search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
852 stars 173 forks source link

Exclude autofs by default #194

Closed luyseyal closed 2 years ago

luyseyal commented 2 years ago

Frequently, nfs and other remote filesystems are masqueraded by the filesystem type autofs. Please exclude autofs by default.

Thank you!

Great little program!

jgstew commented 2 years ago

is it safe to assume autofs is always a remote network location?

In my teams testing of the utility we knew auto mounts were a potential problem but we didn't have any in our lab environments so we were trying to figure out how to exclude it automatically using the --exclude and/or --exclude-fs option and a lookup but wasn't sure what to look for, but I think you just hit on it, probably autofs. Just curious if this could exclude things it shouldn't in some edge cases?

xeraph commented 2 years ago

Since I have decided to scan only fixed media by default, I will add autofs to ignore list.

jgstew commented 2 years ago

We got an ask from the field of people testing this utility that afs also get added to ignored / excluded by default because it is not right now:

We also will add it to our custom exclude list regardless, but just wanted to mention it.

"I have decided to scan only fixed media by default" - this is the right call. You generally only want to scan network drives very very carefully, selectively, and ideally from only a single point. Even better if it can be the host that shares the drives from it's own "local" storage, though that is not always possible.

mpentenr commented 2 years ago

Hi, how do I deactivate the automatic excludes if I want for example scan on nfs mounted drives ? Is there an --include option which deativates the automatic excludes ?

Thanks Marc

xeraph commented 2 years ago

@luyseyal @jgstew Would you test v2.6.0 release? @mpentenr Just override using --exclude-fs option. For example, --exclude-fs tmpfs,devtmpfs. If you want to scan all partitions, use --exclude-fs none.