Skip to content

Commit 7a66409

Browse files
antobinaryantobinary
authored
Merge pull request #811 from bigbluebutton/image-magick-policy
fix(sec): Overwrite ImageMagick's security policy to tighten it up
2 parents 14ef76c + 77c2f51 commit 7a66409

File tree

1 file changed

+113
-0
lines changed

1 file changed

+113
-0
lines changed

‎bbb-install.sh‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ main() {
126126
GL3_DIR=~/greenlight-v3
127127
LTI_DIR=~/bbb-lti
128128
NGINX_FILES_DEST=/usr/share/bigbluebutton/nginx
129+
IMAGE_MAGICK_DIR=/etc/ImageMagick-6
130+
OVERWRITE_IMAGE_MAGICK_POLICY=true
129131
CR_TMPFILE=$(mktemp /tmp/carriage-return.XXXXXX)
130132
printf '\n' > "$CR_TMPFILE"
131133

@@ -391,6 +393,117 @@ main() {
391393
install_greenlight_v3
392394
fi
393395

396+
if [ "$OVERWRITE_IMAGE_MAGICK_POLICY" = true ]; then
397+
echo "ATTENTION!!"
398+
echo "Overwriting ImageMagick policy file (modifying the default configuration to seal security vectors)"
399+
400+
#
401+
# This is the imagemagick-provided https://imagemagick.org/source/policy-websafe.xml with
402+
# minimal modifications required for bigbluebutton presentation conversion to work
403+
404+
405+
cat <<HERE > "$IMAGE_MAGICK_DIR/policy.xml"
406+
<!--
407+
Creating a security policy that fits your specific local environment
408+
before making use of ImageMagick is highly advised. You can find guidance on
409+
setting up this policy at https://imagemagick.org/script/security-policy.php,
410+
and it's important to verify your policy using the validation tool located
411+
at https://imagemagick-secevaluator.doyensec.com/.
412+
Web-safe ImageMagick security policy:
413+
This security protocol designed for web-safe usage focuses on situations
414+
where ImageMagick is applied in publicly accessible contexts, like websites.
415+
It deactivates the capability to read from or write to any image formats
416+
other than web-safe formats like GIF, JPEG, and PNG. Additionally, this
417+
policy prohibits the execution of image filters and indirect reads, thereby
418+
thwarting potential security breaches. By implementing these limitations,
419+
the web-safe policy fortifies the safeguarding of systems accessible to
420+
the public, reducing the risk of exploiting ImageMagick's capabilities
421+
for potential attacks.
422+
-->
423+
<policymap xmlns="">
424+
<!-- Set maximum parallel threads. -->
425+
<policy xmlns="" domain="resource" name="thread" value="2"/>
426+
<!-- Set maximum time to live in seconds or neumonics, e.g. "2 minutes". When
427+
this limit is exceeded, an exception is thrown and processing stops. -->
428+
<policy xmlns="" domain="resource" name="time" value="60"/>
429+
<!-- Set maximum number of open pixel cache files. When this limit is
430+
exceeded, any subsequent pixels cached to disk are closed and reopened
431+
on demand. -->
432+
<policy xmlns="" domain="resource" name="file" value="768"/>
433+
<!-- Set maximum amount of memory in bytes to allocate for the pixel cache
434+
from the heap. When this limit is exceeded, the image pixels are cached
435+
to memory-mapped disk. -->
436+
<policy xmlns="" domain="resource" name="memory" value="256MiB"/>
437+
<!-- Set maximum amount of memory map in bytes to allocate for the pixel
438+
cache. When this limit is exceeded, the image pixels are cached to
439+
disk. -->
440+
<policy xmlns="" domain="resource" name="map" value="512MiB"/>
441+
<!-- Set the maximum width * height of an image that can reside in the pixel
442+
cache memory. Images that exceed the area limit are cached to disk. -->
443+
<policy xmlns="" domain="resource" name="area" value="16KP"/>
