Module: SeccompTools::Audit::Checks::DangerousAllow

Defined in:
lib/seccomp-tools/audit/checks/dangerous_allow.rb

Overview

A syscall a sandbox almost never wants (SeccompTools::Audit::Catalog#dangerous) is reachable as ALLOW. One finding per syscall, carrying the argument condition (if any) under which it is allowed.

Class Method Summary collapse

Class Method Details

.call(policy) ⇒ Array<Audit::Finding>

Parameters:

Returns:



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/seccomp-tools/audit/checks/dangerous_allow.rb', line 16

def call(policy)
  Catalog.dangerous(policy.arch_sym).filter_map do |name, meta|
    nr = policy.number(name)
    next unless nr && policy.reachable_as_allow?(nr)

    cond = policy.condition_for(nr)
    Finding.new(
      id: 'dangerous-allow', severity: meta[:severity], arch: policy.arch_name,
      title: "#{name} is allowed",
      detail: "#{name} reaches ALLOW - #{meta[:why]}.",
      syscalls: [name.to_s], condition: cond,
      remediation: "Block #{name} unless the program genuinely needs it."
    )
  end
end