabilityBoundingSet_CAP_SYS_ADMIN</entry>
872+
</row>
873+
<row>
874+
<entry>CapabilityBoundingSet_CAP_SET_UID_GID_PCAP</entry>
875+
</row>
876+
<row>
877+
<entry>CapabilityBoundingSet_CAP_SYS_PTRACE</entry>
878+
</row>
879+
<row>
880+
<entry>CapabilityBoundingSet_CAP_SYS_TIME</entry>
881+
</row>
882+
<row>
883+
<entry>CapabilityBoundingSet_CAP_NET_ADMIN</entry>
884+
</row>
885+
<row>
886+
<entry>CapabilityBoundingSet_CAP_SYS_RAWIO</entry>
887+
</row>
888+
<row>
889+
<entry>CapabilityBoundingSet_CAP_SYS_MODULE</entry>
890+
</row>
891+
<row>
892+
<entry>CapabilityBoundingSet_CAP_AUDIT</entry>
893+
</row>
894+
<row>
895+
<entry>CapabilityBoundingSet_CAP_SYSLOG</entry>
896+
</row>
897+
<row>
898+
<entry>CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE</entry>
899+
</row>
900+
<row>
901+
<entry>CapabilityBoundingSet_CAP_MKNOD</entry>
902+
</row>
903+
<row>
904+
<entry>CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP</entry>
905+
</row>
906+
<row>
907+
<entry>CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER</entry>
908+
</row>
909+
<row>
910+
<entry>CapabilityBoundingSet_CAP_KILL</entry>
911+
</row>
912+
<row>
913+
<entry>CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW</entry>
914+
</row>
915+
<row>
916+
<entry>CapabilityBoundingSet_CAP_SYS_BOOT</entry>
917+
</row>
918+
<row>
919+
<entry>CapabilityBoundingSet_CAP_MAC</entry>
920+
</row>
921+
<row>
922+
<entry>CapabilityBoundingSet_CAP_LINUX_IMMUTABLE</entry>
923+
</row>
924+
<row>
925+
<entry>CapabilityBoundingSet_CAP_IPC_LOCK</entry>
926+
</row>
927+
<row>
928+
<entry>CapabilityBoundingSet_CAP_SYS_CHROOT</entry>
929+
</row>
930+
<row>
931+
<entry>CapabilityBoundingSet_CAP_BLOCK_SUSPEND</entry>
932+
</row>
933+
<row>
934+
<entry>CapabilityBoundingSet_CAP_WAKE_ALARM</entry>
935+
</row>
936+
<row>
937+
<entry>CapabilityBoundingSet_CAP_LEASE</entry>
938+
</row>
939+
<row>
940+
<entry>CapabilityBoundingSet_CAP_SYS_TTY_CONFIG</entry>
941+
</row>
942+
<row>
943+
<entry>UMask</entry>
944+
</row>
945+
<row>
946+
<entry>KeyringMode</entry>
947+
</row>
948+
<row>
949+
<entry>ProtectProc</entry>
950+
</row>
951+
<row>
952+
<entry>ProcSubset</entry>
953+
</row>
954+
<row>
955+
<entry>NotifyAccess</entry>
956+
</row>
957+
<row>
958+
<entry>RemoveIPC</entry>
959+
</row>
960+
<row>
961+
<entry>Delegate</entry>
962+
</row>
963+
<row>
964+
<entry>RestrictRealtime</entry>
965+
</row>
966+
<row>
967+
<entry>RestrictSUIDSGID</entry>
968+
</row>
969+
<row>
970+
<entry>RestrictNamespaces_CLONE_NEWUSER</entry>
971+
</row>
972+
<row>
973+
<entry>RestrictNamespaces_CLONE_NEWNS</entry>
974+
</row>
975+
<row>
976+
<entry>RestrictNamespaces_CLONE_NEWIPC</entry>
977+
</row>
978+
<row>
979+
<entry>RestrictNamespaces_CLONE_NEWPID</entry>
980+
</row>
981+
<row>
982+
<entry>RestrictNamespaces_CLONE_NEWCGROUP</entry>
983+
</row>
984+
<row>
985+
<entry>RestrictNamespaces_CLONE_NEWUTS</entry>
986+
</row>
987+
<row>
988+
<entry>RestrictNamespaces_CLONE_NEWNET</entry>
989+
</row>
990+
<row>
991+
<entry>RestrictAddressFamilies_AF_INET_INET6</entry>
992+
</row>
993+
<row>
994+
<entry>RestrictAddressFamilies_AF_UNIX</entry>
995+
</row>
996+
<row>
997+
<entry>RestrictAddressFamilies_AF_NETLINK</entry>
998+
</row>
999+
<row>
1000+
<entry>RestrictAddressFamilies_AF_PACKET</entry>
1001+
</row>
1002+
<row>
1003+
<entry>RestrictAddressFamilies_OTHER</entry>
1004+
</row>
1005+
<row>
1006+
<entry>SystemCallArchitectures</entry>
1007+
