Automatically creating security profiles for applications

help
1

Hi there,

I am writing some cmd tools and systemd services for internal usage and I am thinking a bit about security stuff. To run these programs, I need to provide different permissions and capabilities, e.g. process prio, on which core to run, interface (ethtool settings), read/write access to files on the system.

What I'd like to know is, if it is possible/practical to automate the process of creating the permissions and constraints for those programs. The idea was like annotating functions in a library that need those permissions and then somehow collect that information and create the best possible settings that I then can use in systemd unit files, postinst scripts or apparmor profiles. The library with functions should be written once, but the resulting security settings can be different for each program.

What are good ways to achieve that? Maybe there are other ways to do that?
Thanks

2

No one any idea, or is this not feasible?

3

I was working once on Java project with comparable goal (scan Java applet code which system library functions it calls, detect any possible unsafe calls). This was possible to implement by building the database of system and external library functions/methods with their safety ratings (manually curated). Later we forked the OpenJDK compiler and modified it to report all method invocations while compiling the code, including the package name. In most of the cases, safety rating was given per package, not per individual function. Same way, in Rust we could rate per crate or per module.

Maybe something comparable can be done with syn. Of course, the name of the method does not say alone where does it belong, this depends a lot on the context, imports, crates can be renamed, so quite deep language parsing is needed.

I think annotations would not help because most of the libraries you would use do not contain them.

4

Hi, thanks for your answer. I was thinking something like having functions like this somewhere, which means in an internal library:

/// Sets process prio, needs 
#[requires(cap=cap_sys_nice)]
fn set_process_prio() {...}

/// Reads config
#[requires(fs_read=/etc/{crate}/{bin}/config.json)]
fn read_config() -> Config{...}

And then some mechanism running at some time (build, test, compile time, pre package build time) would check which functions are used and creates a list of needed capabilities, permissions and limits all other permissions. So I don't really need this for all std functions, I am ok with creating my own internal lib, or at least a something like a decorator that I can use in the application.

Claude hintet at something like inventory. This is a crate, that creates an inventory that I can read out, but at runtime. But for that I would have to create another application with all those functions in it. It's then just easier to manage a list with those permissions by hand for every application.

I just thought maybe someone knows some trick for stuff like that. Build scripts do not really help, I think, because they are only able to write into OUT_DIR, which we don't know from dependencies.