Skip to content

Commit 81c1713

Browse files
authored
checks (#150)
1 parent d161a15 commit 81c1713

29 files changed

+1348
-115
lines changed

Cargo.lock

Lines changed: 0 additions & 52 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

shellfirm/Cargo.toml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ serde_yaml = "0.9"
2323
serde_derive = "1.0"
2424
serde_regex = "1.1"
2525
regex = "1.12"
26-
rayon = "1.11"
2726
rand = "0.10"
2827
tracing = "0.1"
2928
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

shellfirm/checks/aws.yaml

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
alternative: "aws s3 ls s3://<bucket>"
77
alternative_info: "List bucket contents first to verify what would be deleted."
88
- from: aws
9-
test: aws\s+s3\s+rm\s+s3://.*--recursive
9+
test: aws\s+(?:--\S+\s+\S+\s+)*s3\s+rm\s+.*s3://.*--recursive|aws\s+(?:--\S+\s+\S+\s+)*s3\s+rm\s+--recursive\s+s3://
1010
description: "Recursively deleting all objects in an S3 bucket."
1111
id: aws:s3_recursive_delete
1212
severity: High
@@ -52,3 +52,43 @@
5252
description: "Deleting a Lambda function removes it permanently."
5353
id: aws:lambda_delete
5454
severity: High
55+
- from: aws
56+
test: aws\s+dynamodb\s+delete-table
57+
description: "Deleting a DynamoDB table permanently destroys all its data."
58+
id: aws:dynamodb_delete_table
59+
severity: High
60+
- from: aws
61+
test: aws\s+sqs\s+delete-queue
62+
description: "Deleting an SQS queue loses all queued messages."
63+
id: aws:sqs_delete_queue
64+
severity: High
65+
- from: aws
66+
test: aws\s+sns\s+delete-topic
67+
description: "Deleting an SNS topic breaks all subscriptions."
68+
id: aws:sns_delete_topic
69+
severity: High
70+
- from: aws
71+
test: aws\s+ecr\s+delete-repository
72+
description: "Deleting an ECR repository removes all container images."
73+
id: aws:ecr_delete_repository
74+
severity: High
75+
- from: aws
76+
test: aws\s+secretsmanager\s+delete-secret
77+
description: "Deleting a secret can break applications depending on it."
78+
id: aws:secretsmanager_delete
79+
severity: High
80+
- from: aws
81+
test: aws\s+elasticache\s+delete-cache-cluster
82+
description: "Deleting an ElastiCache cluster destroys all cached data."
83+
id: aws:elasticache_delete_cluster
84+
severity: High
85+
- from: aws
86+
test: aws\s+logs\s+delete-log-group
87+
description: "Deleting a CloudWatch log group permanently loses all log data."
88+
id: aws:logs_delete_log_group
89+
severity: High
90+
- from: aws
91+
test: aws\s+ecs\s+delete-(service|cluster)
92+
description: "Deleting an ECS service or cluster stops all running containers."
93+
id: aws:ecs_delete
94+
severity: High

shellfirm/checks/azure.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,18 @@
3535
description: "Deleting an Azure AD application or service principal can break authentication."
3636
id: azure:delete_ad_app
3737
severity: High
38+
- from: azure
39+
test: az\s+functionapp\s+delete
40+
description: "Deleting an Azure Function App removes it permanently."
41+
id: azure:delete_functionapp
42+
severity: High
43+
- from: azure
44+
test: az\s+webapp\s+delete
45+
description: "Deleting a web app removes it and all deployed code."
46+
id: azure:delete_webapp
47+
severity: High
48+
- from: azure
49+
test: az\s+cosmosdb\s+delete
50+
description: "Deleting a Cosmos DB account destroys all databases and data."
51+
id: azure:delete_cosmosdb
52+
severity: High

shellfirm/checks/base.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,40 @@
2323
description: "You are going to shutdown your machine."
2424
id: base:shutdown_machine
2525
severity: High
26+
- from: base
27+
test: kill\s+-9\s+
28+
description: "SIGKILL gives no chance for graceful shutdown or cleanup."
29+
id: process:kill_9
30+
severity: Low
31+
alternative: "kill <pid>"
32+
alternative_info: "Send SIGTERM first to allow graceful shutdown, then kill -9 if needed."
33+
- from: base
34+
test: killall\s+
35+
description: "Kills ALL processes matching the name."
36+
id: process:killall
37+
severity: Medium
38+
- from: base
39+
test: pkill\s+
40+
description: "Kills processes matching a pattern — could match unintended processes."
41+
id: process:pkill
42+
severity: Medium
43+
- from: base
44+
test: systemctl\s+(disable|mask)\s+
45+
description: "Disabling or masking a service prevents it from starting on boot."
46+
id: systemd:disable_service
47+
severity: Medium
48+
- from: base
49+
test: systemctl\s+stop\s+(docker|sshd|nginx|apache2|httpd|postgresql|mysql|redis)(\s|$)
50+
description: "Stopping a critical system service can cause outages."
51+
id: systemd:stop_critical_service
52+
severity: High
53+
- from: base
54+
test: ssh-add\s+-D
55+
description: "Removes all SSH identities from the agent."
56+
id: ssh:delete_all_identities
57+
severity: Medium
58+
- from: base
59+
test: ssh-keygen\s+-R\s+
60+
description: "Removes a host from known_hosts — could enable MITM attacks."
61+
id: ssh:remove_known_host
62+
severity: Low