</row>
1008+
<row>
1009+
<entry>SystemCallFilter_swap</entry>
1010+
</row>
1011+
<row>
1012+
<entry>SystemCallFilter_obsolete</entry>
1013+
</row>
1014+
<row>
1015+
<entry>SystemCallFilter_clock</entry>
1016+
</row>
1017+
<row>
1018+
<entry>SystemCallFilter_cpu_emulation</entry>
1019+
</row>
1020+
<row>
1021+
<entry>SystemCallFilter_debug</entry>
1022+
</row>
1023+
<row>
1024+
<entry>SystemCallFilter_mount</entry>
1025+
</row>
1026+
<row>
1027+
<entry>SystemCallFilter_module</entry>
1028+
</row>
1029+
<row>
1030+
<entry>SystemCallFilter_raw_io</entry>
1031+
</row>
1032+
<row>
1033+
<entry>SystemCallFilter_reboot</entry>
1034+
</row>
1035+
<row>
1036+
<entry>SystemCallFilter_privileged</entry>
1037+
</row>
1038+
<row>
1039+
<entry>SystemCallFilter_resources</entry>
1040+
</row>
1041+
<row>
1042+
<entry>IPAddressDeny</entry>
1043+
</row>
1044+
<row>
1045+
<entry>DeviceAllow</entry>
1046+
</row>
1047+
<row>
1048+
<entry>AmbientCapabilities</entry>
1049+
</row>
1050+
</tbody>
1051+
</tgroup>
1052+
</table>
1053+
1054+
<example>
1055+
<title>JSON Policy</title>
1056+
<para>The JSON file passed as a path parameter to <option>--security-policy=</option>
1057+
has a top-level JSON object, with keys being the assessment test identifiers mentioned
1058+
above. The values in the file should be JSON objects with one or more of the
1059+
following fields: description_na (string), description_good (string), description_bad
1060+
(string), weight (unsigned integer), and range (unsigned integer). If any of these fields
1061+
corresponding to a specific id of the unit file is missing from the JSON object, the
1062+
default built-in field value corresponding to that same id is used for security analysis
1063+
as default. The weight and range fields are used in determining the overall exposure level
1064+
of the unit files so by allowing users to manipulate these fields, 'security' gives them
1065+
the option to decide for themself which ids are more important and hence, should have a greater
1066+
effect on the exposure level. </para>
1067+
1068+
<programlisting>
1069+
{
1070+
"PrivateDevices":
1071+
{
1072+
"description_good": "Service has no access to hardware devices",
1073+
"description_bad": "Service potentially has access to hardware devices",
1074+
"weight": 1000,
1075+
"range": 1
1076+
},
1077+
"PrivateMounts":
1078+
{
1079+
"description_good": "Service cannot install system mounts",
1080+
"description_bad": "Service may install system mounts",
1081+
"weight": 1000,
1082+
"range": 1
1083+
},
1084+
"PrivateNetwork":
1085+
{
1086+
"description_good": "Service has no access to the host's network",
1087+
"description_bad": "Service has access to the host's network",
1088+
"weight": 2500,
1089+
"range": 1
1090+
},
1091+
"PrivateTmp":
1092+
{
1093+
"description_good": "Service has no access to other software's temporary files",
1094+
"description_bad": "Service has access to other software's temporary files",
1095+
"weight": 1000,
1096+
"range": 1
1097+
},
1098+
"PrivateUsers":
1099+
{
1100+
"description_good": "Service does not have access to other users",
1101+
"description_bad": "Service has access to other users",
1102+
"weight": 1000,
1103+
"range": 1
1104+
}
1105+
}
1106+
</programlisting>
1107+
</example>
1108+
</listitem>
1109+
</varlistentry>
1110+
1111+
7951112
<varlistentry>
7961113
<term><option>--iterations=<replaceable>NUMBER</replaceable></option></term>
7971114

