auditea 0.1.0.beta.3 → 0.1.0.beta.5

data/lib/auditea/host_inventory/component_detectors.rb

@@ -0,0 +1,315 @@
+# frozen_string_literal: true
+
+require "timeout"
+require_relative "windows_components"
+
+module Auditea
+  module HostInventory
+    # Allowlisted local component detectors.
+    # Fixed argv only — no shell, no sudo, no PATH search, no caller-supplied paths.
+    module ComponentDetectors
+      # Wall-clock budget for the entire collect pass (all detectors/candidates).
+      AGGREGATE_TIMEOUT_SECONDS = 2.5
+      # Per-command cap; also clipped by remaining aggregate budget.
+      PER_COMMAND_TIMEOUT_SECONDS = 1.0
+      MAX_OUTPUT_BYTES = 2_048
+      ALLOWED_BASENAMES = %w[openssl apache2 httpd nginx].freeze
+
+      # Fixed trusted system directories only — never ENV["PATH"] or writable app/tmp dirs.
+      TRUSTED_BIN_DIRS = %w[
+        /usr/bin
+        /bin
+        /usr/sbin
+        /sbin
+        /usr/local/bin
+        /usr/local/sbin
+      ].freeze
+
+      DETECTORS = [
+        {
+          product: "OpenSSL",
+          scope: "host_component",
+          observation_method: "host.openssl_version",
+          candidates: [%w[openssl version]],
+          parser: :parse_openssl
+        },
+        {
+          product: "Apache HTTP Server",
+          scope: "reverse_proxy",
+          observation_method: "host.apache_v",
+          candidates: [%w[apache2 -v], %w[httpd -v]],
+          parser: :parse_apache
+        },
+        {
+          product: "nginx",
+          scope: "reverse_proxy",
+          observation_method: "host.nginx_v",
+          candidates: [%w[nginx -v]],
+          parser: :parse_nginx
+        }
+      ].freeze
+
+      module_function
+
+      def collect
+        return WindowsComponents.collect if WindowsComponents.windows?
+
+        deadline = monotonic_now + AGGREGATE_TIMEOUT_SECONDS
+        DETECTORS.filter_map { |detector| detect(detector, deadline: deadline) }
+      rescue StandardError
+        []
+      end
+
+      def detect(detector, deadline: monotonic_now + AGGREGATE_TIMEOUT_SECONDS)
+        detector.fetch(:candidates).each do |argv|
+          break if monotonic_now >= deadline
+
+          output = capture(argv, deadline: deadline)
+          next if output.nil?
+
+          version = send(detector.fetch(:parser), output)
+          next if version.nil? || version.empty?
+
+          return Inventory::Components.build(
+            product: detector.fetch(:product),
+            version: version,
+            scope: detector.fetch(:scope),
+            observation_method: detector.fetch(:observation_method),
+            evidence: {
+              "command" => argv.first.to_s
+            }
+          )
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # Resolve basename from trusted directories only; execute absolute path + fixed args.
+      def capture(argv, deadline: monotonic_now + AGGREGATE_TIMEOUT_SECONDS)
+        basename = argv.first.to_s
+        return nil unless ALLOWED_BASENAMES.include?(basename)
+
+        remaining = deadline - monotonic_now
+        return nil if remaining <= 0
+
+        executable = resolve_executable(basename)
+        return nil unless executable
+
+        full_argv = [executable] + argv.drop(1).map(&:to_s)
+        timeout_seconds = [PER_COMMAND_TIMEOUT_SECONDS, remaining].min
+        return nil if timeout_seconds <= 0
+
+        run_bounded(full_argv, timeout_seconds)
+      rescue StandardError
+        nil
+      end
+
+      def resolve_executable(basename)
+        return nil unless ALLOWED_BASENAMES.include?(basename)
+        return nil if basename.include?("/") || basename.include?("\\") || basename.include?("\0")
+
+        TRUSTED_BIN_DIRS.each do |dir|
+          next if dir.empty? || dir.include?("\0")
+
+          candidate = File.join(dir, basename)
+          next unless File.file?(candidate)
+          next unless File.executable?(candidate)
+
+          real_dir = begin
+            File.realpath(dir)
+          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+            next
+          end
+
+          real_file = begin
+            File.realpath(candidate)
+          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+            next
+          end
+
+          # Symlinks must not escape the trusted real directory boundary
+          # (supports ordinary /bin -> /usr/bin realpath equivalence).
+          next unless File.dirname(real_file) == real_dir
+          next unless trusted_material?(real_dir, real_file)
+
+          return real_file
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # Trust is ownership + mode on the resolved real paths — not directory-name
+      # membership alone. Fail open (reject) when trust cannot be established.
