harden: trusted PATH boundary, command timeouts, parser correctness

Author: q1sh101

Makefile

@@ -1,5 +1,6 @@
 CC ?= cc
 CFLAGS ?= -std=c11 -O2 -Wall -Wextra -Wpedantic -Werror -D_POSIX_C_SOURCE=200809L -Iinclude
+TEST_CFLAGS = $(CFLAGS) -DBYTHOS_ALLOW_PATH_OVERRIDE
 LDFLAGS ?=
 
 prefix ?= /usr/local
@@ -97,28 +98,28 @@ uninstall:
 	rm -f "$(DESTDIR)$(bindir)/$(BIN)" "$(DESTDIR)$(mandir)/bythos.1"
 
 $(FIRMWARE_TEST_BIN): tests/firmware_parsers.c src/firmware_parsers.c include/firmware_parsers.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/firmware_parsers.c src/firmware_parsers.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/firmware_parsers.c src/firmware_parsers.c -o $@ $(LDFLAGS)
 
 $(FIRMWARE_OWNERSHIP_TEST_BIN): tests/firmware_ownership.c src/firmware_ownership.c src/runtime.c src/firmware_parsers.c include/firmware_ownership.h include/runtime.h include/firmware_parsers.h tests/assert_helpers.h tests/test_harness.h
-	$(CC) $(CFLAGS) tests/firmware_ownership.c src/firmware_ownership.c src/runtime.c src/firmware_parsers.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/firmware_ownership.c src/firmware_ownership.c src/runtime.c src/firmware_parsers.c -o $@ $(LDFLAGS)
 
 $(SILICON_TEST_BIN): tests/silicon_parsers.c src/silicon_parsers.c src/runtime.c include/silicon_parsers.h include/runtime.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/silicon_parsers.c src/silicon_parsers.c src/runtime.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/silicon_parsers.c src/silicon_parsers.c src/runtime.c -o $@ $(LDFLAGS)
 
 $(STORAGE_TEST_BIN): tests/storage_parsers.c src/storage_parsers.c include/storage_parsers.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/storage_parsers.c src/storage_parsers.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/storage_parsers.c src/storage_parsers.c -o $@ $(LDFLAGS)
 
 $(RUNTIME_TEST_BIN): tests/runtime_capture.c src/runtime.c include/runtime.h tests/assert_helpers.h tests/test_harness.h
-	$(CC) $(CFLAGS) tests/runtime_capture.c src/runtime.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/runtime_capture.c src/runtime.c -o $@ $(LDFLAGS)
 
 $(EFI_BOOT_TEST_BIN): tests/efi_boot_parsers.c src/efi_boot_parsers.c src/runtime.c include/efi_boot_parsers.h include/runtime.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/efi_boot_parsers.c src/efi_boot_parsers.c src/runtime.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/efi_boot_parsers.c src/efi_boot_parsers.c src/runtime.c -o $@ $(LDFLAGS)
 
 $(ESP_TEST_BIN): tests/esp_posture.c src/esp_parsers.c include/esp_parsers.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/esp_posture.c src/esp_parsers.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/esp_posture.c src/esp_parsers.c -o $@ $(LDFLAGS)
 
 $(SKIP_REASON_TEST_BIN): tests/skip_reason.c src/output.c include/output.h include/types.h tests/assert_helpers.h
-	$(CC) $(CFLAGS) tests/skip_reason.c src/output.c -o $@ $(LDFLAGS)
+	$(CC) $(TEST_CFLAGS) tests/skip_reason.c src/output.c -o $@ $(LDFLAGS)
 
 clean:
 	rm -f src/*.o *.o $(BIN) $(TEST_BINS)

