Module: SeccompTools::Audit::Checks::OrwChain

Defined in:
lib/seccomp-tools/audit/checks/orw_chain.rb

Overview

An open-family, a read-family and a write/send-family syscall are all reachable as ALLOW - the classic "open the flag, read it, write it out" chain.

Class Method Summary collapse

Class Method Details

.call(policy) ⇒ Array<Audit::Finding>

Parameters:

Returns:



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/seccomp-tools/audit/checks/orw_chain.rb', line 16

def call(policy)
  o = first_allowed(policy, Catalog::ORW[:open])
  r = first_allowed(policy, Catalog::ORW[:read])
  w = first_allowed(policy, Catalog::ORW[:write])
  return [] unless o && r && w

  [Finding.new(
    id: 'orw-chain', severity: :high, arch: policy.arch_name,
    title: 'A file can be opened and its contents copied out',
    # The syscall names are painted wherever they appear, so keep them out of prose that
    # merely describes the actions - only name one where the syscall itself is meant.
    detail: "#{o}, #{r} and #{w} all reach ALLOW, so the contents of an arbitrary file " \
            '(e.g. the flag) can be copied straight back out.',
    syscalls: [o, r, w].map(&:to_s), condition: nil,
    remediation: 'Deny the open-family syscalls unless the program genuinely needs arbitrary files.'
  )]
end