+      #
+      # Policy:
+      # - material must be root-owned (uid 0); app-UID ownership is never enough
+      # - directory and executable must not be group- or world-writable
+      # - caller-configurable paths are never accepted
+      def trusted_material?(real_dir, real_file)
+        dir_stat = stat_path(real_dir)
+        file_stat = stat_path(real_file)
+        return false unless dir_stat && file_stat
+
+        trusted_stats?(dir_stat, file_stat)
+      rescue StandardError
+        false
+      end
+
+      def trusted_stats?(dir_stat, file_stat)
+        return false unless root_owned?(dir_stat) && root_owned?(file_stat)
+        return false if group_or_world_writable?(dir_stat)
+        return false if group_or_world_writable?(file_stat)
+        return false if app_user_owned_untrusted?(dir_stat)
+        return false if app_user_owned_untrusted?(file_stat)
+
+        true
+      end
+
+      def root_owned?(stat)
+        stat.uid.zero?
+      end
+
+      # Root-owned system material remains trusted even when the process euid is 0.
+      # Non-root owners (including the effective application user) are rejected.
+      def app_user_owned_untrusted?(stat)
+        return false if stat.uid.zero?
+
+        stat.uid == Process.euid
+      end
+
+      def group_or_world_writable?(stat)
+        (stat.mode & 0o022).nonzero?
+      end
+
+      def stat_path(path)
+        File.stat(path)
+      rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+        nil
+      end
+
+      def run_bounded(full_argv, timeout_seconds)
+        out_r, out_w = IO.pipe
+        err_r, err_w = IO.pipe
+        pid = nil
+
+        begin
+          pid = Process.spawn(
+            *full_argv,
+            in: :close,
+            out: out_w,
+            err: err_w,
+            pgroup: true,
+            close_others: true
+          )
+          out_w.close
+          err_w.close
+          out_w = err_w = nil
+
+          stdout = ""
+          stderr = ""
+          status = nil
+
+          Timeout.timeout(timeout_seconds) do
+            stdout = out_r.read(MAX_OUTPUT_BYTES).to_s
+            stderr = err_r.read(MAX_OUTPUT_BYTES).to_s
+            _pid, status = Process.wait2(pid)
+            pid = nil
+          end
+
+          combined = "#{stdout}\n#{stderr}".byteslice(0, MAX_OUTPUT_BYTES).to_s
+          return nil if combined.strip.empty?
+          return nil if status && !status.success? && combined !~ /version|Server version|nginx/i
+
+          combined
+        rescue Timeout::Error
+          nil
+        ensure
+          # Any post-spawn exit path (timeout, other exceptions, early return after wait)
+          # must account for the child while pid remains owned by this method.
+          if pid
+            begin
+              reap_process_group(pid)
+            rescue StandardError
+              nil
+            end
+            pid = nil
+          end
+
+          begin
+            out_w&.close
+          rescue StandardError
+            nil
+          end
+          begin
+            err_w&.close
+          rescue StandardError
+            nil
+          end
+          begin
+            out_r.close
+          rescue StandardError
+            nil
+          end
+          begin
+            err_r.close
+          rescue StandardError
+            nil
+          end
+        end
+      end
+
+      def reap_process_group(pid)
+        return unless pid
+
+        begin
+          Process.kill("KILL", -pid)
+        rescue Errno::ESRCH, Errno::EPERM
+          begin
+            Process.kill("KILL", pid)
+          rescue Errno::ESRCH, Errno::EPERM
+            nil
+          end
+        end
+
+        loop do
+          Process.waitpid(pid)
+          break
+        rescue Errno::ECHILD
+          break
+        rescue Errno::EINTR
+          # Child may still be exiting; retry wait.
+          next
+        end
+      rescue StandardError
+        nil
+      end
+
+      def parse_openssl(output)
+        # OpenSSL 3.0.2 15 Mar 2022
+        if (match = output.match(/OpenSSL\s+([0-9][^\s]*)/i))
+          match[1]
+        end
+      end
+
+      def parse_apache(output)
+        # Server version: Apache/2.4.52 (Ubuntu)
+        if (match = output.match(%r{Apache/([0-9][^\s)]*)}i))
+          match[1]
+        end
+      end
+
+      def parse_nginx(output)
+        # nginx version: nginx/1.18.0 (Ubuntu)
+        if (match = output.match(%r{nginx/([0-9][^\s)]*)}i))
+          match[1]
+        end
+      end
+
+      def monotonic_now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/auditea/host_inventory/windows_components.rb

@@ -0,0 +1,285 @@
+# frozen_string_literal: true
+
+require "timeout"
+require_relative "../inventory/components"
+
+module Auditea
+  module HostInventory
+    # Windows-only host component detection via read-only registry queries.
