Repository: bottlerocket-os/bottlerocket
File: sources/bloodhound/src/bin/bottlerocket-checks/checks.rs (Rust)

Code before:
use std::os::unix::fs::PermissionsExt;
use std::process::Command;
use walkdir::WalkDir;

const PROC_MODULES_FILE: &str = "/proc/modules";
const PROC_CMDLINE_FILE: &str = "/proc/cmdline";
const LOCKDOWN_FILE: &str = "/sys/kernel/security/lockdown";
const CHRONY_CONF_FILE: &str = "/etc/chrony.conf";
const JOURNALD_CONF_FILE: &str = "/usr/lib/systemd/journald.conf.d/journald.conf";
const SYSCTL_CMD: &str = "/usr/sbin/sysctl";
const SYSTEMCTL_CMD: &str = "/usr/bin/systemctl";
const MODPROBE_CMD: &str = "/bin/modprobe";
const SESTATUS_CMD: &str = "/usr/bin/sestatus";
const IPTABLES_CMD: &str = "/usr/sbin/iptables";
const IP6TABLES_CMD: &str = "/usr/sbin/ip6tables";

// =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<=

pub struct BR01010101Checker {}

impl Checker for BR01010101Checker {
    fn execute(&self) -> CheckerResult {
        let module_result = check_file_contains!(
            PROC_MODULES_FILE,
            &[" udf,"],
            "unable to parse modules to check for udf",
            "udf is currently loaded"
        );
        if module_result.status != CheckStatus::PASS {
            return module_result;
        }
        check_output_contains!(
            MODPROBE_CMD,
            ["-n", "-v", "udf"],
            &["install /bin/true"],
            "unable to parse modprobe output to check if udf is enabled",
            "modprobe for udf is not disabled"
        )
    }

    fn metadata(&self) -> CheckerMetadata {
        CheckerMetadata {
            title: "Ensure mounting of udf filesystems is disabled".to_string(),
            id: "1.1.1.1".to_string(),
            level: 2,
            name: "br01010101".to_string(),
            mode: Mode::Automatic,
        }
    }
}


Review comment (suggestion):
It would be slightly better to check for `"udf "` - `" udf,"` is matching a line for a module that's a dependency of udf, and only matches if udf is the first module in that list.

However, it seems worth adding a different function, like `look_for_word_in_file` that calls `split_ascii_whitespace` on the input and checks for an exact token match instead of using `contains`, to avoid false positives for short inputs like these.

Code after:
use std::os::unix::fs::PermissionsExt;
use std::process::Command;
use walkdir::WalkDir;

const PROC_MODULES_FILE: &str = "/proc/modules";
const PROC_CMDLINE_FILE: &str = "/proc/cmdline";
const LOCKDOWN_FILE: &str = "/sys/kernel/security/lockdown";
const CHRONY_CONF_FILE: &str = "/etc/chrony.conf";
const JOURNALD_CONF_FILE: &str = "/usr/lib/systemd/journald.conf.d/journald.conf";
const SYSCTL_CMD: &str = "/usr/sbin/sysctl";
const SYSTEMCTL_CMD: &str = "/usr/bin/systemctl";
const MODPROBE_CMD: &str = "/bin/modprobe";
const SESTATUS_CMD: &str = "/usr/bin/sestatus";
const IPTABLES_CMD: &str = "/usr/sbin/iptables";
const IP6TABLES_CMD: &str = "/usr/sbin/ip6tables";

// =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<= =>o.o<=

pub struct BR01010101Checker {}

impl Checker for BR01010101Checker {
    fn execute(&self) -> CheckerResult {
        let mut module_result = CheckerResult::default();

        // Make sure UDF isn't already loaded
        if let Ok(found) = look_for_word_in_file(PROC_MODULES_FILE, "udf") {
            if found {
                module_result.error = "udf is currently loaded".to_string();
                module_result.status = CheckStatus::FAIL;
                return module_result;
            }
        } else {
            module_result.error =
                "unable to parse modprobe output to check if udf is enabled".to_string();
            return module_result;
        }

        // Make sure the ability to load UDF is disabled
        check_output_contains!(
            MODPROBE_CMD,
            ["-n", "-v", "udf"],
            &["install /bin/true"],
            "unable to parse modprobe output to check if udf is enabled",
            "modprobe for udf is not disabled"
        )
    }

    fn metadata(&self) -> CheckerMetadata {
        CheckerMetadata {
            title: "Ensure mounting of udf filesystems is disabled".to_string(),
            id: "1.1.1.1".to_string(),