Skip to content

Commit 008491a

Browse files
samrosesamrose
committed
fix: include users, groups perms
1 parent 67f5c11 commit 008491a

File tree

5 files changed

+257
-6
lines changed

5 files changed

+257
-6
lines changed

‎audit-specs/baselines/ami-build/files-postgres-config.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# File baseline: postgres-config
2+
# PostgreSQL configuration files for AMI build
3+
# Uses string names for owner/group (not numeric IDs)
4+
file:
5+
# Main PostgreSQL config directory
6+
/etc/postgresql:
7+
exists: true
8+
filetype: directory
9+
owner: postgres
10+
group: postgres
11+
mode: '0755'
12+
/etc/postgresql/postgresql.conf:
13+
exists: true
14+
filetype: file
15+
owner: root
16+
group: root
17+
mode: '0644'
18+
/etc/postgresql/pg_hba.conf:
19+
exists: true
20+
filetype: file
21+
owner: root
22+
group: postgres
23+
mode: '0664'
24+
/etc/postgresql/pg_ident.conf:
25+
exists: true
26+
filetype: file
27+
owner: root
28+
group: postgres
29+
mode: '0644'
30+
/etc/postgresql/logging.conf:
31+
exists: true
32+
filetype: file
33+
owner: root
34+
group: postgres
35+
mode: '0644'
36+
37+
# Custom PostgreSQL config directory
38+
/etc/postgresql-custom:
39+
exists: true
40+
filetype: directory
41+
owner: postgres
42+
group: postgres
43+
mode: '0755'
44+
/etc/postgresql-custom/platform-defaults.conf:
45+
exists: true
46+
filetype: file
47+
owner: postgres
48+
group: postgres
49+
mode: '0644'
50+
/etc/postgresql-custom/custom-overrides.conf:
51+
exists: true
52+
filetype: file
53+
owner: postgres
54+
group: postgres
55+
mode: '0664'
56+
/etc/postgresql-custom/generated-optimizations.conf:
57+
exists: true
58+
filetype: file
59+
owner: postgres
60+
group: postgres
61+
mode: '0664'
62+
/etc/postgresql-custom/supautils.conf:
63+
exists: true
64+
filetype: file
65+
owner: postgres
66+
group: postgres
67+
mode: '0664'
68+
/etc/postgresql-custom/wal-g.conf:
69+
exists: true
70+
filetype: file
71+
owner: postgres
72+
group: postgres
73+
mode: '0664'
74+
/etc/postgresql-custom/read-replica.conf:
75+
exists: true
76+
filetype: file
77+
owner: postgres
78+
group: postgres
79+
mode: '0664'
80+
/etc/postgresql-custom/pgsodium_root.key:
81+
exists: true
82+
filetype: file
83+
owner: postgres
84+
group: postgres
85+
mode: '0600'
86+
87+
# Extension custom scripts directory
88+
/etc/postgresql-custom/extension-custom-scripts:
89+
exists: true
90+
filetype: directory
91+
owner: postgres
92+
group: postgres
93+
mode: '0755'
94+
/etc/postgresql-custom/extension-custom-scripts/before-create.sql:
95+
exists: true
96+
filetype: file
97+
owner: postgres
98+
group: postgres
99+
mode: '0775'
100+
101+
# PostgREST config directory
102+
/etc/postgrest:
103+
exists: true
104+
filetype: directory
105+
owner: postgrest
106+
group: postgrest
107+
mode: '0755'
108+
/etc/postgrest/base.conf:
109+
exists: true
110+
filetype: file
111+
owner: root
112+
group: root
113+
mode: '0664'

‎audit-specs/baselines/ami-build/files-postgres-data.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# File baseline: postgres-data
2+
# PostgreSQL data directory for AMI build
3+
# Uses string names for owner/group (not numeric IDs)
4+
file:
5+
# PostgreSQL data directory
6+
/var/lib/postgresql:
7+
exists: true
8+
filetype: directory
9+
owner: postgres
10+
group: postgres
11+
mode: '0755'
12+
/var/lib/postgresql/data:
13+
exists: true
14+
filetype: directory
15+
owner: postgres
16+
group: postgres
17+
mode: '0700'