include/runtime.h

@@ -3,6 +3,7 @@
 
 #include <stdbool.h>
 #include <stddef.h>
+#include <dirent.h>
 
 typedef enum {
     BYTHOS_SERVICE_STATE_UNKNOWN = 0,
@@ -18,9 +19,13 @@ bool bythos_command_exists(const char *name);
 bool bythos_file_exists(const char *path);
 bool bythos_read_file_text(const char *path, char *buffer, size_t size);
 bool bythos_read_file_binary(const char *path, unsigned char *buffer, size_t size, size_t *bytes_read);
+bool bythos_first_line_with_prefix(const char *path, const char *prefix, char *buffer, size_t size);
+bool bythos_find_mount_opts(const char *mounts, const char *fstype, char *opts_out, size_t opts_size);
 bool bythos_count_child_dirs(const char *path, size_t *count);
+struct dirent *bythos_readdir_safe(DIR *dir, int *err_out);
 bool bythos_read_key_value(const char *path, const char *key, char *buffer, size_t size);
 bool bythos_capture_argv_status(const char *const argv[], char *buffer, size_t size, int *exit_status);
+bool bythos_capture_argv_status_ex(const char *const argv[], char *buffer, size_t size, int *exit_status, bool *truncated);
 int bythos_run_argv_quiet(const char *const argv[]);
 bythos_service_state_t bythos_probe_systemd_service(const char *unit);
 const char *bythos_esp_efi_base(void);

include/types.h

@@ -50,6 +50,7 @@ typedef struct {
     const char *name;
     check_result_t results[BYTHOS_MAX_SUBGROUP_RESULTS];
     size_t result_count;
+    bool truncated;
     posture_summary_t summary;
 } check_subgroup_t;
 

src/check_bios_boot.c

@@ -37,17 +37,33 @@ static bool read_boot_entry(uint16_t number, bythos_efi_boot_entry_t *entry) {
 static size_t check_efivars_boot(check_result_t *results, size_t max_results) {
     size_t used = 0;
 
+    if (!bythos_file_exists("/sys/firmware/efi/efivars")) {
+        EMIT_SKIP_FEATURE("EFI USB boot",      "EFI runtime");
+        EMIT_SKIP_FEATURE("EFI network boot",  "EFI runtime");
+        EMIT_SKIP_FEATURE("EFI CD/DVD boot",   "EFI runtime");
+        EMIT_SKIP_FEATURE("EFI one-shot boot", "EFI runtime");
+        return used;
+    }
+
     unsigned char order_buf[256];
     size_t order_len = 0;
 
     if (!bythos_read_file_binary(EFI_BOOT_ORDER_PATH, order_buf,
                                      sizeof(order_buf), &order_len)) {
-        return 0;
+        EMIT_SKIP_FEATURE("EFI USB boot",      "BootOrder variable");
+        EMIT_SKIP_FEATURE("EFI network boot",  "BootOrder variable");
+        EMIT_SKIP_FEATURE("EFI CD/DVD boot",   "BootOrder variable");
+        EMIT_SKIP_FEATURE("EFI one-shot boot", "BootOrder variable");
+        return used;
     }
 
     bythos_efi_boot_order_t order = {0};
     if (!bythos_parse_efi_boot_order(order_buf, order_len, &order)) {
-        return 0;
+        EMIT_SKIP("EFI USB boot",      SKIP_OUTPUT_UNPARSEABLE, "BootOrder variable malformed");
+        EMIT_SKIP("EFI network boot",  SKIP_OUTPUT_UNPARSEABLE, "BootOrder variable malformed");
+        EMIT_SKIP("EFI CD/DVD boot",   SKIP_OUTPUT_UNPARSEABLE, "BootOrder variable malformed");
+        EMIT_SKIP("EFI one-shot boot", SKIP_OUTPUT_UNPARSEABLE, "BootOrder variable malformed");
+        return used;
     }
 
     /* Only active risky entries are a real posture signal. */
@@ -154,7 +170,7 @@ static size_t check_firmware_attrs_boot(check_result_t *results, size_t max_resu
     char value[64] = {0};
     struct dirent *vendor;
 
