Module: SeccompTools::Audit::Checks::PermissiveDefault

Defined in:
lib/seccomp-tools/audit/checks/permissive_default.rb

Overview

The catch-all action is ALLOW: a denylist, bypassable by anything the author forgot.

Class Method Summary collapse

Class Method Details

.call(policy) ⇒ Array<Audit::Finding>

Parameters:

Returns:



14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/seccomp-tools/audit/checks/permissive_default.rb', line 14

def call(policy)
  return [] unless policy.default_label == 'ALLOW'

  [Finding.new(
    id: 'permissive-default', severity: :high, arch: policy.arch_name,
    title: 'Default action is ALLOW (denylist)',
    detail: 'Any syscall the filter does not explicitly block is allowed; a denylist is ' \
            'bypassable by any syscall the author overlooked.',
    syscalls: [], condition: nil,
    remediation: 'Use an allowlist: default to KILL/ERRNO and permit only the needed syscalls.'
  )]
end