vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-16 15:20:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Harden agent command policy for procfs reads

Browse source
This commit is contained in:
rcourtman 2026-04-22 09:27:54 +01:00
parent 242c4b432d
commit dd7912f5c2
2 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
internal/agentexec/policy.go
View file

@ -36,7 +36,8 @@ func DefaultPolicy() *CommandPolicy {
`^uptime$`,
`^hostname$`,
`^uname(\s|$)`,
`^cat\s+/proc/`,
`^cat\s+/proc/(cpuinfo|meminfo|loadavg|uptime|version|diskstats|mdstat|swaps|mounts|filesystems|partitions)$`,
`^cat\s+/proc/net/(dev|route|tcp|tcp6|udp|udp6|unix)$`,
`^cat\s+/etc/os-release`,
`^lsof(\s|$)`,
`^netstat(\s|$)`,
@ -197,6 +198,11 @@ func DefaultPolicy() *CommandPolicy {
// Clear system logs
`>\s*/var/log/`,
`truncate.*--size.*0.*/var/log/`,
// Sensitive procfs reads can expose credentials or kernel memory.
`^cat\s+/proc/(kcore|kallsyms|keys|timer_list|sched_debug)(\s|$)`,
`^cat\s+/proc/(self|[0-9]+)/(environ|mem)(\s|$)`,
`^cat\s+/proc/(self|[0-9]+)/(fd|fdinfo|root)(/|\s|$)`,
},
}

13
internal/agentexec/policy_test.go
View file

@ -20,8 +20,12 @@ func TestDefaultPolicyEvaluate(t *testing.T) {
{"blocked", "rm -rf /", PolicyBlock},
{"blocked sudo", "sudo rm -rf /", PolicyBlock},
{"blocked sudo with flags", "sudo -u root rm -rf /", PolicyBlock},
{"blocked proc environ", "cat /proc/self/environ", PolicyBlock},
{"blocked proc kcore", "cat /proc/kcore", PolicyBlock},
{"auto approve", "df -h", PolicyAllow},
{"auto approve safe proc meminfo", "cat /proc/meminfo", PolicyAllow},
{"require approval", "systemctl restart nginx", PolicyRequireApproval},
{"generic proc read requires approval", "cat /proc/1/status", PolicyRequireApproval},
{"unknown defaults to approval", "echo hello", PolicyRequireApproval},
{"sudo with flags remains conservative", "sudo -u root df -h", PolicyRequireApproval},
{"compound command requires approval", "df -h && echo ok", PolicyRequireApproval},
@ -57,10 +61,19 @@ func TestPolicyHelpers(t *testing.T) {
if !p.IsBlocked("sudo -u root rm -rf /") {
t.Fatalf("expected sudo -u root rm -rf / to be blocked")
}
if !p.IsBlocked("cat /proc/self/environ") {
t.Fatalf("expected cat /proc/self/environ to be blocked")
}
if !p.NeedsApproval("echo hello") {
t.Fatalf("expected echo hello to require approval by default")
}
if !p.NeedsApproval("cat /proc/1/status") {
t.Fatalf("expected cat /proc/1/status to require approval")
}
if !p.IsAutoApproved("df -h") {
t.Fatalf("expected df -h to be auto approved")
}
if !p.IsAutoApproved("cat /proc/meminfo") {
t.Fatalf("expected cat /proc/meminfo to be auto approved")
}
}