|
1 | 1 | - from: fs |
2 | | - test: 'rm\s{1,}(?:-R|-r|-f|-fR|-fr|-Rf|-rf|-v|--force|--verbose|--preserve-root)\s*(?:-R|-r|-f|-fR|-fr|-Rf|-rf|-v|--force|--verbose|--preserve-root)?\s*(\*|\.{1,}|/)\s*$' |
| 2 | + test: 'rm\s{1,}(?:-[rRfvV]+|--(?:force|recursive|verbose|preserve-root|no-preserve-root|one-file-system))(?:\s+(?:-[rRfvV]+|--(?:force|recursive|verbose|preserve-root|no-preserve-root|one-file-system)))*(?:\s+\S+)*?\s+(\*|\.{1,}|/)(?:\s|$)' |
3 | 3 | description: "You are going to delete everything in the path." |
4 | 4 | id: fs:recursively_delete |
5 | 5 | severity: Critical |
|
25 | 25 | - type: PathExists |
26 | 26 | value: 1 |
27 | 27 | - from: fs |
28 | | - test: chmod\s{1,}(-R|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/) |
| 28 | + test: chmod\s{1,}(?:\S+\s+)*(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/) |
29 | 29 | description: "Change permission to all root files can brake your some thinks like SSH keys." |
30 | 30 | id: fs:recursively_chmod |
31 | 31 | severity: Critical |
|
37 | 37 | alternative: "find <path> -name '<pattern>' -print" |
38 | 38 | alternative_info: "Preview what would be deleted with -print first, then add -delete when you're sure." |
39 | 39 | - from: fs |
40 | | - test: 'dd\s+.*of=/dev/([hs]d[a-z]|mmcblk[0-9])' |
| 40 | + test: 'dd\s+.*of=/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+)' |
41 | 41 | description: "Are you sure you want to write directly to a block device? This could overwrite your disk." |
42 | 42 | id: fs:dd_block_device |
43 | 43 | severity: Critical |
44 | 44 | - from: fs |
45 | | - test: 'mkfs(?:\.(?:ext[2-4]|fat|ntfs|xfs|btrfs))?\s+(?:-t\s+\w+\s+)?/dev/([hs]d[a-z][0-9]*|mmcblk[0-9]p?[0-9]*)' |
| 45 | + test: 'mkfs(?:\.(?:ext[2-4]|fat|vfat|ntfs|xfs|btrfs))?\s+(?:-t\s+\w+\s+)?/dev/([hs]d[a-z][0-9]*|mmcblk[0-9]p?[0-9]*|nvme[0-9]+n[0-9]+(?:p[0-9]+)?)' |
46 | 46 | description: "Are you sure you want to format this device? This will erase all data on it." |
47 | 47 | id: fs:mkfs_format |
48 | 48 | severity: Critical |
49 | 49 | - from: fs |
50 | | - test: 'parted\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 50 | + test: 'parted\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
51 | 51 | description: "Are you sure you want to modify disk partitions? This could erase all data on the disk." |
52 | 52 | id: fs:parted_disk_modify |
53 | 53 | severity: Critical |
54 | 54 | - from: fs |
55 | | - test: 'fdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 55 | + test: 'fdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
56 | 56 | description: "Are you sure you want to modify disk partitions? This could erase all data on the disk." |
57 | 57 | id: fs:fdisk_disk_modify |
58 | 58 | severity: Critical |
59 | 59 | - from: fs |
60 | | - test: 'sfdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 60 | + test: 'sfdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
61 | 61 | description: "Are you sure you want to modify disk partitions? This could erase all data on the disk." |
62 | 62 | id: fs:sfdisk_disk_modify |
63 | 63 | severity: Critical |
64 | 64 | - from: fs |
65 | | - test: 'dd\s+.*(?:conv=notrunc|seek=\d+|skip=\d+).*of=/dev/([hs]d[a-z]|mmcblk[0-9])' |
| 65 | + test: 'dd\s+.*(?:conv=notrunc|seek=\d+|skip=\d+).*of=/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+)' |
66 | 66 | description: "Are you sure you want to write to a specific sector of the disk? This could corrupt data." |
67 | 67 | id: fs:dd_advanced_disk_write |
68 | 68 | severity: Critical |
69 | 69 | - from: fs |
70 | | - test: 'gdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 70 | + test: 'gdisk\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
71 | 71 | description: "Are you sure you want to modify GPT disk partitions? This could erase all data on the disk." |
72 | 72 | id: fs:gdisk_disk_modify |
73 | 73 | severity: Critical |
74 | 74 | - from: fs |
75 | | - test: 'partprobe\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 75 | + test: 'partprobe\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
76 | 76 | description: "Are you sure you want to inform the OS of partition table changes? This could affect mounted partitions." |
77 | 77 | id: fs:partprobe_disk_update |
78 | 78 | severity: High |
79 | 79 | - from: fs |
80 | | - test: 'blockdev\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 80 | + test: 'blockdev\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
81 | 81 | description: "Are you sure you want to modify block device parameters? This could affect disk operations." |
82 | 82 | id: fs:blockdev_disk_modify |
83 | 83 | severity: High |
84 | 84 | - from: fs |
85 | | - test: 'mount\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 85 | + test: 'mount\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
86 | 86 | description: "Are you sure you want to mount this device? This could affect system stability." |
87 | 87 | id: fs:mount_operations |
88 | 88 | severity: High |
|
92 | 92 | id: fs:lvm_operations |
93 | 93 | severity: Critical |
94 | 94 | - from: fs |
95 | | - test: '(?:dump|restore)\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 95 | + test: '(?:dump|restore)\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
96 | 96 | description: "Are you sure you want to backup/restore this filesystem? This could affect system stability." |
97 | 97 | id: fs:filesystem_backup |
98 | 98 | severity: High |
99 | 99 | - from: fs |
100 | | - test: 'cryptsetup\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]))' |
| 100 | + test: 'cryptsetup\s+.*(/dev/([hs]d[a-z]|mmcblk[0-9]|nvme[0-9]+n[0-9]+))' |
101 | 101 | description: "Are you sure you want to encrypt/decrypt this device? This could affect data accessibility." |
102 | 102 | id: fs:encryption_operations |
103 | 103 | severity: Critical |
|
122 | 122 | filters: |
123 | 123 | - type: PathExists |
124 | 124 | value: 1 |
| 125 | +- from: fs |
| 126 | + test: rsync\s+.*--delete |
| 127 | + description: "Syncs with deletion — removes files at destination not present in source." |
| 128 | + id: fs:rsync_delete |
| 129 | + severity: High |
| 130 | + alternative: "rsync --dry-run --delete ..." |
| 131 | + alternative_info: "Preview what would be deleted with --dry-run first." |
| 132 | + filters: |
| 133 | + - type: NotContains |
| 134 | + value: "--dry-run" |
| 135 | + - type: NotContains |
| 136 | + value: "-n" |
| 137 | +- from: fs |
| 138 | + test: chown\s{1,}(?:\S+\s+)*(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)\s+(?:\S+\s+)*(\*|\.{1,}|/) |
| 139 | + description: "Recursive ownership change on root or wildcard can break system files and SSH keys." |
| 140 | + id: fs:recursively_chown |
| 141 | + severity: Critical |
0 commit comments