+    #
+    # Windows binaries live in untrusted app-specific directories, so we never
+    # execute the installed product itself. Instead we read the uninstall registry
+    # (fixed `reg.exe query` argv — no shell, no PATH search, no caller paths) to
+    # observe installed products, and read the OS ProductName for edition identity.
+    module WindowsComponents
+      AGGREGATE_TIMEOUT_SECONDS = 2.5
+      PER_COMMAND_TIMEOUT_SECONDS = 1.0
+      # Total accumulated bytes we retain per stream. Output beyond this is still
+      # drained (so the child never blocks on a full pipe) but not accumulated.
+      # A real uninstall tree can exceed a few KiB; 1 MiB is ample headroom while
+      # still keeping the reader's memory bounded.
+      REG_MAX_OUTPUT = 1_048_576
+      REG_READ_CHUNK = 8_192
+      REG_DIRS = ["C:\\Windows\\System32", "C:\\Windows\\SysWOW64"].freeze
+      PRODUCT_NAME_KEY = 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+      # Single canonical key; access both 32-bit and 64-bit registry views
+      # explicitly instead of relying on implicit WOW64 redirection.
+      UNINSTALL_KEY = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
+      UNINSTALL_VIEWS = %w[/reg:64 /reg:32].freeze
+
+      # DisplayName → canonical component. Read-only: never executes the product binary.
+      PRODUCT_MATCHERS = [
+        {
+          pattern: /\Aapache\s+http\s+server/i,
+          product: "Apache HTTP Server",
+          scope: "reverse_proxy",
+          method: "windows.uninstall_registry"
+        },
+        {
+          pattern: /\Anginx/i,
+          product: "nginx",
+          scope: "reverse_proxy",
+          method: "windows.uninstall_registry"
+        },
+        {
+          pattern: /\Aopenssl/i,
+          product: "OpenSSL",
+          scope: "host_component",
+          method: "windows.uninstall_registry"
+        }
+      ].freeze
+
+      # Generic Windows software channel. We observe "installed in the Windows
+      # uninstall registry" — the specific installer technology (MSI/Chocolatey/
+      # winget) is unknown, so we claim only the generic Windows ecosystem and let
+      # the server route it to the Windows vendor channel.
+      WINDOWS_PACKAGE = { "ecosystem" => "windows" }.freeze
+
+      module_function
+
+      def windows?
+        Gem.win_platform? || RbConfig::CONFIG["host_os"].to_s.match?(/mswin|mingw|cygwin/i)
+      end
+
+      # Deterministic read-only query plan: the canonical uninstall key under
+      # both explicit registry views. Exposed for testing and dedup guarantees.
+      def uninstall_queries
+        UNINSTALL_VIEWS.map { |view| ["query", UNINSTALL_KEY, "/s", view] }
+      end
+
+      def collect(deadline: monotonic_now + AGGREGATE_TIMEOUT_SECONDS)
+        seen = {}
+        uninstall_queries.each do |argv|
+          remaining = deadline - monotonic_now
+          break if remaining <= 0
+
+          output = run_reg(argv, timeout: [PER_COMMAND_TIMEOUT_SECONDS, remaining].min)
+          next if output.nil?
+
+          parse_uninstall(output).each do |(name, version)|
+            matcher = PRODUCT_MATCHERS.find { |m| name.to_s.match?(m[:pattern]) }
+            next unless matcher
+
+            # Dedup only identical observations. Key on product + version + scope
+            # so multiple installed versions of the same product are all preserved
+            # (the hidden one may be the vulnerable one); a repeated identical
+            # version across the 32/64-bit views collapses to a single component.
+            key = [matcher[:product], version, matcher[:scope]]
+            next if seen.key?(key)
+
+            seen[key] = Inventory::Components.build(
+              product: matcher[:product],
+              version: version,
+              scope: matcher[:scope],
+              observation_method: matcher[:method],
+              package: WINDOWS_PACKAGE,
+              evidence: { "command" => "reg.exe" }
+            )
+          end
+        end
+        seen.values
+      end
+
+      def parse_uninstall(output)
+        entries = []
+        name = nil
+        version = nil
+        output.to_s.each_line do |line|
+          stripped = line.strip
+          if stripped.start_with?("HKEY_")
+            entries << [name, version] if name && version
+            name = nil
+            version = nil
+            next
+          end
+
+          if (match = stripped.match(/\ADisplayName\s+REG_\S+\s+(.+)\z/i))
+            name = match[1].to_s.strip
+          elsif (match = stripped.match(/\ADisplayVersion\s+REG_\S+\s+(.+)\z/i))
+            version = match[1].to_s.strip
+          end
+        end
+        entries << [name, version] if name && version
+        entries
+      end
+
+      # ProductName from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
+      # (e.g. "Windows Server 2016 Standard"). Fails open → nil when absent.
