784 lines
27 KiB
Go
784 lines
27 KiB
Go
package policy
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// Risk es la categoría de riesgo de un comando.
|
|
type Risk string
|
|
|
|
const (
|
|
RiskReadOnly Risk = "read-only"
|
|
RiskNetwork Risk = "network"
|
|
RiskDownload Risk = "download"
|
|
RiskWrite Risk = "write"
|
|
RiskDelete Risk = "delete"
|
|
RiskPackage Risk = "package"
|
|
RiskService Risk = "service"
|
|
RiskAdmin Risk = "admin"
|
|
RiskDestructive Risk = "destructive"
|
|
RiskReboot Risk = "reboot"
|
|
RiskUnknown Risk = "unknown"
|
|
)
|
|
|
|
// Classification describe un comando concreto (argv) tras desenvolver
|
|
// envoltorios como sudo, env o timeout.
|
|
type Classification struct {
|
|
Program string // nombre base del programa efectivo
|
|
Argv []string
|
|
Risks []Risk
|
|
// AllArgsArePaths indica que todos los argumentos no-opción deben
|
|
// tratarse como rutas afectadas (rm, cp, chmod...).
|
|
AllArgsArePaths bool
|
|
// Nested contiene comandos anidados (bash -c, find -exec, xargs...).
|
|
Nested []Classification
|
|
// Script es el script de un "bash -c" anidado, si lo hay.
|
|
Script *ShellScript
|
|
}
|
|
|
|
// AllRisks devuelve los riesgos propios y de todos los comandos anidados.
|
|
func (c Classification) AllRisks() []Risk {
|
|
out := append([]Risk(nil), c.Risks...)
|
|
for _, n := range c.Nested {
|
|
out = append(out, n.AllRisks()...)
|
|
}
|
|
return out
|
|
}
|
|
|
|
// ReadOnly indica si el comando y todos sus anidados son de solo lectura
|
|
// (o solo red), es decir, seguros de ejecutar en --dry-run.
|
|
func (c Classification) ReadOnly() bool {
|
|
for _, r := range c.AllRisks() {
|
|
if r != RiskReadOnly && r != RiskNetwork {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
// readOnlyPrograms nunca modifican el sistema, sean cuales sean sus argumentos.
|
|
var readOnlyPrograms = set(
|
|
"ls", "dir", "cat", "tac", "head", "tail", "grep", "egrep", "fgrep", "rg", "zgrep", "zcat", "bzcat", "xzcat", "zstdcat",
|
|
"stat", "file", "wc", "du", "df", "free", "uptime", "uname", "id", "whoami", "groups", "who", "w", "last", "lastlog",
|
|
"ps", "pgrep", "pidof", "ss", "netstat", "lsof", "lsblk", "blkid", "lscpu", "lsmem", "lspci", "lsusb", "lsmod",
|
|
"lsattr", "lsns", "lsipc", "lslocks", "lslogins", "findmnt", "cal", "printenv", "echo", "printf", "true", "false",
|
|
"test", "[", "[[", "basename", "dirname", "realpath", "readlink", "pwd", "which", "whereis", "type", "sort", "uniq",
|
|
"cut", "tr", "column", "nl", "fold", "fmt", "paste", "join", "comm", "diff", "cmp", "md5sum", "sha1sum", "sha224sum",
|
|
"sha256sum", "sha384sum", "sha512sum", "b2sum", "cksum", "base64", "base32", "xxd", "hexdump", "od", "strings", "jq",
|
|
"getent", "getconf", "nproc", "arch", "locale", "vmstat", "iostat", "mpstat", "pidstat", "sar", "systemd-analyze",
|
|
"modinfo", "tree", "locate", "dmidecode", "sensors", "aa-status", "getenforce", "sestatus", "apt-cache", "dpkg-query",
|
|
"named-checkconf", "named-checkzone", "cd", "export", "unset", "set", "read", "sleep", "wait", "exit", "return",
|
|
"local", "shift", "declare", "typeset", "readonly", "let", "seq", "yes", "expr", "tput", "ldd", "nm",
|
|
"objdump", "readelf", "lsinitramfs", "systemd-detect-virt", "virt-what", "numfmt", "rev", "shuf", "iconv", "less",
|
|
"more", "man", "whatis", "apropos", "hash", "ulimit", "logname", "tty", "users",
|
|
"free", "systemd-cgls", "systemd-cgtop", "diff3", "sdiff", "look", "zdiff", "zless", "zmore", "cmp")
|
|
|
|
// networkPrograms solo consultan la red.
