1071285 - [mig modules] filechecker support for verifying file permissions/mode

Status: RESOLVED FIXED

(Enterprise Information Security Graveyard :: MIG, task)

Description

[Guillaume Destuynder [:kang] [this account is no longer active]]

The use case is to check if file X has mode Z such as:
/etc/password is 0644 root:root
/etc/shadow is 0640 or 0600 root:root

/home/*/.ssh/authorized_keys is 0600 

etc.

Bonus questions:
- is anything in /* 777?
- is anything in /* setuid?

etc.

Comment 1

[Julien Vehent]

This is a common request and should be added soon.

New search types can be added to the search struct at https://github.com/mozilla/mig/blob/master/src/mig/modules/filechecker/filechecker.go#L57
I would propose to map the FileInfo struct from the golang os package: http://golang.org/pkg/os/#FileInfo

    16	type FileInfo interface {
    [...]
    18		Size() int64        // length in bytes for regular files; system-dependent for others
    19		Mode() FileMode     // file mode bits
    20		ModTime() time.Time // modification time
    [...]

which would map to adding the following types (note that all integer values are stored in float64 for json convertion).

- Sizes [][]float64, where each item contains a min and max size
  example: [[1024, 8192]] would find all files that have a size between 1kB and 8kB

- Modes []float64, where each item contains a valid FileMode
  example: [0640, 0777] would find all files with the permissions 640 or 777

- ModTimes [][]time.Time, where each item contains a before and after date
  example: [["Mon Sep 22 9:23pm UTC", "Tue Sep 23 9:23pm UTC"] would find all files modified during that interval

Comment 2

[Julien Vehent]

Fixed in https://github.com/mozilla/mig/commit/d8c61f2efd11f160bdb34e3850a40b7a724ce6a1 as part of the rewrite of filechecker into file module.