+      def product_name
+        read_value(PRODUCT_NAME_KEY, "ProductName")
+      end
+
+      def read_value(key, name)
+        return nil unless windows?
+
+        output = run_reg(["query", key, "/v", name])
+        return nil if output.nil?
+
+        parse_value(output, name)
+      end
+
+      def parse_value(output, name)
+        pattern = /\A\s*#{Regexp.escape(name)}\s+REG_\S+\s+(.+)\z/i
+        output.to_s.each_line do |line|
+          if (match = line.strip.match(pattern))
+            return match[1].to_s.strip
+          end
+        end
+        nil
+      end
+
+      # reg.exe lives in a fixed trusted system directory; argv is fixed and
+      # read-only (`query`). No PATH search, no shell, no caller-supplied paths.
+      # Fail-open: any registry-execution failure (missing exe, EACCES/AppLocker,
+      # spawn failure) yields nil so host inventory never breaks.
+      def run_reg(args, timeout: PER_COMMAND_TIMEOUT_SECONDS)
+        reg = resolve_reg_exe
+        return nil unless reg
+        return nil if timeout.to_f <= 0
+
+        run_bounded([reg] + Array(args).map(&:to_s), timeout)
+      rescue StandardError
+        nil
+      end
+
+      def resolve_reg_exe
+        REG_DIRS.each do |dir|
+          candidate = File.join(dir, "reg.exe")
+          return candidate if File.file?(candidate)
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # Executes the fixed argv and returns combined stdout/stderr, draining BOTH
+      # streams concurrently to EOF so a large uninstall tree cannot block the
+      # child on a full pipe. Accumulated memory is bounded at REG_MAX_OUTPUT per
+      # stream; beyond that we keep draining (discard) so the child still exits.
+      # Returns nil on timeout, non-zero exit, empty output, or spawn failure.
+      def run_bounded(full_argv, timeout_seconds)
+        out_r, out_w = IO.pipe
+        err_r, err_w = IO.pipe
+        pid = nil
+        readers = []
+
+        begin
+          pid = spawn_process(full_argv, out_w, err_w)
+          out_w.close
+          err_w.close
+          out_w = err_w = nil
+
+          stdout = +"".b
+          stderr = +"".b
+          readers = [
+            Thread.new { stdout = drain_io(out_r) },
+            Thread.new { stderr = drain_io(err_r) }
+          ]
+
+          status = nil
+          Timeout.timeout(timeout_seconds) do
+            _pid, status = Process.wait2(pid)
+            pid = nil
+          end
+          readers.each(&:join)
+
+          combined = "#{stdout}\n#{stderr}"
+          return nil if combined.strip.empty?
+          return nil if status && !status.success?
+
+          combined
+        rescue Timeout::Error, SystemCallError, IOError
+          nil
+        ensure
+          if pid
+            reap(pid)
+            pid = nil
+          end
+
+          close_io(out_w)
+          close_io(err_w)
+          close_io(out_r)
+          close_io(err_r)
+          readers.each { |reader| reader.join(0.1) }
+        end
+      end
+
+      # Reads a stream to EOF in bounded chunks, retaining at most REG_MAX_OUTPUT
+      # bytes but continuing to drain the rest so the writer never blocks.
+      def drain_io(io)
+        out = +"".b
+        loop do
+          chunk = io.read(REG_READ_CHUNK)
+          break if chunk.nil?
+          next if out.bytesize >= REG_MAX_OUTPUT
+
+          out << chunk
+          out = out.byteslice(0, REG_MAX_OUTPUT) if out.bytesize > REG_MAX_OUTPUT
+        end
+        out
+      rescue IOError, Errno::EIO, Errno::EBADF
+        out
+      end
+
+      # Windows spawns in a new process group (`new_pgroup:`), POSIX uses `pgroup:`.
+      # The POSIX branch also allows the Windows reader to be integration-tested on
+      # Linux against a fixture executable.
+      def spawn_process(full_argv, out_w, err_w)
+        if windows?
+          Process.spawn(*full_argv, in: :close, out: out_w, err: err_w, new_pgroup: true)
+        else
+          Process.spawn(*full_argv, in: :close, out: out_w, err: err_w, pgroup: true)
+        end
+      end
+
+      def reap(pid)
+        begin
+          Process.kill("KILL", pid)
+        rescue StandardError
+          nil
+        end
+
+        loop do
+          Process.waitpid(pid)
+          break
+        rescue Errno::ECHILD
+          break
+        rescue Errno::EINTR
+          next
+        end
+      rescue StandardError
+        nil
+      end
+
+      def close_io(io)
+        io&.close
+      rescue StandardError
+        nil
+      end
+
+      def monotonic_now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end