‎audit-specs/baselines/ami-build/files-security.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# File baseline: security
2+
# Critical security-related files for AMI build
3+
# Uses string names for owner/group (not numeric IDs)
4+
file:
5+
# fail2ban configuration directory
6+
/etc/fail2ban:
7+
exists: true
8+
filetype: directory
9+
owner: root
10+
group: root
11+
mode: '0755'
12+
/etc/fail2ban/jail.local:
13+
exists: true
14+
filetype: file
15+
owner: root
16+
group: root
17+
mode: '0644'
18+
19+
# AppArmor
20+
/etc/apparmor.d:
21+
exists: true
22+
filetype: directory
23+
owner: root
24+
group: root
25+
mode: '0755'
26+
27+
# UFW firewall
28+
/etc/ufw:
29+
exists: true
30+
filetype: directory
31+
owner: root
32+
group: root
33+
mode: '0755'
34+
/etc/ufw/ufw.conf:
35+
exists: true
36+
filetype: file
37+
owner: root
38+
group: root
39+
mode: '0644'
40+
41+
# SSH configuration
42+
/etc/ssh/sshd_config:
43+
exists: true
44+
filetype: file
45+
owner: root
46+
group: root
47+
mode: '0644'
48+
49+
# PAM configuration
50+
/etc/pam.d:
51+
exists: true
52+
filetype: directory
53+
owner: root
54+
group: root
55+
mode: '0755'
56+
57+
# Sudoers
58+
/etc/sudoers:
59+
exists: true
60+
filetype: file
61+
owner: root
62+
group: root
63+
mode: '0440'
64+
/etc/sudoers.d:
65+
exists: true
66+
filetype: directory
67+
owner: root
68+
group: root
69+
mode: '0750'
70+
71+
# Security limits
72+
/etc/security/limits.conf:
73+
exists: true
74+
filetype: file
75+
owner: root
76+
group: root
77+
mode: '0644'

‎audit-specs/baselines/ami-build/files-ssl.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# File baseline: ssl
2+
# SSL certificate and key directories for AMI build
3+
# Uses string names for owner/group (not numeric IDs)
4+
file:
5+
# System SSL directory
6+
/etc/ssl:
7+
exists: true
8+
filetype: directory
9+
owner: root
10+
group: root
11+
mode: '0755'
12+
/etc/ssl/certs:
13+
exists: true
14+
filetype: directory
15+
owner: root
16+
group: root
17+
mode: '0755'
18+
/etc/ssl/private:
19+
exists: true
20+
filetype: directory
21+
owner: root
22+
group: ssl-cert
23+
mode: '0710'
24+
/etc/ssl/openssl.cnf:
25+
exists: true
26+
filetype: file
27+
owner: root
28+
group: root
29+
mode: '0644'
30+
31+
# AdminAPI SSL directory (created during AMI build)
32+
/etc/ssl/adminapi:
33+
exists: true
34+
filetype: directory
35+
owner: adminapi
36+
group: root
37+
mode: '0700'

‎nix/packages/supascan/internal/scanners/files.go‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"io/fs"
77
"os"
8+
"os/user"
89
"path/filepath"
910
"syscall"
1011

@@ -212,14 +213,20 @@ func (s *FileScanner) handleError(err error, path string, opts ScanOptions) erro
212213

213214
// getUsername returns username for UID (or UID as string if lookup fails)
214215
func getUsername(uid uint32) string {
215-
// Simple implementation: just return UID
216-
// Could use os/user.LookupId() for name resolution
217-
return fmt.Sprintf("%d", uid)
216+
u, err := user.LookupId(fmt.Sprintf("%d", uid))
217+
if err != nil {
218+
// Fall back to numeric UID if lookup fails
219+
return fmt.Sprintf("%d", uid)
220+
}
221+
return u.Username
218222
}
219223

220224
// getGroupname returns groupname for GID (or GID as string if lookup fails)
221225
func getGroupname(gid uint32) string {
222-
// Simple implementation: just return GID
223-
// Could use os/user.LookupGroupId() for name resolution
224-
return fmt.Sprintf("%d", gid)
226+
g, err := user.LookupGroupId(fmt.Sprintf("%d", gid))
227+
if err != nil {
228+
// Fall back to numeric GID if lookup fails
229+
return fmt.Sprintf("%d", gid)
230+
}
231+
return g.Name
225232
}

0 commit comments

Comments
 (0)