privexec

const (
	// Firewall — the biggest gap measured: 76% of this section is lost
	// without privilege, including every rule count and both default policies.
	FirewallIptablesSave     ID = "firewall.iptables_save"
	FirewallNftListRuleset   ID = "firewall.nft_list_ruleset"
	FirewallUfwStatusVerbose ID = "firewall.ufw_status_verbose"

	// systemd — measured: these three lose data as an unprivileged user.
	SystemdDefaultTarget ID = "systemd.default_target"
	SystemdFailedUnits   ID = "systemd.failed_units"
	SystemdListTimers    ID = "systemd.list_timers"

	// Services — measured: nginx loses its whole TLS posture without this.
	NginxDumpConfig ID = "nginx.dump_config"

	// SSHDumpConfig is the effective sshd configuration, which only sshd itself
	// can work out: it is the main file, plus every drop-in, plus the built-in
	// defaults, resolved in the order sshd applies them. Reading sshd_config
	// would answer a different question and answer it wrongly — a drop-in shipped
	// by cloud-init routinely overrides what that file says.
	SSHDumpConfig ID = "ssh.dump_config"

	// Scheduling — found by tracing, not by scanning: this one hides inside a
	// [][]string literal and no search for exec.Command would show it.
	CrontabListRoot ID = "cron.crontab_list_root"
	CrontabListSelf ID = "cron.crontab_list_self"

	// Privileged reads, every one a command a reviewer already knows.
	//
	// These used to be `ghostpsy read-shadow` and friends: our own binary,
	// printing a summary. It was safe, and it was unreadable. A security team
	// auditing /etc/sudoers.d/ghostpsy could not tell what ran as root without
	// reading our source, and a team that has to read your source to approve you
	// does not approve you.
	//
	// So each one is now a standard command whose output is already safe to hand
	// over, and the counting happens afterwards, unprivileged. `passwd -S -a`
	// prints an account status per line and never a hash; that is the whole
	// argument, and it applies to all four.
	GrantFile ID = "read.grant_file"

	// ShadowAccountStatus and LastlogAll together answer what read-shadow did:
	// how many accounts are locked, how many have no password, how many have
	// never logged in. Neither prints password material of any kind.
	ShadowAccountStatus ID = "read.shadow_account_status"
	LastlogAll          ID = "read.lastlog_all"

	// SudoersText is every sudo rule on the host, with the file each came from.
	// `.` matches any non-empty line, so this is "print these files, numbered".
	SudoersText ID = "read.sudoers_text"

	// AuthorizedKeysFiles finds which accounts still have an SSH key, which is
	// what stops a hardening change locking the operator out of their own
	// server. /etc/passwd is world-readable, so the agent already knows the home
	// directories; the only thing it needs root for is whether the key file is
	// there and not empty.
	AuthorizedKeysFiles ID = "read.authorized_keys_files"

	// Services. Restarting, stopping and switching on are declared one command per
	// service in service.go, from the list of services ghostpsy actually configures —
	// `systemctl restart *` was a grant to restart anything on the machine.
	ServiceStatus    ID = "service.status"
	ServiceIsActive  ID = "service.is_active"
	ServiceIsEnabled ID = "service.is_enabled"

	// SSH. Checking the config before reloading is what stops a bad edit from
	// leaving a server nobody can log into.
	SSHTestConfig ID = "ssh.test_config"

	// Firewall, ufw — Debian and Ubuntu. `ufw --dry-run` is a real dry run: it
	// prints the exact rules it would install without installing them.
	UfwDryRunEnable    ID = "firewall.ufw_dry_run_enable"
	UfwDryRunAllowPort ID = "firewall.ufw_dry_run_allow_port"
	UfwAllowPort       ID = "firewall.ufw_allow_port"
	UfwEnable          ID = "firewall.ufw_enable"
	UfwDisable         ID = "firewall.ufw_disable"

	// Firewall, firewalld — the RHEL family. It has no dry run, so the preview
	// shows what is configured now and the run adds the port to the permanent
	// rules *before* the firewall starts.
	FirewalldState        ID = "firewall.firewalld_state"
	FirewalldListAll      ID = "firewall.firewalld_list_all"
	FirewalldAddPort      ID = "firewall.firewalld_add_port"
	FirewalldRemovePort   ID = "firewall.firewalld_remove_port"
	FirewalldReload       ID = "firewall.firewalld_reload"
	FirewalldRuntimePorts ID = "firewall.firewalld_runtime_ports"

	// Automatic security updates.
	UnattendedUpgradeDryRun ID = "updates.unattended_upgrade_dry_run"

	// Time. The package is named in the command, not passed to it — see the
	// declarations for why that matters.
	// Whether the clock daemon is running, asked of the process table rather than
	// of systemd. `systemctl is-active` cannot answer it on a machine that has no
	// systemd, and Ubuntu 14.04 is exactly the machine this action is for.
	NTPDaemonRunning    ID = "time.ntp_daemon_running"
	ChronyDaemonRunning ID = "time.chrony_daemon_running"

	AptInstallNTP            ID = "time.apt_install_ntp"
	AptSimulateInstallNTP    ID = "time.apt_simulate_install_ntp"
	DnfInstallChrony         ID = "time.dnf_install_chrony"
	DnfSimulateInstallChrony ID = "time.dnf_simulate_install_chrony"

	// Setting the clock, as opposed to installing something that will get round
	// to it. A freshly installed ntpd needs several poll cycles before it will
	// step a badly wrong clock, so a machine can be "fixed" and still be hours
	// out — which is a fix that reports success and leaves the finding standing.
	NTPServiceStop  ID = "time.ntp_service_stop"
	NTPServiceStart ID = "time.ntp_service_start"
	NTPStepClock    ID = "time.ntp_step_clock"
	ChronyStepClock ID = "time.chrony_step_clock"
)

const APTEffectiveConfig ID = "config.effective.apt"

const ReadSSHConfig ID = "config.read.sshd_config"

const SSHEffectiveConfig ID = "config.effective.sshd"