444+
<!-- Set maximum amount of disk space in bytes permitted for use by the pixel
445+
cache. When this limit is exceeded, the pixel cache is not be created
446+
and an exception is thrown. -->
447+
<policy xmlns="" domain="resource" name="disk" value="1GiB"/>
448+
<!-- Set the maximum length of an image sequence. When this limit is
449+
exceeded, an exception is thrown. -->
450+
<policy xmlns="" domain="resource" name="list-length" value="16"/>
451+
<!-- Set the maximum width of an image. When this limit is exceeded, an
452+
exception is thrown. -->
453+
<policy xmlns="" domain="resource" name="width" value="4KP"/>
454+
<!-- Set the maximum height of an image. When this limit is exceeded, an
455+
exception is thrown. -->
456+
<policy xmlns="" domain="resource" name="height" value="4KP"/>
457+
<!-- Periodically yield the CPU for at least the time specified in
458+
milliseconds. -->
459+
<policy xmlns="" domain="resource" name="throttle" value="2"/>
460+
<!-- Do not create temporary files in the default shared directories, instead
461+
specify a private area to store only ImageMagick temporary files. -->
462+
<!-- <policy domain="resource" name="temporary-path" value="/magick/tmp/"/> -->
463+
<!-- Force memory initialization by memory mapping select memory
464+
allocations. -->
465+
<policy xmlns="" domain="cache" name="memory-map" value="anonymous"/>
466+
<!-- Ensure all image data is fully flushed and synchronized to disk. -->
467+
<policy xmlns="" domain="cache" name="synchronize" value="true"/>
468+
<!-- Replace passphrase for secure distributed processing -->
469+
<!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
470+
<!-- Do not permit any delegates to execute. -->
471+
<policy xmlns="" domain="delegate" rights="none" pattern="*"/>
472+
<!-- Do not permit any image filters to load. -->
473+
<policy xmlns="" domain="filter" rights="none" pattern="*"/>
474+
475+
<!-- Don't read/write from/to stdin/stdout. -->
476+
<policy xmlns="" domain="path" rights="none" pattern="-"/>
477+
478+
<!-- Indirect reads are not permitted. -->
479+
<policy xmlns="" domain="path" rights="none" pattern="@*"/>
480+
481+
<!-- don't read sensitive paths. -->
482+
<policy domain="path" rights="none" pattern="/*"/>
483+
484+
<!-- allow access to required paths. -->
485+
<policy domain="path" rights="read|write" pattern="/var/bigbluebutton/*"/>
486+
<policy domain="path" rights="read|write" pattern="/tmp/*"/>
487+
488+
<!-- Deny all image modules and specifically exempt reading or writing
489+
web-safe image formats. -->
490+
<policy xmlns="" domain="module" rights="none" pattern="*"/>
491+
<policy domain="module" rights="read | write" pattern="{BMP,GIF,JPEG,PDF,PNG,TIFF,WEBP}"/>
492+
<policy xmlns="" domain="module" rights="read | write" pattern="{MPC}" stealth="true"/>
493+
<policy domain="module" rights="write" pattern="{JSON,INFO,PNM,PS,SVG}"/>
494+
<!-- This policy sets the number of times to replace content of certain
495+
memory buffers and temporary files before they are freed or deleted. -->
496+
<policy xmlns="" domain="system" name="shred" value="1"/>
497+
<!-- Enable the initialization of buffers with zeros, resulting in a minor
498+
performance penalty but with improved security. -->
499+
<policy xmlns="" domain="system" name="memory-map" value="anonymous"/>
500+
<!-- Set the maximum amount of memory in bytes that are permitted for
501+
allocation requests. -->
502+
<policy xmlns="" domain="system" name="max-memory-request" value="256MiB"/>
503+
</policymap>
504+
HERE
505+
fi
506+
394507
bbb-conf --check
395508
}
396509

0 commit comments

Comments
 (0)