|
|
var networkPrograms = set(
|
|
"ping", "ping6", "traceroute", "traceroute6", "tracepath", "mtr", "dig", "host", "nslookup", "whois", "nc", "ncat",
|
|
"netcat", "telnet", "nmap", "arping", "ssh", "sftp", "ftp", "drill", "delv", "kdig", "socat",
|
|
)
|
|
|
|
// destructivePrograms pueden destruir datos de forma irreversible.
|
|
var destructivePrograms = set(
|
|
"dd", "mkfs", "mke2fs", "mkswap", "wipefs", "fdisk", "sfdisk", "cfdisk", "gdisk", "sgdisk", "parted", "shred",
|
|
"blkdiscard", "pvremove", "vgremove", "lvremove", "userdel", "deluser", "groupdel", "delgroup", "killall5",
|
|
"mdadm", "zpool", "badblocks",
|
|
)
|
|
|
|
// adminPrograms modifican la configuración del sistema.
|
|
var adminPrograms = set(
|
|
"chmod", "chown", "chgrp", "setfacl", "chattr", "useradd", "usermod", "groupadd", "groupmod", "gpasswd", "passwd",
|
|
"chpasswd", "adduser", "addgroup", "chsh", "chfn", "kill", "pkill", "killall", "umount", "mount", "swapoff",
|
|
"modprobe", "insmod", "rmmod", "depmod", "chroot", "pvcreate", "vgcreate", "lvcreate", "lvextend", "lvresize",
|
|
"resize2fs", "xfs_growfs", "tune2fs", "e2fsck", "fsck", "update-grub", "grub-install", "update-initramfs",
|
|
"update-alternatives", "ldconfig", "setcap", "newaliases", "postmap", "a2enmod", "a2dismod", "a2ensite",
|
|
"a2dissite", "locale-gen", "update-ca-certificates", "certbot", "iptables-restore", "ip6tables-restore",
|
|
"renice", "systemd-tmpfiles", "setenforce", "exportfs", "quotaon", "quotaoff",
|
|
)
|
|
|
|
// writePrograms escriben archivos (sin llegar a administración del sistema).
|
|
var writePrograms = set(
|
|
"cp", "mv", "install", "ln", "touch", "mkdir", "tee", "truncate", "patch", "mkfifo", "mknod", "split", "csplit",
|
|
"make", "cmake", "ninja", "meson", "gcc", "cc", "g++", "c++", "clang", "clang++", "ld", "as", "rustc", "cargo", "go",
|
|
"javac", "ar", "strip", "zip", "7z", "convert", "sponge", "dos2unix", "unix2dos", "ssh-keygen",
|
|
)
|
|
|
|
// packagePrograms: gestores de paquetes (subcomandos de lectura se tratan aparte).
|
|
var packageReadVerbs = map[string]map[string]bool{
|
|
"apt": set("list", "show", "search", "policy", "depends", "rdepends", "showsrc", "changelog", "madison", "help", "moo"),
|
|
"apt-get": set("check", "changelog", "help"),
|
|
"dnf": set("list", "info", "search", "repolist", "repoquery", "provides", "whatprovides", "history", "check-update", "help", "deplist", "updateinfo", "module-list"),
|
|
"yum": set("list", "info", "search", "repolist", "provides", "whatprovides", "history", "check-update", "help", "deplist", "updateinfo"),
|
|
"zypper": set("search", "se", "info", "if", "list-updates", "lu", "repos", "lr", "packages", "pa", "patches", "lp", "help"),
|
|
"apk": set("info", "search", "list", "policy", "version", "dot", "stats", "help"),
|
|
"snap": set("list", "info", "find", "search", "version", "help", "changes", "services", "connections"),
|
|
"flatpak": set("list", "info", "search", "remote-ls", "remotes", "history", "help"),
|
|
"pip": set("list", "show", "freeze", "check", "help", "search", "inspect", "debug", "config"),
|
|
"pip3": set("list", "show", "freeze", "check", "help", "search", "inspect", "debug", "config"),
|
|
}
|
|
|
|
func set(items ...string) map[string]bool {
|
|
m := make(map[string]bool, len(items))
|
|
for _, it := range items {
|
|
m[it] = true
|
|
}
|
|
return m
|
|
}
|
|
|
|
// Classify clasifica un argv. Nunca devuelve una lista de riesgos vacía.