-    while ((vendor = readdir(vendors)) != NULL) {
+    while ((vendor = bythos_readdir_safe(vendors, NULL)) != NULL) {
         if (vendor->d_name[0] == '.') {
             continue;
         }
@@ -170,7 +186,7 @@ static size_t check_firmware_attrs_boot(check_result_t *results, size_t max_resu
         }
 
         struct dirent *attr;
-        while ((attr = readdir(attrs)) != NULL) {
+        while ((attr = bythos_readdir_safe(attrs, NULL)) != NULL) {
             if (attr->d_name[0] == '.') {
                 continue;
             }
@@ -281,6 +297,10 @@ static size_t check_firmware_password(check_result_t *results, size_t max_result
         while (*pos == ' ' || *pos == '\t') {
             pos++;
         }
+        if ((size_t)((buf + sizeof(buf)) - pos) < 9) {
+            EMIT_SKIP_PARSE(slots[i].name, "dmidecode");
+            continue;
+        }
         char term = pos[7];
         if (strncmp(pos, "Enabled", 7) == 0 &&
             (term == '\0' || term == '\n' || term == '\r' || term == ' ' || term == '\t')) {

src/check_bolt.c

@@ -16,7 +16,7 @@ static bool read_tb_domain_attr(const char *attr, char *buffer, size_t size) {
     if (dir == NULL) return false;
 
     struct dirent *entry;
-    while ((entry = readdir(dir)) != NULL) {
+    while ((entry = bythos_readdir_safe(dir, NULL)) != NULL) {
         if (strncmp(entry->d_name, "domain", 6) != 0) continue;
 
         char path[PATH_MAX];
@@ -39,7 +39,7 @@ static bool tb_controller_present(void) {
 
     bool found = false;
     struct dirent *entry;
-    while ((entry = readdir(dir)) != NULL) {
+    while ((entry = bythos_readdir_safe(dir, NULL)) != NULL) {
         if (strncmp(entry->d_name, "domain", 6) == 0) {
             found = true;
             break;

src/check_boot_chain.c

@@ -62,7 +62,7 @@ static bool find_efi_binary(const char *const *candidates, size_t candidate_coun
     bool found = false;
     struct dirent *vendor;
 
-    while (!found && (vendor = readdir(efi_dir)) != NULL) {
+    while (!found && (vendor = bythos_readdir_safe(efi_dir, NULL)) != NULL) {
         if (vendor->d_name[0] == '.') {
             continue;
         }
@@ -79,7 +79,7 @@ static bool find_efi_binary(const char *const *candidates, size_t candidate_coun
         }
 
         struct dirent *entry;
-        while ((entry = readdir(vendor_dir)) != NULL) {
+        while ((entry = bythos_readdir_safe(vendor_dir, NULL)) != NULL) {
             char lower[256];
             bythos_to_lower_ascii(entry->d_name, lower, sizeof(lower));
 
@@ -172,7 +172,7 @@ static void scan_initramfs_dir(const char *dir_path, int max_depth,
     if (d == NULL) return;
 
     struct dirent *entry;
-    while ((entry = readdir(d)) != NULL) {
+    while ((entry = bythos_readdir_safe(d, NULL)) != NULL) {
         const char *name = entry->d_name;
         if (name[0] == '.') continue;
 

src/check_esp_posture.c

@@ -123,7 +123,7 @@ static size_t check_efi_vendor_dirs(check_result_t *results, size_t max_results)
     size_t names_len = 0;
     struct dirent *entry;
 
-    while ((entry = readdir(dir)) != NULL) {
+    while ((entry = bythos_readdir_safe(dir, NULL)) != NULL) {
         if (entry->d_name[0] == '.') continue;
         char path[PATH_MAX];
         if (snprintf(path, sizeof(path), "%s/%s", esp_base, entry->d_name) >=
@@ -174,7 +174,7 @@ static bool find_shim(char *path_out, size_t size) {
     if (efi_dir == NULL) return false;
     bool found = false;
     struct dirent *vendor;
-    while (!found && (vendor = readdir(efi_dir)) != NULL) {
+    while (!found && (vendor = bythos_readdir_safe(efi_dir, NULL)) != NULL) {
         if (vendor->d_name[0] == '.') continue;
         for (size_t i = 0; i < sizeof(shim_names) / sizeof(shim_names[0]); i++) {
             char candidate[PATH_MAX];
@@ -295,7 +295,7 @@ static size_t check_update_capsule(check_result_t *results, size_t max_results)
 
