342 lines
10 KiB
Go
342 lines
10 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
capabilities.go
|
|
|
|
Linux capability definitions with severity ratings and fast lookup
|
|
functions
|
|
|
|
Capabilities maps all 41 Linux capabilities (CAP_CHOWN through
|
|
CAP_CHECKPOINT_RESTORE) to severity ratings and descriptions. Pre-
|
|
computed sets (dangerousCapabilities, criticalCapabilities) enable
|
|
O(1) lookups during scanning without iterating the full map.
|
|
|
|
Key exports:
|
|
Capabilities - map of capability name to severity and description
|
|
IsDangerousCapability - true if severity >= HIGH
|
|
IsCriticalCapability - true if severity == CRITICAL
|
|
GetCapabilityInfo, GetCapabilitySeverity - lookup by name
|
|
|
|
Connects to:
|
|
finding.go - uses Severity constants
|
|
analyzer/container.go - classifies cap_add entries from container
|
|
inspect
|
|
analyzer/compose.go - classifies cap_add entries from compose services
|
|
proc/capabilities.go - uses IsDangerousCapability, IsCriticalCapability
|
|
*/
|
|
|
|
package rules
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/CarterPerez-dev/docksec/internal/finding"
|
|
)
|
|
|
|
type CapabilityInfo struct {
|
|
Severity finding.Severity
|
|
Description string
|
|
}
|
|
|
|
var Capabilities = map[string]CapabilityInfo{
|
|
// CAP 0 - File Ownership
|
|
"CAP_CHOWN": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Change file ownership. Can take ownership of any file, bypassing normal permission checks.",
|
|
},
|
|
|
|
// CAP 1 - DAC Override
|
|
"CAP_DAC_OVERRIDE": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Bypass file read, write, and execute permission checks. Complete filesystem access.",
|
|
},
|
|
|
|
// CAP 2 - DAC Read Search
|
|
"CAP_DAC_READ_SEARCH": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Bypass file read permission checks and directory read/execute checks. Read any file.",
|
|
},
|
|
|
|
// CAP 3 - File Owner Override
|
|
"CAP_FOWNER": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Bypass permission checks on operations requiring file owner UID match. Modify any file metadata.",
|
|
},
|
|
|
|
// CAP 4 - File Set-ID
|
|
"CAP_FSETID": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Don't clear set-user-ID and set-group-ID bits when a file is modified. Preserve SUID/SGID.",
|
|
},
|
|
|
|
// CAP 5 - Kill Processes
|
|
"CAP_KILL": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Send signals to arbitrary processes. Bypass permission checks for kill().",
|
|
},
|
|
|
|
// CAP 6 - Set GID
|
|
"CAP_SETGID": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Make arbitrary manipulations of process GIDs. Privilege escalation risk via group changes.",
|
|
},
|
|
|
|
// CAP 7 - Set UID
|
|
"CAP_SETUID": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Make arbitrary manipulations of process UIDs. Direct privilege escalation to root.",
|
|
},
|
|
|
|
// CAP 8 - Set Process Capabilities
|
|
"CAP_SETPCAP": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Modify process capabilities. Can grant new capabilities to self or child processes.",
|
|
},
|
|
|
|
// CAP 9 - Linux Immutable
|
|
"CAP_LINUX_IMMUTABLE": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Set the immutable and append-only file attributes. Can prevent file modification/deletion.",
|
|
},
|
|
|
|
// CAP 10 - Bind Privileged Ports
|
|
"CAP_NET_BIND_SERVICE": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Bind to privileged ports (below 1024). Required for most server applications.",
|
|
},
|
|
|
|
// CAP 11 - Network Broadcast
|
|
"CAP_NET_BROADCAST": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Send broadcast packets and listen to multicast. Can flood network segments.",
|
|
},
|
|
|
|
// CAP 12 - Network Administration
|
|