|
|
func Classify(argv []string) Classification {
|
|
return classify(argv, 0)
|
|
}
|
|
|
|
func classify(argv []string, depth int) Classification {
|
|
if len(argv) == 0 {
|
|
return Classification{Risks: []Risk{RiskReadOnly}}
|
|
}
|
|
if depth > maxShellDepth {
|
|
return Classification{Program: argv[0], Argv: argv, Risks: []Risk{RiskUnknown}}
|
|
}
|
|
prog := filepath.Base(argv[0])
|
|
args := argv[1:]
|
|
c := Classification{Program: prog, Argv: argv}
|
|
|
|
// Un nombre de programa dinámico ($CMD, $(...)) no se puede clasificar.
|
|
if strings.ContainsAny(argv[0], "$`") {
|
|
c.Risks = []Risk{RiskUnknown}
|
|
return c
|
|
}
|
|
|
|
// Envoltorios: el riesgo es el del comando interior.
|
|
if inner, ok := unwrap(prog, args); ok {
|
|
if inner == nil {
|
|
c.Risks = []Risk{RiskUnknown}
|
|
return c
|
|
}
|
|
n := classify(inner, depth+1)
|
|
n.Nested = append([]Classification(nil), n.Nested...)
|
|
return n
|
|
}
|
|
|
|
// Intérpretes de shell con -c: se analiza el script.
|
|
if isShell(prog) {
|
|
if script, ok := shellDashC(args); ok {
|
|
s := ParseShell(script)
|
|
c.Script = &s
|
|
c.Risks = []Risk{RiskReadOnly}
|
|
if len(s.Opaque) > 0 {
|
|
c.Risks = []Risk{RiskUnknown}
|
|
}
|
|
for _, sc := range s.Commands {
|
|
c.Nested = append(c.Nested, classify(sc.Argv, depth+1))
|
|
}
|
|
return c
|
|
}
|
|
c.Risks = []Risk{RiskUnknown}
|
|
return c
|
|
}
|
|
|
|
// Consultas de versión/ayuda: seguras para cualquier programa.
|
|
if len(args) == 1 && (args[0] == "--version" || args[0] == "--help" || args[0] == "-version") {
|
|
c.Risks = []Risk{RiskReadOnly}
|
|
return c
|
|
}
|
|
|
|
c.Risks, c.AllArgsArePaths, c.Nested = programRisks(prog, args, depth)
|
|
return c
|
|
}
|
|
|
|
// programRisks contiene las reglas por programa y subcomando.
|
|
func programRisks(prog string, args []string, depth int) (risks []Risk, allPaths bool, nested []Classification) {
|
|
verb := firstNonFlag(args)
|
|
has := func(flags ...string) bool { return hasAny(args, flags...) }
|
|
one := func(r Risk) ([]Risk, bool, []Classification) { return []Risk{r}, false, nil }
|
|
|
|
switch prog {
|
|
case "rm", "rmdir", "unlink":
|
|
return []Risk{RiskDelete}, true, nil
|
|
case "cp", "mv", "install", "ln", "touch", "mkdir", "truncate", "tee", "mkfifo":
|
|
return []Risk{RiskWrite}, true, nil
|
|
case "chmod", "chown", "chgrp", "setfacl", "chattr":
|
|
return []Risk{RiskAdmin}, true, nil
|
|
case "shred":
|
|
return []Risk{RiskDestructive}, true, nil
|
|
|
|
case "find":
|
|
return classifyFind(args, depth)
|
|
case "xargs":
|
|
inner := skipFlags(args, "-n", "-I", "-P", "-d", "-L", "-s", "-E", "-a", "--max-args", "--max-procs", "--delimiter", "--arg-file")
|
|
if len(inner) == 0 {
|
|
return one(RiskReadOnly) // xargs sin comando ejecuta echo
|
|
}
|
|
n := classify(inner, depth+1)
|
|
return n.Risks, n.AllArgsArePaths, n.Nested
|
|
|
|
case "systemctl":
|
|
switch verb {
|
|
case "", "status", "is-active", "is-enabled", "is-failed", "is-system-running", "show", "cat", "list-units",
|
|
"list-unit-files", "list-sockets", "list-timers", "list-jobs", "list-dependencies", "list-machines",
|
|
"help", "get-default", "show-environment":
|
|
return one(RiskReadOnly)
|
|
case "start", "stop", "restart", "reload", "try-restart", "reload-or-restart", "try-reload-or-restart",
|
|
"enable", "disable", "reenable", "mask", "unmask", "daemon-reload", "daemon-reexec", "kill", "reset-failed",
|
|
"condrestart", "force-reload", "preset", "revert":
|
|
return one(RiskService)
|
|
case "reboot", "poweroff", "halt", "kexec", "suspend", "hibernate", "hybrid-sleep", "suspend-then-hibernate",
|
|
"rescue", "emergency", "default", "isolate", "soft-reboot", "switch-root":
|
|
return one(RiskReboot)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "service":