‎shell-completion/bash/systemd-analyze‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ _systemd_analyze() {
144144

145145
elif __contains_word "$verb" ${VERBS[SECURITY]}; then
146146
if [[ $cur = -* ]]; then
147-
comps='--help --version --no-pager --system --user -H --host -M --machine --offline --threshold'
147+
comps='--help --version --no-pager --system --user -H --host -M --machine --offline --threshold --security-policy'
148148
else
149149
if __contains_word "--user" ${COMP_WORDS[*]}; then
150150
mode=--user

‎shell-completion/zsh/_systemd-analyze‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ _arguments \
9292
'--recursive-errors=[When verifying a unit, control dependency verification]:MODE' \
9393
'--offline=[Perform a security review of the specified unit file(s)]:BOOL' \
9494
'--threshold=[Set a value to compare the overall security exposure level with]: NUMBER' \
95+
'--security-policy=[Allow user to use customized requirements to compare unit file(s) against]: PATH' \
9596
'--no-pager[Do not pipe output into a pager]' \
9697
'--man=[Do (not) check for existence of man pages]:boolean:(1 0)' \
9798
'--order[When generating graph for dot, show only order]' \

‎src/analyze/analyze-security.c‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2481,8 +2481,16 @@ static int offline_security_checks(char **filenames, UnitFileScope scope, bool c
24812481
return r;
24822482
}
24832483

2484-
int analyze_security(sd_bus *bus, char **units, UnitFileScope scope, bool check_man, bool run_generators,
2485-
bool offline, unsigned threshold, const char *root, AnalyzeSecurityFlags flags) {
2484+
int analyze_security(sd_bus *bus,
2485+
char **units,
2486+
JsonVariant *policy,
2487+
UnitFileScope scope,
2488+
bool check_man,
2489+
bool run_generators,
2490+
bool offline,
2491+
unsigned threshold,
2492+
const char *root,
2493+
AnalyzeSecurityFlags flags) {
24862494

24872495
_cleanup_(table_unrefp) Table *overview_table = NULL;
24882496
int ret = 0, r;

‎src/analyze/analyze-security.h‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
#include "sd-bus.h"
77

8+
#include "json.h"
89
#include "unit-file.h"
910

1011
typedef enum AnalyzeSecurityFlags {
@@ -13,5 +14,13 @@ typedef enum AnalyzeSecurityFlags {
1314
ANALYZE_SECURITY_ONLY_LONG_RUNNING = 1 << 2,
1415
} AnalyzeSecurityFlags;
1516

16-
int analyze_security(sd_bus *bus, char **units, UnitFileScope scope, bool check_man, bool run_generators,
17-
bool offline, unsigned threshold, const char *root, AnalyzeSecurityFlags flags);
17+
int analyze_security(sd_bus *bus,
18+
char **units,
19+
JsonVariant *policy,
20+
UnitFileScope scope,
21+
bool check_man,
22+
bool run_generators,
23+
bool offline,
24+
unsigned threshold,
25+
const char *root,
26+
AnalyzeSecurityFlags flags);

0 commit comments

Comments
 (0)