     size_t count = 0;
     struct dirent *entry;
-    while ((entry = readdir(dir)) != NULL) {
+    while ((entry = bythos_readdir_safe(dir, NULL)) != NULL) {
         if (entry->d_name[0] != '.') count++;
     }
     closedir(dir);

src/check_groups.c

@@ -9,16 +9,19 @@
 #define SUBGROUP_TAIL(sg) \
     ((sg)->results + (sg)->result_count)
 
+#define BYTHOS_SUBGROUP_MAX_FNS 6
+
 typedef size_t (*subgroup_check_fn)(check_result_t *, size_t);
 
 typedef struct {
     const char *name;
-    subgroup_check_fn fns[5];
+    subgroup_check_fn fns[BYTHOS_SUBGROUP_MAX_FNS];
 } subgroup_def_t;
 
 static void subgroup_init(check_subgroup_t *sg, const char *name) {
     sg->name = name;
     sg->result_count = 0;
+    sg->truncated = false;
     sg->summary = (posture_summary_t){0};
 }
 
@@ -36,7 +39,11 @@ static size_t run_subgroups(const subgroup_def_t *defs,
     for (size_t i = 0; defs[i].name != NULL && used < max_subgroups; i++) {
         check_subgroup_t *sg = &subgroups[used++];
         subgroup_init(sg, defs[i].name);
-        for (size_t j = 0; defs[i].fns[j] != NULL; j++) {
+        for (size_t j = 0; j < BYTHOS_SUBGROUP_MAX_FNS && defs[i].fns[j] != NULL; j++) {
+            if (sg->result_count >= BYTHOS_MAX_SUBGROUP_RESULTS) {
+                sg->truncated = true;
+                break;
+            }
             sg->result_count += defs[i].fns[j](
                 SUBGROUP_TAIL(sg), SUBGROUP_REMAINING(sg));
         }

src/check_luks.c

@@ -136,7 +136,7 @@ size_t bythos_check_luks(check_result_t *results, size_t max_results) {
                                     dump_buf, sizeof(dump_buf), &dump_status) &&
                                 dump_status == 0) {
                                 dump_ok++;
-                                if (strstr(dump_buf, "tpm2") != NULL) {
+                                if (strstr(dump_buf, "systemd-tpm2") != NULL) {
                                     any_token = true;
                                     uint32_t mask = 0;
                                     if (bythos_parse_luks_pcr_mask(dump_buf, &mask)) {

src/check_memory_encryption.c

@@ -1,5 +1,4 @@
 #include <stddef.h>
-#include <string.h>
 
 #include "checks.h"
 #include "checks_internal.h"
@@ -23,16 +22,14 @@ size_t bythos_check_memory_encryption(check_result_t *results, size_t max_result
         return used;
     }
 
-    static char cpuinfo[65536];
-    memset(cpuinfo, 0, sizeof(cpuinfo));
-
-    if (!bythos_read_file_text("/proc/cpuinfo", cpuinfo, sizeof(cpuinfo))) {
+    char flags_line[4096] = {0};
+    if (!bythos_first_line_with_prefix("/proc/cpuinfo", "flags", flags_line, sizeof(flags_line))) {
         EMIT_SKIP_EXEC("memory encryption", "cpuinfo");
         return used;
     }
 
     bythos_mem_enc_flags_t flags;
-    bythos_parse_memory_encryption_flags(cpuinfo, &flags);
+    bythos_parse_memory_encryption_flags(flags_line, &flags);
 
     if (vendor == BYTHOS_CPU_VENDOR_AMD) {
         if (!flags.amd_sme) {