|
|
if has("--status-all") || len(args) >= 2 && args[1] == "status" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskService)
|
|
case "reboot", "shutdown", "poweroff", "halt":
|
|
return one(RiskReboot)
|
|
case "init", "telinit":
|
|
if verb == "0" || verb == "6" {
|
|
return one(RiskReboot)
|
|
}
|
|
return one(RiskAdmin)
|
|
|
|
case "apt", "apt-get", "aptitude", "dnf", "yum", "microdnf", "zypper", "apk", "snap", "flatpak", "pip", "pip3":
|
|
if verb == "" || packageReadVerbs[prog][verb] {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return []Risk{RiskPackage, RiskNetwork}, false, nil
|
|
case "apt-mark", "dpkg-reconfigure", "debconf-set-selections", "add-apt-repository":
|
|
if prog == "apt-mark" && (verb == "showhold" || verb == "showauto" || verb == "showmanual") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskPackage)
|
|
case "dpkg":
|
|
if has("-i", "--install", "-r", "--remove", "-P", "--purge", "--configure", "--unpack", "-a", "--set-selections",
|
|
"--clear-selections", "--add-architecture", "--remove-architecture", "-x", "--extract", "-b", "--build") {
|
|
return one(RiskPackage)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "rpm":
|
|
if has("-i", "--install", "-U", "--upgrade", "-e", "--erase", "-F", "--freshen", "--import", "--rebuilddb") {
|
|
return one(RiskPackage)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "pacman":
|
|
if verb == "" && len(args) > 0 {
|
|
f := args[0]
|
|
if strings.HasPrefix(f, "-Q") || strings.HasPrefix(f, "-F") || f == "-Ss" || f == "-Si" || f == "-Sl" || f == "-Sg" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
} else if len(args) > 0 && (strings.HasPrefix(args[0], "-Q") || args[0] == "-Ss" || args[0] == "-Si") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return []Risk{RiskPackage, RiskNetwork}, false, nil
|
|
|
|
case "ip":
|
|
return classifyIP(args)
|
|
case "nft":
|
|
if verb == "list" || verb == "describe" || has("-c", "--check") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "iptables", "ip6tables", "iptables-legacy", "ip6tables-legacy", "iptables-nft", "ip6tables-nft", "ebtables", "arptables":
|
|
if onlyFlags(args, "-L", "--list", "-S", "--list-rules", "-n", "--numeric", "-v", "--verbose", "-t", "--table", "-x", "--line-numbers", "-C", "--check") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "iptables-save", "ip6tables-save":
|
|
return one(RiskReadOnly)
|
|
case "ufw":
|
|
if verb == "status" || verb == "show" || verb == "app" && len(args) > 1 && (args[1] == "list" || args[1] == "info") || verb == "version" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "firewall-cmd":
|
|
for _, a := range args {
|
|
if !(strings.HasPrefix(a, "--list") || strings.HasPrefix(a, "--get") || strings.HasPrefix(a, "--query") ||
|
|
a == "--state" || strings.HasPrefix(a, "--zone") || a == "--permanent" || strings.HasPrefix(a, "--info")) {
|
|
return one(RiskAdmin)
|
|
}
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "tc", "bridge":
|
|
if verb == "" || containsWord(args, "show", "list", "ls") && !containsWord(args, "add", "del", "delete", "replace", "change", "set", "flush") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "nmcli":
|
|
if containsWord(args, "modify", "up", "down", "add", "delete", "del", "reload", "import", "connect", "disconnect", "on", "off", "set", "edit", "clone") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "networkctl", "resolvectl", "loginctl", "hostnamectl", "timedatectl", "localectl", "busctl", "coredumpctl", "machinectl":
|
|
if verb == "" || verb == "status" || verb == "show" || verb == "query" || verb == "list" || strings.HasPrefix(verb, "list") ||
|
|
verb == "statistics" || verb == "dns" || verb == "domain" || verb == "info" || verb == "cat-config" || verb == "timesync-status" ||
