default profile checks SUID/SGID blacklist

Instead of going for the whitelist and expecting all other SUID/SGID bits to be removed, go for the blacklist in the default profile. This behavior is preferred, since we don't want to enable a search through all nodes on a system for any SUID/SGID bits by default. This search is desired and reasonable in all cases, but many new users will be turned away if we activate it by default. It causes issues with any regularly mounted network filesystems (which take very long) or very large (amount of entries on the filesystem) storage nodes.

We will add this point to the documentation, as it's the user's task to mount these components with a nosuid configuration.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

Author: arlimus

default/serverspec/os_spec.rb

@@ -62,57 +62,38 @@
 end
 
 # GIS: Req 3.21-12
-describe 'SUID/ SGID whitelist check' do
-  it 'found only whitelist suid/sgid' do
-    whitelist  = [
-      # whitelist as provided by NSA
-      '/bin/mount', '/bin/ping', '/bin/su', '/bin/umount', '/sbin/pam_timestamp_check',
-      '/sbin/unix_chkpwd', '/usr/bin/at', '/usr/bin/gpasswd', '/usr/bin/locate',
-      '/usr/bin/newgrp', '/usr/bin/passwd', '/usr/bin/ssh-agent', '/usr/libexec/utempter/utempter', '/usr/sbin/lockdev',
-      '/usr/sbin/sendmail.sendmail', '/usr/bin/expiry',
-      # whitelist ipv6
-      '/bin/ping6', '/usr/bin/traceroute6.iputils',
-      # whitelist nfs
-      '/sbin/mount.nfs', '/sbin/umount.nfs',
-      # whitelist nfs4
-      '/sbin/mount.nfs4', '/sbin/umount.nfs4',
-      # whitelist cron
-      '/usr/bin/crontab',
-      # whitelist consolemssaging
-      '/usr/bin/wall', '/usr/bin/write',
-      # whitelist: only SGID with utmp group for multi-session access
-      #            impact is limited; installation/usage has some remaining risk
-      '/usr/bin/screen',
-      # whitelist locate
-      '/usr/bin/mlocate',
-      # whitelist usermanagement
-      '/usr/bin/chage', '/usr/bin/chfn', '/usr/bin/chsh',
-      # whitelist fuse
-      '/bin/fusermount',
-      # whitelist pkexec
-      '/usr/bin/pkexec',
-      # whitelist sudo
-      '/usr/bin/sudo', '/usr/bin/sudoedit',
-      # whitelist postfix
-      '/usr/sbin/postdrop', '/usr/sbin/postqueue',
-      # whitelist apache
-      '/usr/sbin/suexec',
-      # whitelist squid
-      '/usr/lib/squid/ncsa_auth', '/usr/lib/squid/pam_auth',
-      # whitelist kerberos
-      '/usr/kerberos/bin/ksu',
-      # whitelist pam_caching
-      '/usr/sbin/ccreds_validate',
-      # whitelist Xorg
-      '/usr/bin/Xorg',                                              # xorg
-      '/usr/bin/X',                                                 # xorg
-      '/usr/lib/dbus-1.0/dbus-daemon-launch-helper',                # freedesktop ipc
-      '/usr/lib/vte/gnome-pty-helper',                              # gnome
-      '/usr/lib/libvte9/gnome-pty-helper',                          # gnome
-      '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome
+describe 'SUID/ SGID blacklist  check' do
+  it 'found no blacklisted suid/sgid' do
+    blacklist = [
+      # blacklist as provided by NSA
+      '/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
+      # sshd must not use host-based authentication (see ssh cookbook)
+      '/usr/libexec/openssh/ssh-keysign',
+      '/usr/lib/openssh/ssh-keysign',
+      # misc others
+      '/sbin/netreport',                                            # not normally required for user
+      '/usr/sbin/usernetctl',                                       # modify interfaces via functional accounts
+      # connecting to ...
+      '/usr/sbin/userisdnctl',                                      # no isdn...
+      '/usr/sbin/pppd',                                             # no ppp / dsl ...
+      # lockfile
+      '/usr/bin/lockfile',
+      '/usr/bin/mail-lock',
+      '/usr/bin/mail-unlock',
+      '/usr/bin/mail-touchlock',
+      '/usr/bin/dotlockfile',
+      # need more investigation, blacklist for now
+      '/usr/bin/arping',
+      '/usr/sbin/uuidd',
+      '/usr/bin/mtr',                                               # investigate current state...
+      '/usr/lib/evolution/camel-lock-helper-1.2',                   # investigate current state...
+      '/usr/lib/pt_chown',                                          # pseudo-tty, needed?
+      '/usr/lib/eject/dmcrypt-get-device',
+      '/usr/lib/mc/cons.saver'                                      # midnight commander screensaver
     ]
+
     actual = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'').stdout.split(/\r?\n/)
-    (actual - whitelist).count.should be 0
+    (actual & blacklist).count.should be 0
   end
 end