mirror of
https://git.yoctoproject.org/meta-security
synced 2026-05-07 04:58:47 +00:00
Armin Kuster
186 lines
8.7 KiB
Python
186 lines
8.7 KiB
Python
#
|
|
# ISA_fsa_plugin.py - Filesystem analyser plugin, part of ISA FW
|
|
#
|
|
# Copyright (c) 2015 - 2016, Intel Corporation
|
|
#
|
|
# Redistribution and use in source and binary forms, with or without
|
|
# modification, are permitted provided that the following conditions are met:
|
|
#
|
|
# * Redistributions of source code must retain the above copyright notice,
|
|
# this list of conditions and the following disclaimer.
|
|
# * Redistributions in binary form must reproduce the above copyright
|
|
# notice, this list of conditions and the following disclaimer in the
|
|
# documentation and/or other materials provided with the distribution.
|
|
# * Neither the name of Intel Corporation nor the names of its contributors
|
|
# may be used to endorse or promote products derived from this software
|
|
# without specific prior written permission.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE
|
|
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
import os
|
|
from stat import *
|
|
try:
|
|
from lxml import etree
|
|
except ImportError:
|
|
try:
|
|
import xml.etree.cElementTree as etree
|
|
except ImportError:
|
|
import xml.etree.ElementTree as etree
|
|
|
|
|
|
FSAnalyzer = None
|
|
|
|
|
|
class ISA_FSChecker():
|
|
initialized = False
|
|
|
|
def __init__(self, ISA_config):
|
|
self.logfile = ISA_config.logdir + "/isafw_fsalog"
|
|
self.full_report_name = ISA_config.reportdir + "/fsa_full_report_" + \
|
|
ISA_config.machine + "_" + ISA_config.timestamp
|
|
self.problems_report_name = ISA_config.reportdir + \
|
|
"/fsa_problems_report_" + ISA_config.machine + "_" + ISA_config.timestamp
|
|
self.full_reports = ISA_config.full_reports
|
|
self.initialized = True
|
|
self.setuid_files = []
|
|
self.setgid_files = []
|
|
self.ww_files = []
|
|
self.no_sticky_bit_ww_dirs = []
|
|
with open(self.logfile, 'w') as flog:
|
|
flog.write("\nPlugin ISA_FSChecker initialized!\n")
|
|
|
|
def process_filesystem(self, ISA_filesystem):
|
|
if (self.initialized):
|
|
if (ISA_filesystem.img_name and ISA_filesystem.path_to_fs):
|
|
with open(self.logfile, 'a') as flog:
|
|
flog.write("Analyzing filesystem at: " + ISA_filesystem.path_to_fs +
|
|
" for the image: " + ISA_filesystem.img_name + "\n")
|
|
self.files = self.find_fsobjects(ISA_filesystem.path_to_fs)
|
|
with open(self.logfile, 'a') as flog:
|
|
flog.write("\nFilelist is: " + str(self.files))
|
|
if self.full_reports:
|
|
with open(self.full_report_name + "_" + ISA_filesystem.img_name, 'w') as ffull_report:
|
|
ffull_report.write(
|
|
"Report for image: " + ISA_filesystem.img_name + '\n')
|
|
ffull_report.write(
|
|
"With rootfs location at " + ISA_filesystem.path_to_fs + "\n\n")
|
|
for f in self.files:
|
|
st = os.lstat(f)
|
|
i = f.replace(ISA_filesystem.path_to_fs, "")
|
|
if self.full_reports:
|
|
with open(self.full_report_name + "_" + ISA_filesystem.img_name, 'a') as ffull_report:
|
|
ffull_report.write("File: " + i + ' mode: ' + str(oct(st.st_mode)) +
|
|
" uid: " + str(st.st_uid) + " gid: " + str(st.st_gid) + '\n')
|
|
if ((st.st_mode & S_ISUID) == S_ISUID):
|
|
self.setuid_files.append(i)
|
|
if ((st.st_mode & S_ISGID) == S_ISGID):
|
|
self.setgid_files.append(i)
|
|
if ((st.st_mode & S_IWOTH) == S_IWOTH):
|
|
if (((st.st_mode & S_IFDIR) == S_IFDIR) and ((st.st_mode & S_ISVTX) != S_ISVTX)):
|
|
self.no_sticky_bit_ww_dirs.append(i)
|
|
if (((st.st_mode & S_IFREG) == S_IFREG) and ((st.st_mode & S_IFLNK) != S_IFLNK)):
|
|
self.ww_files.append(i)