shellfirm/checks/database.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,13 @@
3535
value: "WHERE"
3636
- type: NotContains
3737
value: "where"
38+
- from: database
39+
test: (?i)DROP\s+(SCHEMA|ROLE|USER)
40+
description: "Dropping a schema, role, or user is a destructive and often irreversible operation."
41+
id: database:drop_schema_role_user
42+
severity: High
43+
- from: database
44+
test: (?i)ALTER\s+TABLE\s+\w+\s+DROP\s+COLUMN
45+
description: "Dropping a column permanently removes data from all rows."
46+
id: database:alter_drop_column
47+
severity: High

shellfirm/checks/docker.yaml

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
- from: docker
2-
test: docker\s+system\s+prune\s+(-a|--all)
2+
test: docker\s+system\s+prune\s+.*(?:-[a-zA-Z]*a|--all)
33
description: "This will remove all unused Docker data including stopped containers, networks, dangling images, and build cache."
44
id: docker:system_prune_all
55
severity: High
@@ -31,7 +31,7 @@
3131
id: docker:remove_network
3232
severity: Medium
3333
- from: docker
34-
test: docker[\s-]compose\s+down\s+(-v|--volumes)
34+
test: docker[\s-]compose\s+down\s+.*(-v|--volumes)
3535
description: "This will stop containers AND delete all associated volumes and data."
3636
id: docker:compose_down_volumes
3737
severity: High
@@ -42,3 +42,20 @@
4242
description: "Stopping all running Docker containers."
4343
id: docker:stop_all_containers
4444
severity: Medium
45+
- from: docker
46+
test: docker\s+image\s+prune\s+.*(?:-[a-zA-Z]*a|--all)
47+
description: "Removes ALL images, not just dangling ones."
48+
id: docker:image_prune_all
49+
severity: High
50+
alternative: "docker image prune"
51+
alternative_info: "Without -a, only dangling images are removed."
52+
- from: docker
53+
test: docker\s+container\s+prune
54+
description: "Removes all stopped containers."
55+
id: docker:container_prune
56+
severity: Medium
57+
- from: docker
58+
test: docker\s+buildx\s+prune\s+.*--all
59+
description: "Clears the entire Docker build cache."
60+
id: docker:buildx_prune_all
61+
severity: High