|
|
verb == "show-timesync" || verb == "tree" || verb == "introspect" || verb == "user-status" || verb == "session-status" || verb == "seat-status" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "ethtool":
|
|
if has("-s", "--change", "-K", "--features", "--offload", "-G", "--set-ring", "-A", "--pause", "-C", "--coalesce",
|
|
"-L", "--set-channels", "-E", "--change-eeprom", "-f", "--flash", "-r", "--negotiate", "-p", "--identify", "--reset", "-X", "-N", "-U") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "iw", "wg":
|
|
if containsWord(args, "set", "add", "del", "connect", "disconnect", "setconf", "addconf", "syncconf") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
|
|
case "mount":
|
|
if len(args) == 0 || onlyFlags(args, "-l", "--show-labels", "-t", "--types", "-v") && !hasNonFlag(args, "-t", "--types") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "swapon":
|
|
if len(args) == 0 || has("--show", "-s", "--summary") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "sysctl":
|
|
for _, a := range args {
|
|
if a == "-w" || a == "--write" || a == "-p" || a == "--load" || a == "--system" || strings.Contains(a, "=") && !strings.HasPrefix(a, "-") {
|
|
return one(RiskAdmin)
|
|
}
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "hostname":
|
|
if verb == "" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "date":
|
|
if has("-s", "--set") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "dmesg":
|
|
if has("-c", "-C", "--clear", "--read-clear", "-D", "-E", "-n", "--console-off", "--console-on", "--console-level") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "journalctl":
|
|
for _, a := range args {
|
|
if strings.HasPrefix(a, "--vacuum") {
|
|
return []Risk{RiskDelete}, false, nil
|
|
}
|
|
if a == "--rotate" || a == "--flush" || a == "--relinquish-var" || a == "--sync" || a == "--setup-keys" {
|
|
return one(RiskAdmin)
|
|
}
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "crontab":
|
|
if has("-l") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "top", "htop", "iotop", "atop":
|
|
if has("-b", "--batch") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskUnknown) // interactivo: se colgaría hasta el timeout
|
|
case "kill":
|
|
if has("-l", "-L", "--list", "--table") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "smartctl":
|
|
if has("-t", "--test", "-s", "--smart", "-o", "--offlineauto", "-S", "--saveauto", "-X", "--abort") {
|
|
return one(RiskAdmin)
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "cryptsetup":
|
|
switch verb {
|
|
case "status", "luksDump", "isLuks", "luksUUID", "tcryptDump", "bitlkDump":
|
|
return one(RiskReadOnly)
|
|
case "luksFormat", "erase", "luksErase", "reencrypt", "luksKillSlot", "luksRemoveKey":
|
|
return one(RiskDestructive)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "zfs":
|
|
if verb == "destroy" {
|
|
return one(RiskDestructive)
|
|
}
|
|
if verb == "list" || verb == "get" || verb == "status" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "lvm", "lvs", "vgs", "pvs", "lvdisplay", "vgdisplay", "pvdisplay", "pvscan", "vgscan", "lvscan":
|
|
return one(RiskReadOnly)
|
|
|
|
case "sed":
|
|
for _, a := range args {
|
|
if a == "-i" || strings.HasPrefix(a, "-i") && !strings.HasPrefix(a, "--") || strings.HasPrefix(a, "--in-place") ||
|
|
len(a) > 1 && a[0] == '-' && a[1] != '-' && strings.Contains(a, "i") {
|
|
return []Risk{RiskWrite}, true, nil
|
|
}
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "awk", "gawk", "mawk", "nawk", "perl", "python", "python3", "ruby", "node", "php", "lua", "tclsh", "Rscript":
|
|
// Lenguajes con E/S y system(): no se pueden evaluar.
|
|
return one(RiskUnknown)
|
|
case "tar", "bsdtar":
|
|
// Modo de listado: "tf", "-tzf", "--list" (sin crear ni extraer).
