oblitorum
commented
1 year ago I'm gonna combine all of them into one file, is this looks ok? Example log artifact logs/security-audit-scanning.log:
rkhunter scanning
=================
Warning: Checking for prerequisites [ Warning ]
The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --propupd'.
Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
is used, all the files on their system are known to be genuine, and installed from a
reliable source. The rkhunter '--check' option will compare the current file properties
against previously stored values, and report if any values differ. However, rkhunter
cannot determine what has caused the change, that is for the user to do.
Warning: The command '/usr/bin/egrep' has been replaced by a script: /usr/bin/egrep: POSIX shell script, ASCII text executable
Warning: The command '/usr/bin/fgrep' has been replaced by a script: /usr/bin/fgrep: POSIX shell script, ASCII text executable
Warning: The kernel modules directory '/lib/modules' is missing or empty.
Warning: No running system logging daemon has been found.
clamav scanning
===============
/tmp/xxx.tar: (HEX)XXX.TEST.3.UNOFFICIAL FOUND
/tmp/xxx.cab: (HEX)XXX.TEST.3.UNOFFICIAL FOUNDnote: files not owned by any package and flagged by vt will be append to the end of the log artifact file.
gordan-bobic
Add a build feature that performs a verifivation of packages from RPMs to reduce scanning burden and extend scanning. Get full list of packages: rpm -qa For each package, rpm --verify
Anything that gets reported means the checksum doesn't match what is in the package.
This list should be a separate build log artifact that can be manually checked.
ONLY for the files that: 1) fail the checksum OR 2) get flagged by clamscan or rkhunter 3) aren't owned by any package (get all files using find then for each file check what package owns it using rpm -qf filename, if rpm says nothing owns it, add to the list)
add scanning using virustotal.
Reason for limiting virustotal scanning is because we only have a standard account which limits us to 4 requests per minute / 500 requests per day / 15,500 requests per month. So we only want to scan things that have some indication of possibility of something not being quite right.
You can get VT packages from here (rebuild on aarch64 if necessary): https://ftp.redsleeve.org/pub/misc/vt/
VT api key was forwarded privately. Make sure this doesn't make it into anything pushed into git repositories.
To scan using vt:
vt scan file /path/to/file that submits it, but it doesn't block until it is scanned. It will return a hash. You then check every 10 seconds using:
vt analysis big_long_hash_returned_above
Build time audit log artifact for human operator review should include:
1) Files not owned by any package (simple list) 2) Files flagged by clamscan (full output for each file flagged) 3) Files flagged by rkhunter (output for each file flagged) 4) Files flagged by vt (full output for each file where malicious or suspicious flags returned by vt analysisare greater than 0