shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-08 21:17:47 +03:00
Code

analyze: check for RestrictSUIDSGID= in "systemd-analyze security"

Browse Source 
And let's give it a heigh weight, since it pretty much can be used for
bad things only.
This commit is contained in:
Lennart Poettering 2019-03-20 19:20:35 +01:00
parent f69567cbe2
commit 9d880b70ba
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/analyze/analyze-security.c
View File

@ -75,6 +75,7 @@ struct security_info {
uint64_t restrict_namespaces; uint64_t restrict_namespaces;
bool restrict_realtime; bool restrict_realtime;
bool restrict_suid_sgid;
char *root_directory; char *root_directory;
char *root_image; char *root_image;
@ -1148,6 +1149,16 @@ static const struct security_assessor security_assessor_table[] = {
.assess = assess_bool, .assess = assess_bool,
.offset = offsetof(struct security_info, restrict_realtime), .offset = offsetof(struct security_info, restrict_realtime),
}, },
{
.id = "RestrictSUIDSGID=",
.url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RestrictSUIDSGID=",
.description_good = "SUID/SGID file creation by service is restricted",
.description_bad = "Service may create SUID/SGID files",
.weight = 1000,
.range = 1,
.assess = assess_bool,
.offset = offsetof(struct security_info, restrict_suid_sgid),
},
{ {
.id = "RestrictNamespaces=~CLONE_NEWUSER", .id = "RestrictNamespaces=~CLONE_NEWUSER",
.url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RestrictNamespaces=", .url = "https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RestrictNamespaces=",
@ -1881,6 +1892,7 @@ static int acquire_security_info(sd_bus *bus, const char *name, struct security_
{ "RestrictAddressFamilies", "(bas)", property_read_restrict_address_families, 0 }, { "RestrictAddressFamilies", "(bas)", property_read_restrict_address_families, 0 },
{ "RestrictNamespaces", "t", NULL, offsetof(struct security_info, restrict_namespaces) }, { "RestrictNamespaces", "t", NULL, offsetof(struct security_info, restrict_namespaces) },
{ "RestrictRealtime", "b", NULL, offsetof(struct security_info, restrict_realtime) }, { "RestrictRealtime", "b", NULL, offsetof(struct security_info, restrict_realtime) },
{ "RestrictSUIDSGID", "b", NULL, offsetof(struct security_info, restrict_suid_sgid) },
{ "RootDirectory", "s", NULL, offsetof(struct security_info, root_directory) }, { "RootDirectory", "s", NULL, offsetof(struct security_info, root_directory) },
{ "RootImage", "s", NULL, offsetof(struct security_info, root_image) }, { "RootImage", "s", NULL, offsetof(struct security_info, root_image) },
{ "SupplementaryGroups", "as", NULL, offsetof(struct security_info, supplementary_groups) }, { "SupplementaryGroups", "as", NULL, offsetof(struct security_info, supplementary_groups) },