shellfirm/checks/fs.yaml

Lines changed: 31 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
- from: fs
2-
test: 'rm\s{1,}(?:-R|-r|-f|-fR|-fr|-Rf|-rf|-v|--force|--verbose|--preserve-root)\s*(?:-R|-r|-f|-fR|-fr|-Rf|-rf|-v|--force|--verbose|--preserve-root)?\s*(\*|\.{1,}|/)\s*$'
2+
test: 'rm\s{1,}(?:-[rRfvV]+|--(?:force|recursive|verbose|preserve-root|no-preserve-root|one-file-system))(?:\s+(?:-[rRfvV]+|--(?:force|recursive|verbose|preserve-root|no-preserve-root|one-file-system)))*(?:\s+\S+)*?\s+(\*|\.{1,}|/)(?:\s|$)'
33
description: "You are going to delete everything in the path."
44
id: fs:recursively_delete
55
severity: Critical
@@ -25,7 +25,7 @@
2525
- type: PathExists
2626
value: 1
2727
- from: fs
28-
test: chmod\s{1,}(-R|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/)
28+
test: chmod\s{1,}(?:\S+\s+)*(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/)
2929
description: "Change permission to all root files can brake your some thinks like SSH keys."
3030
id: fs:recursively_chmod
3131
severity: Critical
@@ -37,52 +37,52 @@
3737
alternative: "find <path> -name '<pattern>' -print"
3838
alternative_info: "Preview what would be deleted with -print first, then add -delete when you're sure."
3939
- from: fs
40-
test: 'dd\s+.*of=/dev/([hs]d[a-z]|mmcblk[0-9])'
40+
test: 'dd\s+.*of=/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+)'
4141
description: "Are you sure you want to write directly to a block device? This could overwrite your disk."
4242
id: fs:dd_block_device
4343
severity: Critical
4444
- from: fs
45-
test: 'mkfs(?:\.(?:ext[2-4]|fat|ntfs|xfs|btrfs))?\s+(?:-t\s+\w+\s+)?/dev/([hs]d[a-z][0-9]*|mmcblk[0-9]p?[0-9]*)'
45+
test: 'mkfs(?:\.(?:ext[2-4]|fat|vfat|ntfs|xfs|btrfs))?\s+(?:-t\s+\w+\s+)?/dev/([hs]d[a-z][0-9]*|mmcblk[0-9]p?[0-9]*|nvme[0-9]+n[0-9]+(?:p[0-9]+)?)'
4646
description: "Are you sure you want to format this device? This will erase all data on it."
4747
id: fs:mkfs_format
4848
severity: Critical
4949
- from: fs
50-
test: 'parted\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
50+
test: 'parted\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
5151
description: "Are you sure you want to modify disk partitions? This could erase all data on the disk."
5252
id: fs:parted_disk_modify
5353
severity: Critical
5454
- from: fs
55-
test: 'fdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
55+
test: 'fdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
5656
description: "Are you sure you want to modify disk partitions? This could erase all data on the disk."
5757
id: fs:fdisk_disk_modify
5858
severity: Critical
5959
- from: fs
60-
test: 'sfdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
60+
test: 'sfdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
6161
description: "Are you sure you want to modify disk partitions? This could erase all data on the disk."
6262
id: fs:sfdisk_disk_modify
6363
severity: Critical
6464
- from: fs
65-
test: 'dd\s+.*(?:conv=notrunc|seek=\d+|skip=\d+).*of=/dev/([hs]d[a-z]|mmcblk[0-9])'
65+
test: 'dd\s+.*(?:conv=notrunc|seek=\d+|skip=\d+).*of=/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+)'
6666
description: "Are you sure you want to write to a specific sector of the disk? This could corrupt data."
6767
id: fs:dd_advanced_disk_write
6868
severity: Critical
6969
- from: fs
70-
test: 'gdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
70+
test: 'gdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
7171
description: "Are you sure you want to modify GPT disk partitions? This could erase all data on the disk."
7272
id: fs:gdisk_disk_modify
7373
severity: Critical
7474
- from: fs
75-
test: 'partprobe\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
75+
test: 'partprobe\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
7676
description: "Are you sure you want to inform the OS of partition table changes? This could affect mounted partitions."
7777
id: fs:partprobe_disk_update
7878
severity: High
7979
- from: fs
80-
test: 'blockdev\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
80+
test: 'blockdev\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
8181
description: "Are you sure you want to modify block device parameters? This could affect disk operations."
8282
id: fs:blockdev_disk_modify
8383
severity: High
8484
- from: fs
85-
test: 'mount\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
85+
test: 'mount\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
8686
description: "Are you sure you want to mount this device? This could affect system stability."
8787
id: fs:mount_operations
8888
severity: High
@@ -92,12 +92,12 @@
9292
id: fs:lvm_operations
9393
severity: Critical
9494
- from: fs
95-
test: '(?:dump|restore)\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
95+
test: '(?:dump|restore)\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
9696
description: "Are you sure you want to backup/restore this filesystem? This could affect system stability."
9797
id: fs:filesystem_backup
9898
severity: High
9999
- from: fs
100-
test: 'cryptsetup\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))'
100+
test: 'cryptsetup\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))'
101101
description: "Are you sure you want to encrypt/decrypt this device? This could affect data accessibility."
102102
id: fs:encryption_operations
103103
severity: Critical
@@ -122,3 +122,20 @@
122122
filters:
123123
- type: PathExists
124124
value: 1
125+
- from: fs
126+
test: rsync\s+.*--delete
127+
description: "Syncs with deletion — removes files at destination not present in source."
128+
id: fs:rsync_delete
129+
severity: High
130+
alternative: "rsync --dry-run --delete ..."
131+
alternative_info: "Preview what would be deleted with --dry-run first."
132+
filters:
133+
- type: NotContains
134+
value: "--dry-run"
135+
- type: NotContains
136+
value: "-n"
137+
- from: fs
138+
test: chown\s{1,}(?:\S+\s+)*(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/)
139+
description: "Recursive ownership change on root or wildcard can break system files and SSH keys."
140+
id: fs:recursively_chown
141+
severity: Critical

shellfirm/checks/gcp.yaml

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
id: gcp:delete_gke_cluster
2222
severity: High
2323
- from: gcp
24-
test: gsutil\s+rm\s+-r\s+gs://
24+
test: gsutil\s+(?:-\S+\s+)*rm\s+(?:-r\s+gs://|gs://\S+\s+-r)
2525
description: "Recursively deleting all objects in a GCS bucket."
2626
id: gcp:gcs_recursive_delete
2727
severity: High
@@ -37,3 +37,23 @@
3737
description: "Deleting a service account can break applications using it."
3838
id: gcp:delete_service_account
3939
severity: High
40+
- from: gcp
41+
test: gcloud\s+functions\s+delete
42+
description: "Deleting a Cloud Function removes it permanently."
43+
id: gcp:delete_function
44+
severity: High
45+
- from: gcp
46+
test: gcloud\s+run\s+services\s+delete
47+
description: "Deleting a Cloud Run service stops serving traffic."
48+
id: gcp:delete_cloud_run
49+
severity: High
50+
- from: gcp
51+
test: gcloud\s+pubsub\s+topics\s+delete
52+
description: "Deleting a Pub/Sub topic breaks all connected subscriptions."
53+
id: gcp:delete_pubsub_topic
54+
severity: High
55+
- from: gcp
56+
test: gcloud\s+secrets\s+delete
57+
description: "Deleting a secret can break applications depending on it."
58+
id: gcp:delete_secret
59+
severity: High

0 commit comments

Comments
 (0)