|
|
mode := ""
|
|
if len(args) > 0 && !strings.HasPrefix(args[0], "--") {
|
|
mode = strings.TrimPrefix(args[0], "-")
|
|
}
|
|
if has("--list") || strings.Contains(mode, "t") && !strings.ContainsAny(mode, "cxruA") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return []Risk{RiskWrite}, false, nil
|
|
case "unzip":
|
|
if has("-l", "-v", "-t", "-Z", "-p") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return []Risk{RiskWrite}, false, nil
|
|
case "gzip", "gunzip", "bzip2", "bunzip2", "xz", "unxz", "zstd", "unzstd", "lz4", "lzma":
|
|
if has("-l", "--list", "-t", "--test", "-c", "--stdout", "--to-stdout") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return []Risk{RiskWrite}, true, nil
|
|
case "git":
|
|
switch verb {
|
|
case "status", "log", "diff", "show", "branch", "rev-parse", "ls-files", "blame", "describe", "shortlog",
|
|
"grep", "cat-file", "ls-tree", "reflog", "config", "help", "version", "whatchanged", "tag", "remote":
|
|
if verb == "config" && !has("--get", "--list", "-l", "--get-all", "--get-regexp") ||
|
|
verb == "remote" && hasNonFlagAfterVerb(args, "remote") && !containsWord(args, "show", "-v", "get-url") ||
|
|
verb == "tag" && hasNonFlagAfterVerb(args, "tag") && !has("-l", "--list") ||
|
|
verb == "branch" && hasNonFlagAfterVerb(args, "branch") && !has("-l", "--list", "-a", "-r", "-v", "-vv") {
|
|
return []Risk{RiskWrite}, false, nil
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "clone", "fetch", "pull", "push", "submodule":
|
|
return []Risk{RiskNetwork, RiskWrite}, false, nil
|
|
case "ls-remote":
|
|
return one(RiskNetwork)
|
|
}
|
|
return []Risk{RiskWrite}, false, nil
|
|
case "curl":
|
|
if has("-o", "--output", "-O", "--remote-name", "--remote-name-all", "-T", "--upload-file", "-c", "--cookie-jar", "-D", "--dump-header") {
|
|
return []Risk{RiskNetwork, RiskDownload, RiskWrite}, false, nil
|
|
}
|
|
return one(RiskNetwork)
|
|
case "wget", "aria2c":
|
|
if has("-O-", "--output-document=-", "--spider", "-qO-") || has("-O") && containsWord(args, "-") {
|
|
return one(RiskNetwork)
|
|
}
|
|
return []Risk{RiskNetwork, RiskDownload, RiskWrite}, false, nil
|
|
case "scp", "rsync":
|
|
r := []Risk{RiskWrite}
|
|
for _, a := range args {
|
|
if strings.Contains(a, ":") && !strings.HasPrefix(a, "-") {
|
|
r = append(r, RiskNetwork)
|
|
break
|
|
}
|
|
}
|
|
return r, prog == "scp", nil
|
|
case "openssl":
|
|
switch verb {
|
|
case "s_client", "s_time", "ocsp":
|
|
return one(RiskNetwork)
|
|
case "genrsa", "genpkey", "req", "ca", "rand", "enc", "pkcs12", "dhparam", "ecparam", "x509", "rsa", "ec", "pkey", "dgst", "smime", "cms":
|
|
if has("-out", "-keyout", "-new", "-newkey") {
|
|
return []Risk{RiskWrite}, false, nil
|
|
}
|
|
}
|
|
return one(RiskReadOnly)
|
|
case "nginx", "apache2ctl", "apachectl", "httpd":
|
|
if has("-t", "-T", "-v", "-V", "-S", "-M", "-l", "-L") || verb == "configtest" || verb == "-t" {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskService)
|
|
case "sshd":
|
|
if has("-t", "-T", "-G") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskService)
|
|
case "visudo":
|
|
if has("-c", "--check") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
return one(RiskAdmin)
|
|
case "docker", "podman", "nerdctl":
|
|
switch verb {
|
|
case "ps", "images", "inspect", "logs", "info", "version", "stats", "top", "port", "diff", "history", "events":
|
|
return one(RiskReadOnly)
|
|
case "rm", "rmi", "prune", "system":
|
|
return []Risk{RiskAdmin, RiskDelete}, false, nil
|
|
}
|
|
return []Risk{RiskAdmin, RiskNetwork}, false, nil
|
|
case "command":
|
|
if has("-v", "-V") {
|
|
return one(RiskReadOnly)
|
|
}
|
|
}
|
|
|
|
switch {
|
|
case readOnlyPrograms[prog]:
|
|
return one(RiskReadOnly)
|
|
case networkPrograms[prog]:
|
|
return one(RiskNetwork)
|
|
case destructivePrograms[prog] || strings.HasPrefix(prog, "mkfs."):
|
|
return []Risk{RiskDestructive}, true, nil
|
|
case adminPrograms[prog]:
|
|
return one(RiskAdmin)
|
|
case writePrograms[prog]:
|
|
return []Risk{RiskWrite}, false, nil
|
|
case prog == "eval" || prog == "source" || prog == "." || prog == "exec" || prog == "trap" || prog == "alias":
|
|
return one(RiskUnknown)
|
|
}
|
|
return one(RiskUnknown)
|
|
}
|
|
|
|
// unwrap desenvuelve comandos que ejecutan otro comando.