"CAP_NET_ADMIN": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Perform network administration operations. Modify routing, firewall rules, sniff traffic, MITM attacks.",
|
|
},
|
|
|
|
// CAP 13 - Raw Network Access
|
|
"CAP_NET_RAW": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Use RAW and PACKET sockets. Craft arbitrary packets, ARP/DNS spoofing, packet sniffing.",
|
|
},
|
|
|
|
// CAP 14 - IPC Lock Memory
|
|
"CAP_IPC_LOCK": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Lock memory (mlock, mlockall). Prevent swapping of sensitive data, DoS via memory exhaustion.",
|
|
},
|
|
|
|
// CAP 15 - IPC Owner Override
|
|
"CAP_IPC_OWNER": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Bypass permission checks for IPC operations. Access any shared memory, semaphores, message queues.",
|
|
},
|
|
|
|
// CAP 16 - Kernel Module Operations
|
|
"CAP_SYS_MODULE": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Load and unload kernel modules. Full kernel access, rootkit installation, complete system compromise.",
|
|
},
|
|
|
|
// CAP 17 - Raw I/O Operations
|
|
"CAP_SYS_RAWIO": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Perform raw I/O port operations and access /dev/mem, /dev/kmem. Direct hardware and kernel memory access.",
|
|
},
|
|
|
|
// CAP 18 - Chroot
|
|
"CAP_SYS_CHROOT": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Use chroot. Essential for container operations but can be used in escape techniques.",
|
|
},
|
|
|
|
// CAP 19 - Process Trace
|
|
"CAP_SYS_PTRACE": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Trace arbitrary processes using ptrace. Read/write memory of any process, inject code, steal secrets.",
|
|
},
|
|
|
|
// CAP 20 - Process Accounting
|
|
"CAP_SYS_PACCT": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Configure process accounting. Enable/disable accounting, access accounting data.",
|
|
},
|
|
|
|
// CAP 21 - System Administration
|
|
"CAP_SYS_ADMIN": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Perform a range of system administration operations. Effectively root - mount filesystems, quotas, namespaces, etc.",
|
|
},
|
|
|
|
// CAP 22 - System Reboot
|
|
"CAP_SYS_BOOT": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Reboot the system and use kexec_load. DoS via system restart.",
|
|
},
|
|
|
|
// CAP 23 - Process Scheduling
|
|
"CAP_SYS_NICE": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Modify process nice values, scheduling policy, and CPU affinity. DoS via resource starvation, RT priority escalation.",
|
|
},
|
|
|
|
// CAP 24 - Resource Limits Override
|
|
"CAP_SYS_RESOURCE": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Override resource limits (RLIMIT_*). Exhaust system resources, bypass quotas and limits.",
|
|
},
|
|
|
|
// CAP 25 - System Time
|
|
"CAP_SYS_TIME": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Set system clock and real-time hardware clock. Break logging, certificates, time-based authentication.",
|
|
},
|
|
|
|
// CAP 26 - TTY Configuration
|
|
"CAP_SYS_TTY_CONFIG": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Configure tty devices using vhangup. Limited security impact.",
|
|
},
|
|
|
|
// CAP 27 - Create Special Files
|
|
"CAP_MKNOD": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Create special files using mknod. Create device nodes for /dev/mem, /dev/sda access.",
|
|
},
|
|
|
|
// CAP 28 - File Leases
|
|
"CAP_LEASE": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Establish leases on arbitrary files. Limited security impact.",
|
|
},
|
|
|
|
// CAP 29 - Audit Write
|
|
"CAP_AUDIT_WRITE": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Write records to kernel audit log. Inject false audit entries to cover tracks.",
|
|
},
|
|
|
|
// CAP 30 - Audit Control
|
|
