rpm-chksec

#!/bin/sh
# rpm-chksec
#
# Copyright (c) 2011-2013,2016 Steve Grubb. ALL RIGHTS RESERVED.
# sgrubb@redhat.com
#
# This software may be freely redistributed under the terms of the GNU
# public license.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
# Given an rpm, it will look at each file to check that its compiled with 
# the intended flags to make it more secure. Things that are green are OK.
# Anything in yellow could be better but is passable. Anything in red needs
# attention.
#
# If the --all option is given, it will generate a list of rpms and then
# summarize the rpm's state. For yes, then all files are in the expected
# state. Just one file not compiled with the right flags can turn the
# answer to no. Re-run passing that package (instead of --all) for the details.
#
# To save to file: ./rpm-chksec | sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g" | tee output.txt

VERSION="0.5.3"

usage () {
	echo "rpm-chksec [--version|--all|<rpmname>...]"
	if [ ! -x /usr/bin/filecap ] ; then
		echo "You need to install libcap-ng-utils to test capabilities"
	fi
	if [ $EUID != 0 ] ; then
		echo "You might need to be root to read some files"
	fi
	exit 0
}

if [ "$1" = "--help" -o $# -eq 0 ] ; then
	usage
fi
if [ "$1" = "--version" ] ; then
	echo "rpm-chksec $VERSION"
	exit 0
fi
rpm -q "$1" >/dev/null 2>&1
if [ $? -ne 0 ] ; then
	echo "$1 is not installed"
	exit 1
fi
if [ "$1" = "--all" ] ; then
	MODE="all"
else
	MODE="single"
fi

echo "Building tables..." >&2

# Look for daemons, need this for later...
DAEMON=""
for f in $files
do
	if [ ! -f "$f" ] ; then
		continue
	fi
	if [ `echo "$f" | grep '\/etc\/rc.d\/init.d'` ] ; then
		n=`basename "$f"`
	        t=`which "$n" 2>/dev/null`
        	if [ x"$t" != "x" ] ; then
                	DAEMON="$DAEMON $t"
	                continue
        	fi
	        t=`which "$n"d 2>/dev/null`
        	if [ x"$t" != "x" ] ; then
                	DAEMON="$DAEMON $t"
	                continue
        	fi
	        t=`cat "$f" 2>/dev/null | grep 'bin' | grep 'exit 5' | grep -v '\$'`
        	if [ x"$t" != "x" ] ; then
                	DAEMON="$DAEMON $t"
	                continue
        	fi
		if [ "$MODE" = "single" ] ; then
        		echo "Can't find the executable in $f but daemon rules would apply"
		fi
	elif [ `echo "$f" | grep '\/lib\/systemd\/'` ] ; then
		t=`cat "$f" | grep -i '^ExecStart=' | tr '=' ' ' | awk '{ print $2 }' | sed 's|^-||'`
		if [ x"$t" != "x" ] ; then
                	DAEMON="$DAEMON $t"
	                continue
        	fi
	fi
done

# Look for parsers of untrusted media...need this for later
UNTRUSTED1=""
rpms=`rpm -qa --queryformat "%{NAME}\n" | grep -Ev '\-devel|^perl|^python'`
for p in $rpms
do
	rpm -qi $p | grep -i 'librar' | grep -Ei 'image format files|rendering library|Adobe Flash|multimedia library|image files|codec|BMP|PPM|PCX|GIF|JPEG|PNG|SVG |MPEG4|h263|ac3|asf| avi|mjpeg|archive formats|bzip2|zip archives' >/dev/null 2>&1
	if [ $? -eq 0 ] ; then
		UNTRUSTED1="$UNTRUSTED1 `rpm -ql $p | grep -E '^\/lib|^\/usr\/lib'`"
	fi
done
UNTRUSTED=`echo "$UNTRUSTED1" | sort`

do_one () {
if ! rpm -q $1 >/dev/null 2>&1 ; then
	if [ "$MODE" = "single" ] ; then
		echo "$1 is not installed"
		exit 1
	else
		echo "not installed"
		return
	fi
fi
files=`rpm -ql $1`