|
|
self.write_problems_report(ISA_filesystem)
|
|
self.write_problems_report_xml(ISA_filesystem)
|
|
else:
|
|
with open(self.logfile, 'a') as flog:
|
|
flog.write(
|
|
"Mandatory arguments such as image name and path to the filesystem are not provided!\n")
|
|
flog.write("Not performing the call.\n")
|
|
else:
|
|
with open(self.logfile, 'a') as flog:
|
|
flog.write(
|
|
"Plugin hasn't initialized! Not performing the call.\n")
|
|
|
|
def write_problems_report(self, ISA_filesystem):
|
|
with open(self.problems_report_name + "_" + ISA_filesystem.img_name, 'w') as fproblems_report:
|
|
fproblems_report.write(
|
|
"Report for image: " + ISA_filesystem.img_name + '\n')
|
|
fproblems_report.write(
|
|
"With rootfs location at " + ISA_filesystem.path_to_fs + "\n\n")
|
|
fproblems_report.write("Files with SETUID bit set:\n")
|
|
for item in self.setuid_files:
|
|
fproblems_report.write(item + '\n')
|
|
fproblems_report.write("\n\nFiles with SETGID bit set:\n")
|
|
for item in self.setgid_files:
|
|
fproblems_report.write(item + '\n')
|
|
fproblems_report.write("\n\nWorld-writable files:\n")
|
|
for item in self.ww_files:
|
|
fproblems_report.write(item + '\n')
|
|
fproblems_report.write(
|
|
"\n\nWorld-writable dirs with no sticky bit:\n")
|
|
for item in self.no_sticky_bit_ww_dirs:
|
|
fproblems_report.write(item + '\n')
|
|
|
|
def write_problems_report_xml(self, ISA_filesystem):
|
|
num_tests = len(self.setuid_files) + len(self.setgid_files) + \
|
|
len(self.ww_files) + len(self.no_sticky_bit_ww_dirs)
|
|
root = etree.Element(
|
|
'testsuite', name='FSA_Plugin', tests=str(num_tests))
|
|
if self.setuid_files:
|
|
for item in self.setuid_files:
|
|
tcase1 = etree.SubElement(
|
|
root, 'testcase', classname='Files_with_SETUID_bit_set', name=item)
|
|
etree.SubElement(
|
|
tcase1, 'failure', message=item, type='violation')
|
|
if self.setgid_files:
|
|
for item in self.setgid_files:
|
|
tcase2 = etree.SubElement(
|
|
root, 'testacase', classname='Files_with_SETGID_bit_set', name=item)
|
|
etree.SubElement(
|
|
tcase2, 'failure', message=item, type='violation')
|
|
if self.ww_files:
|
|
for item in self.ww_files:
|
|
tcase3 = etree.SubElement(
|
|
root, 'testase', classname='World-writable_files', name=item)
|
|
etree.SubElement(
|
|
tcase3, 'failure', message=item, type='violation')
|
|
if self.no_sticky_bit_ww_dirs:
|
|
for item in self.no_sticky_bit_ww_dirs:
|
|
tcase4 = etree.SubElement(
|
|
root, 'testcase', classname='World-writable_dirs_with_no_sticky_bit', name=item)
|
|
etree.SubElement(
|
|
tcase4, 'failure', message=item, type='violation')
|
|
tree = etree.ElementTree(root)
|
|
output = self.problems_report_name + "_" + ISA_filesystem.img_name + '.xml'
|
|
try:
|
|
tree.write(output, encoding='UTF-8',
|
|
pretty_print=True, xml_declaration=True)
|
|
except TypeError:
|
|
tree.write(output, encoding='UTF-8', xml_declaration=True)
|
|
|
|
def find_fsobjects(self, init_path):
|
|
list_of_files = []
|
|
for (dirpath, dirnames, filenames) in os.walk(init_path):
|
|
if (dirpath != init_path):
|
|
list_of_files.append(str(dirpath)[:])
|
|
for f in filenames:
|
|
list_of_files.append(str(dirpath + "/" + f)[:])
|
|
return list_of_files
|
|
|
|
# ======== supported callbacks from ISA ============= #
|
|
|
|
|
|
def init(ISA_config):
|
|
global FSAnalyzer
|
|
FSAnalyzer = ISA_FSChecker(ISA_config)
|
|
|
|
|
|
def getPluginName():
|
|
return "ISA_FSChecker"
|
|
|
|
|
|
def process_filesystem(ISA_filesystem):
|
|
global FSAnalyzer
|
|
return FSAnalyzer.process_filesystem(ISA_filesystem)
|
|
|
|
# ==================================================== #
|