priv-kweihmann / meta-dca

Layer for dynamic code analysis, profiling and security hardening

Table of content

• meta-dca
• Requirements
• How to use this layer
  • Additional notes
• Getting started
• Available modules
• Further documentation
• Get involved
• Security Policy

meta-dca

This layer is an addition to meta-sca. It enables dynamic code analysis, such as

• checking capabilties
• memleak checking
• files/path checking

These checks are suppose to be done on the build host only (using qemu/testimage support)

Requirements

You need the following to use meta-dca

• clang

• meta-sca

• openembedded

• poky

• a sufficient oeqa based test suite

• systemd set in DISTRO_FEATURES

How to use this layer

As the name implies, this layer uses dynamic code analysis to check certain (configurable features), so we have to execute the code that needs to be checked. Therefore we are using testimage provided by upstream poky. The checks itself will only be done when you execute bitbake <your-image-recipe> -c testimage. Results will be stored in the way meta-sca was configured for the build

Additional notes

It's highly recommended to

• enable KVM support (QEMU_USE_KVM = "1")
• have at least 1G of RAM for QEMU (QB_MEM = "-m 1024")

Getting started

For a quick start how to use this layer see getting started guide

Available modules

module	purpose	more info
caplint	Identify needed capabilities of a systemd unit	https://github.com/iovisor/bcc
filelife	Find shortlived files written to non-volatile storage	https://github.com/iovisor/bcc
filemiss	Find inaccessible files	https://github.com/iovisor/bpftrace
opensnoop	Lint ReadOnlyPaths/ReadWritePaths settings of a systemd unit	https://github.com/iovisor/bpftrace

Further documentation

• Global Configuration
  • filelife

Get involved

To get involved following things can be done

• create an issue
• fix an issue and create a pull request
• see the pinned issues in the bugtracker

Security Policy

For the project's security policy please see here

meta-dca's Issues

alter kernel configuration only if at least one dca module is active

preserve the originally used kernel configuration, if no module is active

feature: deadlock detection

Use https://github.com/iovisor/bcc/blob/master/tools/deadlock.py to detect (optential) deadlocks on a systemd unit

feature: Vailyn

Is your feature request related to a problem? Please describe.
Vailyn is a multi-phased vulnerability analysis and exploitation tool for path traversal/directory climbing vulnerabilities - and as path traversal bugs shouldn't happen anymore in 2020, give this tool a try (maybe using the cross-qemu-image tooling)

Describe a tool that might help here
https://github.com/VainlyStrain/Vailyn

feature: fuxploider

https://github.com/almandin/fuxploider sounds like a good idea to have for testing webservers

seccomp-tools

Is your feature request related to a problem? Please describe.

Provide powerful tools for seccomp analysis

Describe a tool that might help here
https://github.com/david942j/seccomp-tools

feature: files&paths monitoring

Use https://github.com/iovisor/bpftrace/blob/master/tools/opensnoop.bt to detect the necessary r/o and r/w paths of a system unit and warning on mismatches

Hardknott and honnister comp of the layer

feature: monitor setuid calls

Use https://github.com/iovisor/bpftrace/blob/master/tools/setuids.bt to monitor any setuid calls of a system unit (in theory a unit shall not do any)

feature: monitor short lived files

Use https://github.com/iovisor/bcc/blob/master/tools/filelife.py to catch short-lived files, which are NOT written to a ramdisk based mount path

Convert to new override syntax

feature: dr.memory

Try using https://dynamorio.org/drmemory_docs/index.html to detect memleaks

feature: webscan target with Sitadel

Using https://github.com/shenril/Sitadel to scan the target for vulnerabilities

feature: tracee

https://github.com/aquasecurity/tracee

Tracee is a Runtime Security and forensics tool for Linux. It is using Linux eBPF technology to trace your system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns. It is delivered as a Docker image that monitors the OS and detects suspicious behavior based on a pre-defined set of behavioral patterns

feature: openvas

Use openvas to check an image (https://github.com/greenbone/openvas-scanner)

feature: LFISuite

https://github.com/D35m0nd142/LFISuite looks like something for do some valuable security scanning

feature: memleak detection

Enable usage of https://github.com/iovisor/bcc/blob/master/tools/memleak.py

feature: identify files that are not accessable

for instance due to missing permissions or simply because they are not present in the system.
Each cause should get its own error ID.

use SCA_SPARE_LAYER and sca-blacklist settings

...to filter out services that don't need to be monitored