search

microsoft / AttackSurfaceAnalyzer

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
MIT License
2.73k stars 277 forks source link

AppImage for ASA - Linux Environment #720

Open otamrll09 opened 1 week ago

otamrll09 commented 1 week ago

Hello everyone!

I would like to know if there is a possibility to create an AppImage (https://appimage.org/) of this project.

I believe it would be of great benefit since it will allow greater compatibility between distributions, but I understand that it may not be possible due to the analyses that the tool performs in the environment. Therefore, I would like to know your opinion about this and if there is the possibility of creating the AppImage of the tool.

gfs commented 1 week ago

Hi @otamrll09,

Thanks for your suggestion. It is not on our roadmap to create an appimage but you should be able to run ASA wherever .NET is supported (https://learn.microsoft.com/en-us/dotnet/core/install/linux) using the dotnet tool install command (dotnet tool install -g Microsoft.CST.AttackSurfaceAnalyzer.CLI). I'm further not sure if the appimage sandboxing would interfere with some of ASA collection techniques for linux which can involve parsing output from built-in linux utilities and of course the root file system.

It does look like it may be possible to create an appimage for a .NET program, for example, for example, with this project (no affiliation or endorsement implied: https://github.com/kuiperzone/PupNet-Deploy). This looks like something you could do if you had a specific need for support on a distribution where .NET doesn't run on the underlying OS, but we don't currently have any plans to maintain more distribution mechanisms and would be unlikely to be able to provide much support if you ran into appimage sandboxing related difficulties.