# Prevent garbled output when doing --all.
skip_current=0

for f in $files
do
	if [ ! -f "$f" ] ; then
		continue
	fi
	# Some packages have files with ~ in them. This avoids it.
	if ! echo "$f" | grep '^/' >/dev/null ; then
		continue
	fi
	if [ ! -r "$f" ] && [ $EUID != 0 ] ; then
		if [ $MODE = "single" ] ; then
			echo "Please re-test $f as the root user"
		else
			# Don't print results.
			skip_current=1
			echo "Please re-test $1 as the root user"
		fi
		continue
	fi
	if ! file "$f" | grep -qw 'ELF'; then
		continue
	fi
	RELRO="no"
	if readelf -l "$f" 2>/dev/null | grep -q 'GNU_RELRO'; then
		RELRO="partial"
		if readelf -d "$f" 2>/dev/null | grep -q 'BIND_NOW'; then
			RELRO="full"
		fi
	fi
	PIE="no"
	if readelf -h "$f" 2>/dev/null | grep -q 'Type:[[:space:]]*DYN'; then
		PIE="DSO"
		if readelf -d "$f" 2>/dev/null | grep -q '(DEBUG)'; then
			PIE="yes"
		fi
	fi
	APP=""
	if [ x"$DAEMON" != "x" ] ; then
		for d in $DAEMON
		do
			if [ "$f" = "$d" ] ; then
				APP="daemon"
				break
			fi
		done
	fi
	if [ x"$APP" = "x" ] ; then
		# See if this is a library or a setuid app
		if [ `echo "$f" | grep '\/lib' | grep '\.so'` ] ; then
			APP="library"
		elif [ `find "$f" -perm -004000 -type f -print` ] ; then
			APP="setuid"
		elif [ `find "$f" -perm -002000 -type f -print` ] ; then
			APP="setgid"
		elif [ -x /usr/bin/filecap ] && [ `filecap "$f" 2> /dev/null | wc -w` -gt 0 ] ; then
			APP="setcap"
		else
			syms1=`/usr/bin/readelf -sW "$f" 2>/dev/null | grep -E ' connect@.*GLIBC| listen@.*GLIBC| accept@.*GLIBC|accept4@.*GLIBC'`
			syms2=`/usr/bin/readelf -sW "$f" 2>/dev/null | grep -E ' getaddrinfo@.*GLIBC| getnameinfo@.*GLIBC| getservent@.*GLIBC| getservbyname@.*GLIBC| getservbyport@.*GLIBC|gethostbyname@.*GLIBC| gethostbyname2@.*GLIBC|  gethostbyaddr@.*GLIBC|  gethostbyaddr2@.*GLIBC'`
			if [ x"$syms1" != "x" ] ; then
				if [ x"$syms2" != "x" ] ; then
					APP="network-ip"
				else
					APP="network-local"
				fi
			fi
		fi
	fi
	if [  x"$APP" = "x" -a x"$UNTRUSTED" != "x" ] ; then
		libs=`ldd $f 2> /dev/null | awk 'NF>2 { print $3 }'`
		for L in $libs
		do
			if [[ $UNTRUSTED =~ $L ]] ; then
				APP="media-app"
				break
			fi
		done
	fi
	if [ x"$APP" = "x" ] ; then
		APP="exec"
	fi

	# OK, ready for the output
	if [ "$MODE" = "single" ] ; then
		printf "%-56s %-10s  " "$f" $APP
		if [ "$APP" = "daemon" -o "$APP" = "setuid" -o "$APP" = "setgid" -o "$APP" = "setcap" -o "$APP" = "network-ip" -o "$APP" = "network-local" -o "$APP" = "untrusted-media" ] ; then
			if [ "$RELRO" = "full" ] ; then
				 printf "\033[32m%-7s\033[m  " $RELRO
			elif [ "$RELRO" = "partial" ] ; then
				printf "\033[33m%-7s\033[m  " $RELRO
			else
				printf "\033[31m%-7s\033[m  " $RELRO
			fi
			if [ "$PIE" = "yes" ] ; then
				printf "\033[32m%-4s\033[m" $PIE
			else
				printf "\033[31m%-4s\033[m" $PIE
			fi
		elif [ "$APP" = "library" ] ; then
			if [ "$RELRO" = "full" -o "$RELRO" = "partial" ] ; then
				 printf "\033[32m%-7s\033[m  " $RELRO
			else
				printf "\033[31m%-7s\033[m  " $RELRO
			fi
			printf "\033[32m%-4s\033[m" $PIE
		else
			# $APP = exec - we want partial relro
			if [ "$RELRO" = "no" ] ; then
				printf "\033[31m%-7s\033[m  " $RELRO
			else
				printf "\033[32m%-7s\033[m  " $RELRO
			fi
			printf "\033[32m%-4s\033[m" $PIE
		fi
		echo
	else
		if [ "$APP" = "daemon" -o "$APP" = "setuid" -o "$APP" = "setgid" -o "$APP" = "setcap" -o "$APP" = "network-ip" -o "$APP" = "network-local" ] ; then
			if [ "$RELRO" = "no" ] ; then
				RELRO_SUM="no"
				APP_SUM="$APP"
			fi
			if [ "$PIE" = "no" ] ; then
				PIE_SUM="no"
				APP_SUM="$APP"
			fi
		elif [ "$APP" = "library" ] ; then
			if [ "$RELRO" = "no" ] ; then
				RELRO_SUM="no"
				APP_SUM="$APP"
			fi
		# $APP = exec - must have partial or full relro
		elif [ "$RELRO" = "no" ] ; then
			RELRO_SUM="no"
			APP_SUM="$APP"
		fi
	fi
done
}

if [ "$MODE" = "single" ] ; then
	printf "%-56s %-10s  %-7s  %-4s" "FILE" "TYPE" "RELRO" "PIE"
	echo
	f=$(basename $1)
	# Strip the .rpm extension, if present.
	do_one ${f%%.rpm}
	exit 0
fi

# Skip the kernel as its special
packages=`rpm -qa --queryformat "%{NAME}.%{ARCH}\n" | grep -Ev 'kernel.|debuginfo.|.noarch|gpg-pubkey' | sort`
printf "%-50s  %-5s  %-4s  %-14s" "PACKAGE" "RELRO" "PIE" "CLASS"
echo
for p in $packages
do
	RELRO_SUM="yes"
	PIE_SUM="yes"
	APP_SUM=""
	printf "%-50s  " $p
	do_one $p
	if [[ $skip_current -eq 1 ]] ; then
		continue
	fi
	if [ "$RELRO_SUM" = "yes" ] ; then
		printf "\033[32m%-5s\033[m  " "$RELRO_SUM"
	else
		printf "\033[31m%-5s\033[m  " "$RELRO_SUM"
	fi
	if [ "$PIE_SUM" = "yes" ] ; then
		printf "\033[32m%-4s\033[m" "$PIE_SUM"
		if [ "$RELRO_SUM" = "no" ] ; then
			printf "  %-14s" "$APP_SUM"
		fi
	else
		if [ "$APP_SUM" = "network-local" ] ; then
			printf "\033[33m%-4s\033[m  %-14s" "$PIE_SUM" "$APP_SUM"
		else
			printf "\033[31m%-4s\033[m  %-14s" "$PIE_SUM" "$APP_SUM"
		fi
	fi
	echo
done
exit 0