|
|
// Devuelve (nil, true) si es un envoltorio pero no se pudo extraer el comando.
|
|
func unwrap(prog string, args []string) ([]string, bool) {
|
|
switch prog {
|
|
case "sudo", "doas":
|
|
if hasAny(args, "-s", "--shell", "-i", "--login", "-e", "--edit", "-l", "--list", "-v", "--validate", "-k", "-K") {
|
|
if hasAny(args, "-l", "--list", "-v", "-k", "-K") && firstNonFlag(args) == "" {
|
|
return []string{"true"}, true
|
|
}
|
|
return nil, true
|
|
}
|
|
return orNil(skipFlags(args, "-u", "--user", "-g", "--group", "-C", "--close-from", "-h", "--host", "-p", "--prompt", "-r", "--role", "-t", "--type", "-U", "--other-user", "-D", "--chdir", "-T", "--command-timeout")), true
|
|
case "env":
|
|
rest := skipFlags(args, "-u", "--unset", "-C", "--chdir", "-S", "--split-string")
|
|
for len(rest) > 0 && assignmentRe.MatchString(rest[0]) {
|
|
rest = rest[1:]
|
|
}
|
|
if len(rest) == 0 {
|
|
return []string{"printenv"}, true
|
|
}
|
|
return rest, true
|
|
case "nice":
|
|
return orNil(skipFlags(args, "-n", "--adjustment")), true
|
|
case "ionice":
|
|
return orNil(skipFlags(args, "-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid", "-u", "--uid")), true
|
|
case "nohup", "setsid", "unbuffer", "builtin", "time", "chronic":
|
|
return orNil(skipFlags(args)), true
|
|
case "stdbuf":
|
|
return orNil(skipFlags(args, "-i", "-o", "-e")), true
|
|
case "timeout":
|
|
rest := skipFlags(args, "-s", "--signal", "-k", "--kill-after")
|
|
if len(rest) > 0 {
|
|
rest = rest[1:] // duración
|
|
}
|
|
return orNil(rest), true
|
|
case "watch":
|
|
return orNil(skipFlags(args, "-n", "--interval", "-d")), true
|
|
case "taskset":
|
|
rest := skipFlags(args, "-c")
|
|
if len(rest) > 0 && !hasAny(args, "-p", "--pid") {
|
|
rest = rest[1:] // máscara
|
|
}
|
|
return orNil(rest), true
|
|
case "chrt":
|
|
rest := skipFlags(args)
|
|
if len(rest) > 0 {
|
|
rest = rest[1:] // prioridad
|
|
}
|
|
return orNil(rest), true
|
|
case "busybox":
|
|
return orNil(args), true
|
|
case "su":
|
|
for i, a := range args {
|
|
if (a == "-c" || a == "--command") && i+1 < len(args) {
|
|
return []string{"sh", "-c", args[i+1]}, true
|
|
}
|
|
}
|
|
return nil, true
|
|
case "command":
|
|
if hasAny(args, "-v", "-V") {
|
|
return nil, false // lo gestiona programRisks
|
|
}
|
|
return orNil(skipFlags(args, "-p")), true
|
|
}
|
|
return nil, false
|
|
}
|
|
|
|
func orNil(s []string) []string {
|
|
if len(s) == 0 {
|
|
return nil
|
|
}
|
|
return s
|
|
}
|
|
|
|
func isShell(prog string) bool {
|
|
switch prog {
|
|
case "sh", "bash", "dash", "zsh", "ksh", "ash", "mksh", "fish", "rbash":
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// shellDashC busca el script de "sh -c SCRIPT" (también -lc, -ec, ...).
