57 lines
1.7 KiB
SQL
57 lines
1.7 KiB
SQL
-- Find unexpected world readable run locks
|
|
--
|
|
-- false positives:
|
|
-- * none known
|
|
--
|
|
-- references:
|
|
-- * https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game
|
|
--
|
|
-- tags: persistent filesystem state seldom
|
|
-- platform: posix
|
|
SELECT
|
|
*,
|
|
CONCAT (
|
|
MIN(file.uid, 500),
|
|
",",
|
|
file.gid,
|
|
",",
|
|
file.path,
|
|
",",
|
|
file.type,
|
|
',',
|
|
mode
|
|
) AS exception_key
|
|
FROM
|
|
file
|
|
WHERE
|
|
(
|
|
path LIKE "/tmp/%.lock"
|
|
OR path LIKE "/var/run/%.lock"
|
|
OR path LIKE "/var/tmp/%.lock"
|
|
OR path LIKE "/dev/shm/%.lock"
|
|
OR path LIKE "/dev/mqueue/%.lock"
|
|
OR path LIKE "/tmp/.%.lock"
|
|
OR path LIKE "/var/run/.%.lock"
|
|
OR path LIKE "/var/tmp/.%.lock"
|
|
OR path LIKE "/dev/shm/.%.lock"
|
|
OR path LIKE "/dev/mqueue/.%.lock"
|
|
)
|
|
AND exception_key NOT IN (
|
|
'0,0,/var/run/apport.lock,regular,0600',
|
|
'0,0,/var/run/dnf-metadata.lock,regular,0644',
|
|
'0,0,/var/run/ublue-update.lock,regular,0755',
|
|
'0,0,/var/run/ufw.lock,regular,0644',
|
|
'0,0,/var/run/unattended-upgrades.lock,regular,0640',
|
|
'0,0,/var/run/xtables.lock,regular,0600',
|
|
'0,1,/var/run/VMware Fusion Services.lock,regular,0600',
|
|
'500,0,/tmp/mysql.sock.lock,regular,0600',
|
|
'500,0,/tmp/mysqlx.sock.lock,regular,0600',
|
|
'500,1000,/tmp/golangci-lint.lock,regular,0600',
|
|
'500,1001,/tmp/nwg-dock.lock,regular,0600',
|
|
'74,0,/tmp/mysql.sock.lock,regular,0600',
|
|
'74,0,/tmp/mysqlx.sock.lock,regular,0600'
|
|
)
|
|
AND NOT exception_key LIKE '500,1000,/tmp/keepassxc-%.lock,regular,0644'
|
|
AND NOT exception_key LIKE '500,1000,/tmp/keepassxc-%.lock,regular,0664'
|
|
AND NOT exception_key LIKE '500,0,/tmp/.s.PGSQL.%.lock,regular,0600'
|