()
Inspect systemd timer unit files
Inspect systemd timer unit files
Inspect systemd timer unit files
def uptux_check_timer_units():
    """Inspect systemd timer unit files"""
    units = set()
    mask = '*.timer'
    units = find_system_files(known_dirs=SYSTEMD_DIRS,
                              search_mask=mask)

    tee("Found {} timer units to analyse...\n".format(len(units)),
        box='ok')

    # Test for write access to any timer files.
    # Will resolve symlinks to their target and also check for broken links.
    text = 'Found writeable timer unit files:'
    text2 = 'Found writeable directories referred to by broken symlinks'
    box = 'vuln'
    tee("")
    tee("Checking permissions on timer unit files...",
        box='ok')
    check_file_permissions(file_paths=units,
                           files_message_text=text,
                           dirs_message_text=text2,
                           message_box=box)

    # Timers may reference systemd services, which are already being checked.
    # But they may reference a specific script (often a '.target' file of the
    # same name. Check to see if the action called is writable.
    # The regex below is used to extract these targets.
    regex = re.compile(r'^Unit=*(.*?$)',
                       re.MULTILINE)

    # We don't pass message info to this function as we need to perform more
    # processing on the output to determine what is writeable.
    tee("")
    tee("Checking for write access to commands referenced in timer files...",
        box='ok')
    timer_commands = regex_vuln_search(file_paths=units,
                                       regex=regex,
                                       message_text='',
                                       message_box='')

    # Another helper function to take the extracted commands and check for
    # write permissions.
    text = 'You have write access to commands referred to in timer files:'
    box = 'vuln'
    check_command_permission(commands=timer_commands,
                             message_text=text,
                             message_box=box)
def uptux_check_timer_units ( ) : units = set ( ) mask = '*.timer' units = find_system_files ( known_dirs = SYSTEMD_DIRS , search_mask = mask ) tee ( "Found {} timer units to analyse...\n" . format ( len ( units ) ) , box = 'ok' ) # Test for write access to any timer files. # Will resolve symlinks to their target and also check for broken links. text = 'Found writeable timer unit files:' text2 = 'Found writeable directories referred to by broken symlinks' box = 'vuln' tee ( "" ) tee ( "Checking permissions on timer unit files..." , box = 'ok' ) check_file_permissions ( file_paths = units , files_message_text = text , dirs_message_text = text2 , message_box = box ) # Timers may reference systemd services, which are already being checked. # But they may reference a specific script (often a '.target' file of the # same name. Check to see if the action called is writable. # The regex below is used to extract these targets. regex = re . compile ( r'^Unit=*(.*?$)' , re . MULTILINE ) # We don't pass message info to this function as we need to perform more # processing on the output to determine what is writeable. tee ( "" ) tee ( "Checking for write access to commands referenced in timer files..." , box = 'ok' ) timer_commands = regex_vuln_search ( file_paths = units , regex = regex , message_text = '' , message_box = '' ) # Another helper function to take the extracted commands and check for # write permissions. text = 'You have write access to commands referred to in timer files:' box = 'vuln' check_command_permission ( commands = timer_commands , message_text = text , message_box = box )