|
|
func shellDashC(args []string) (string, bool) {
|
|
for i, a := range args {
|
|
if len(a) > 1 && a[0] == '-' && a[1] != '-' && strings.Contains(a, "c") {
|
|
if i+1 < len(args) {
|
|
return args[i+1], true
|
|
}
|
|
return "", false
|
|
}
|
|
if !strings.HasPrefix(a, "-") {
|
|
return "", false // sh script.sh: contenido no analizado
|
|
}
|
|
}
|
|
return "", false
|
|
}
|
|
|
|
func classifyFind(args []string, depth int) ([]Risk, bool, []Classification) {
|
|
risks := []Risk{RiskReadOnly}
|
|
var nested []Classification
|
|
for i := 0; i < len(args); i++ {
|
|
switch args[i] {
|
|
case "-delete":
|
|
risks = append(risks, RiskDelete)
|
|
case "-fprint", "-fprint0", "-fprintf", "-fls":
|
|
risks = append(risks, RiskWrite)
|
|
case "-exec", "-execdir", "-ok", "-okdir":
|
|
j := i + 1
|
|
for j < len(args) && args[j] != ";" && args[j] != "+" {
|
|
j++
|
|
}
|
|
nested = append(nested, classify(args[i+1:j], depth+1))
|
|
i = j
|
|
}
|
|
}
|
|
return risks, false, nested
|
|
}
|
|
|
|
func classifyIP(args []string) ([]Risk, bool, []Classification) {
|
|
var words []string
|
|
for i := 0; i < len(args); i++ {
|
|
a := args[i]
|
|
if strings.HasPrefix(a, "-") {
|
|
if a == "-n" || a == "-netns" || a == "-b" || a == "-batch" || a == "-rc" || a == "-rcvbuf" || a == "-f" || a == "-family" {
|
|
if a == "-b" || a == "-batch" {
|
|
return []Risk{RiskAdmin}, false, nil // ejecuta comandos de un archivo
|
|
}
|
|
i++
|
|
}
|
|
continue
|
|
}
|
|
words = append(words, a)
|
|
}
|
|
if len(words) < 2 {
|
|
return []Risk{RiskReadOnly}, false, nil
|
|
}
|
|
switch words[1] {
|
|
case "show", "list", "ls", "lst", "get", "help", "monitor", "sh", "s", "l":
|
|
return []Risk{RiskReadOnly}, false, nil
|
|
}
|
|
if words[0] == "netns" && (words[1] == "identify" || words[1] == "pids") {
|
|
return []Risk{RiskReadOnly}, false, nil
|
|
}
|
|
return []Risk{RiskAdmin}, false, nil
|
|
}
|
|
|
|
// firstNonFlag devuelve el primer argumento que no es una opción.
|
|
func firstNonFlag(args []string) string {
|
|
for _, a := range args {
|
|
if !strings.HasPrefix(a, "-") {
|
|
return a
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// skipFlags elimina opciones iniciales; las de valueFlags consumen un valor.
|
|
func skipFlags(args []string, valueFlags ...string) []string {
|
|
vf := set(valueFlags...)
|
|
i := 0
|
|
for i < len(args) {
|
|
a := args[i]
|
|
if a == "--" {
|
|
return args[i+1:]
|
|
}
|
|
if !strings.HasPrefix(a, "-") || a == "-" {
|
|
break
|
|
}
|
|
if vf[a] {
|
|
i++
|
|
}
|
|
i++
|
|
}
|
|
if i > len(args) {
|
|
return nil
|
|
}
|
|
return args[i:]
|
|
}
|
|
|
|
func hasAny(args []string, flags ...string) bool {
|
|
for _, a := range args {
|
|
for _, f := range flags {
|
|
if a == f || strings.HasPrefix(f, "--") && strings.HasPrefix(a, f+"=") {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func containsWord(args []string, words ...string) bool {
|
|
return hasAny(args, words...)
|
|
}
|
|
|
|
// onlyFlags informa si todos los argumentos que son opciones pertenecen a
|
|
// allowed (los valores no-opción se permiten, p.ej. nombres de cadena).
|
|
func onlyFlags(args []string, allowed ...string) bool {
|
|
al := set(allowed...)
|
|
for _, a := range args {
|
|
if strings.HasPrefix(a, "-") {
|
|
// Opciones combinadas tipo -nvL
|
|
if len(a) > 2 && a[1] != '-' {
|
|
for _, ch := range a[1:] {
|
|
if !al["-"+string(ch)] {
|
|
return false
|
|
}
|
|
}
|
|
continue
|
|
}
|
|
if !al[a] {
|
|
return false
|
|
}
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
// hasNonFlag indica si hay argumentos posicionales, ignorando los valores
|
|
// de las opciones valueFlags.
|
|
func hasNonFlag(args []string, valueFlags ...string) bool {
|
|
vf := set(valueFlags...)
|
|
for i := 0; i < len(args); i++ {
|
|
if vf[args[i]] {
|
|
i++
|
|
continue
|
|
}
|
|
if !strings.HasPrefix(args[i], "-") {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func hasNonFlagAfterVerb(args []string, verb string) bool {
|
|
seen := false
|
|
for _, a := range args {
|
|
if !seen {
|
|
seen = a == verb
|
|
continue
|
|
}
|
|
if !strings.HasPrefix(a, "-") {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|