From d54017e8f7e5cc01b02b41b92a28178d55dcc3da Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 4 Nov 2021 19:22:28 +0000 Subject: [PATCH 1/3] analyze: fix typos in test policy --- test/units/testsuite-65.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/units/testsuite-65.sh b/test/units/testsuite-65.sh index c2cbf33cf52..64a7a34ed95 100755 --- a/test/units/testsuite-65.sh +++ b/test/units/testsuite-65.sh @@ -106,7 +106,7 @@ systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile # set to 'yes' (as above in the case of testfile.service) in the content of the unit file, the overall exposure # level for the unit file should decrease to account for that increased weight. cat </tmp/testfile.json -{"User_Or_DynamicUser": +{"UserOrDynamicUser": {"description_bad": "Service runs as root user", "weight": 2000, "range": 10 @@ -192,7 +192,7 @@ cat </tmp/testfile.json {"weight": 1000, "range": 10 }, -"RootDirectory_Or_RootImage": +"RootDirectoryOrRootImage": {"description_good": "Service has its own root directory/image", "description_bad": "Service runs within the host's root directory", "weight": 200, From 03e93377dc47a5dabb4c4b968b241ecf03f72315 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 4 Nov 2021 19:47:29 +0000 Subject: [PATCH 2/3] analyze: explain how the weight/range policy fields are used --- man/systemd-analyze.xml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/man/systemd-analyze.xml b/man/systemd-analyze.xml index 87e15369862..d3dfa9e5261 100644 --- a/man/systemd-analyze.xml +++ b/man/systemd-analyze.xml @@ -1075,9 +1075,13 @@ Service b@0.service not loaded, b.socket cannot be started. corresponding to a specific id of the unit file is missing from the JSON object, the default built-in field value corresponding to that same id is used for security analysis as default. The weight and range fields are used in determining the overall exposure level - of the unit files so by allowing users to manipulate these fields, 'security' gives them - the option to decide for themself which ids are more important and hence, should have a greater - effect on the exposure level. + of the unit files: the value of each setting is assigned a badness score, which is multiplied + by the policy weight and divided by the policy range to determine the overall exposure that + the setting implies. The computed badness is summed across all settings in the unit file, + normalized to the 1…100 range, and used to determine the overall exposure level of the unit. + By allowing users to manipulate these fields, the 'security' verb gives them the option to + decide for themself which ids are more important and hence should have a greater effect on + the exposure level. { From 82100ef486cf7e3b1df64b6bb29db43ac146ac6c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Thu, 4 Nov 2021 19:48:58 +0000 Subject: [PATCH 3/3] analyze: allow a custom policy to skip a check with weight=0 In some cases an offline analysis should ignore some fields, for example a portable service in an image will never list RootImage/RootDirectory, as they are added at runtime, and thus can be skipped. --- man/systemd-analyze.xml | 3 ++- src/analyze/analyze-security.c | 5 +++++ test/units/testsuite-65.sh | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/man/systemd-analyze.xml b/man/systemd-analyze.xml index d3dfa9e5261..e072d661312 100644 --- a/man/systemd-analyze.xml +++ b/man/systemd-analyze.xml @@ -1081,7 +1081,8 @@ Service b@0.service not loaded, b.socket cannot be started. normalized to the 1…100 range, and used to determine the overall exposure level of the unit. By allowing users to manipulate these fields, the 'security' verb gives them the option to decide for themself which ids are more important and hence should have a greater effect on - the exposure level. + the exposure level. A weight of 0 means the setting will not be + checked. { diff --git a/src/analyze/analyze-security.c b/src/analyze/analyze-security.c index 400eebbda8a..d3e011e903f 100644 --- a/src/analyze/analyze-security.c +++ b/src/analyze/analyze-security.c @@ -1764,6 +1764,11 @@ static int assess(const SecurityInfo *info, d = strdup("Service runs in special boot phase, option is not appropriate"); if (!d) return log_oom(); + } else if (weight == 0) { + badness = UINT64_MAX; + d = strdup("Option excluded by policy, skipping"); + if (!d) + return log_oom(); } else { r = a->assess(a, info, data, &badness, &d); if (r < 0) diff --git a/test/units/testsuite-65.sh b/test/units/testsuite-65.sh index 64a7a34ed95..3218462c769 100755 --- a/test/units/testsuite-65.sh +++ b/test/units/testsuite-65.sh @@ -108,7 +108,7 @@ systemd-analyze security --threshold=90 --offline=true --root=/tmp/img/ testfile cat </tmp/testfile.json {"UserOrDynamicUser": {"description_bad": "Service runs as root user", - "weight": 2000, + "weight": 0, "range": 10 }, "SupplementaryGroups":