"CAP_AUDIT_CONTROL": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Enable/disable kernel auditing and modify audit rules. Hide malicious activity completely.",
|
|
},
|
|
|
|
// CAP 31 - File Capabilities
|
|
"CAP_SETFCAP": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Set file capabilities on executables. Grant elevated privileges to any binary.",
|
|
},
|
|
|
|
// CAP 32 - MAC Override
|
|
"CAP_MAC_OVERRIDE": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Override Mandatory Access Control for specific operations. Bypass SELinux/AppArmor policies.",
|
|
},
|
|
|
|
// CAP 33 - MAC Administration
|
|
"CAP_MAC_ADMIN": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Configure or modify MAC policy (SELinux, AppArmor, Smack). Disable mandatory access controls entirely.",
|
|
},
|
|
|
|
// CAP 34 - Syslog Operations
|
|
"CAP_SYSLOG": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Perform privileged syslog operations. Read kernel ring buffer, clear logs, information disclosure.",
|
|
},
|
|
|
|
// CAP 35 - Wake Alarm
|
|
"CAP_WAKE_ALARM": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Trigger system wake events using RTC timers. Limited security impact.",
|
|
},
|
|
|
|
// CAP 36 - Block System Suspend
|
|
"CAP_BLOCK_SUSPEND": {
|
|
Severity: finding.SeverityLow,
|
|
Description: "Block system suspend and hibernation. DoS via power management interference.",
|
|
},
|
|
|
|
// CAP 37 - Audit Read
|
|
"CAP_AUDIT_READ": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Read kernel audit logs. Information disclosure of security events and user activity.",
|
|
},
|
|
|
|
// CAP 38 - Performance Monitoring
|
|
"CAP_PERFMON": {
|
|
Severity: finding.SeverityMedium,
|
|
Description: "Access performance monitoring and observability operations. Profile system behavior, side-channel attacks.",
|
|
},
|
|
|
|
// CAP 39 - BPF Operations
|
|
"CAP_BPF": {
|
|
Severity: finding.SeverityCritical,
|
|
Description: "Load BPF programs and create BPF maps. Trace all syscalls, modify network traffic, kernel-level monitoring.",
|
|
},
|
|
|
|
// CAP 40 - Checkpoint/Restore
|
|
"CAP_CHECKPOINT_RESTORE": {
|
|
Severity: finding.SeverityHigh,
|
|
Description: "Checkpoint and restore processes using CRIU. Access process memory, file descriptors, and state.",
|
|
},
|
|
}
|
|
|
|
// Pre computed sets for fast lookup
|
|
var dangerousCapabilities = func() map[string]struct{} {
|
|
m := make(map[string]struct{})
|
|
for cap, info := range Capabilities {
|
|
if info.Severity >= finding.SeverityHigh {
|
|
m[cap] = struct{}{}
|
|
m[strings.TrimPrefix(cap, "CAP_")] = struct{}{}
|
|
}
|
|
}
|
|
return m
|
|
}()
|
|
|
|
var criticalCapabilities = func() map[string]struct{} {
|
|
m := make(map[string]struct{})
|
|
for cap, info := range Capabilities {
|
|
if info.Severity == finding.SeverityCritical {
|
|
m[cap] = struct{}{}
|
|
m[strings.TrimPrefix(cap, "CAP_")] = struct{}{}
|
|
}
|
|
}
|
|
return m
|
|
}()
|
|
|
|
func normalizeCapability(cap string) string {
|
|
normalized := strings.ToUpper(strings.TrimSpace(cap))
|
|
if !strings.HasPrefix(normalized, "CAP_") {
|
|
normalized = "CAP_" + normalized
|
|
}
|
|
return normalized
|
|
}
|
|
|
|
func IsDangerousCapability(cap string) bool {
|
|
normalized := strings.ToUpper(strings.TrimSpace(cap))
|
|
_, exists := dangerousCapabilities[normalized]
|
|
return exists
|
|
}
|
|
|
|
func IsCriticalCapability(cap string) bool {
|
|
normalized := strings.ToUpper(strings.TrimSpace(cap))
|
|
_, exists := criticalCapabilities[normalized]
|
|
return exists
|
|
}
|
|
|
|
func GetCapabilityInfo(cap string) (CapabilityInfo, bool) {
|
|
info, ok := Capabilities[normalizeCapability(cap)]
|
|
return info, ok
|
|
}
|
|
|
|
func GetCapabilitySeverity(cap string) finding.Severity {
|
|
if info, ok := GetCapabilityInfo(cap); ok {
|
|
return info.Severity
|
|
}
|
|
return finding.SeverityLow
|
|
}
|