File I/O Security Feature
Support for API Protect was added to this rule in ARMR 2.9. Please see the API Protect Directives page in the ARMR documentation for information on how to configure this rule for API endpoint protection.
Overview
File operations, such as opening for reading or writing, modifying file attributes (such as last modified dates, etc.), can be controlled using the ARMR filesystem rule.
Some high-level examples of rules are:
-
Log a warning upon writing to any file
-
Allow / deny creation of new files in certain directories
-
Disallow writing to, or modification of, JAR files
-
Protect arbitrary files or directories from modification (for example, based on file extension, such as .rules and .xml files)
When (Event)
To control read and write access to files using the ARMR filesystem rule, the user can specify either the read or write declaration, respectively.
The user must specify either the read or the write declaration.
A parameter must be supplied to the read or write declaration to determine the files and / or directories that the ARMR filesystem rule will control access to.
Both Unix and Windows filesystem paths are supported
This parameter takes the form of a list of one or more quoted-strings indicating specifically targeted files/directories.
Each string represented in the parameter can be:
-
a single file or directory name - the agent will control access to any file or directory on the filesystem that matches the given name
-
an absolute path to a specific file or directory
The wildcard character (*) is supported anywhere in the file name or path:
-
only one wildcard character can be used with each path
-
if used at the end of a file path, the wildcard will represent all files and sub-directories recursively
-
this is equivalent to the file path simply ending with a file separator
-
if used in the middle of a file path, the wildcard will represent a single level of directories only
-
the wildcard can be used to specify all files with a specific prefix
-
the wildcard character specified on its own represents all files and directories on the filesystem
Then (Action)
There are three supported actions for the ARMR filesystem rule: protect, detect and allow.
| protect | All attempts to read from or write to a protected file are blocked. If configured, a log message is generated with details of the event. |
| detect | Monitoring mode: the application behaves as normal. A log message is generated with details of all attempts to read from or write to a protected file. A log message must be specified with this action. |
| allow | Can be used to allow access to specific files or directories under a parent directory that is covered by an ARMR filesystem rule in protect mode. |
As part of the action statement, the user may optionally specify the parameter stacktrace: “full”. When this parameter is specified, the stacktrace of the location of the attempted exploit is included in the security log entry.
Examples
All examples of the ARMR filesystem rule are given for both Unix and Windows style filesystem paths, where appropriate.
In the following example, we define an ARMR filesystem rule that protects all files in a specific directory from being read.
Unix
app("File read protect mod"):
requires(version: ARMR/2.7)
filesystem("Protect read access in specific directory"):
read("/tmp/*")
protect(message: "Unauthorized file read blocked", severity: 8)
endfilesystem
endapp
Windows
app("File read protect mod"):
requires(version: ARMR/2.7)
filesystem("Protect read access in specific directory"):
read("C:\\Windows\\*")
protect(message: "Unauthorized file read blocked", severity: 8)
endfilesystem
endapp
Specifying read("/tmp/") and read("C:\\Windows\\") would be functionally equivalent read declarations in the above two mods, respectively.
Logging
<10>1 2021-03-29T11:59:25.147+01:00 userX_system java 15891 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect read access in specific directory|Execute Rule|High|rt=Mar 29 2021 11:59:25.146 +0100 dvchost=userX_system procid=15891 appVersion=1 ruleType=filesystem securityFeature=filesystem read act=protect msg=Unauthorized file read blocked path=/tmp/somefile.txt
<10>1 2021-03-29T11:57:23.337+01:00 userX_system java 14223 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect read access in specific directory|Execute Rule|High|rt=Mar 29 2021 11:57:23.337 +0100 dvchost=userX_system procid=14223 appVersion=1 ruleType=filesystem securityFeature=filesystem read act=protect msg=Unauthorized file read blocked path=C:\\Windows\\somefile.txt
Further Examples
As above, with the stacktrace also logged
Unix
app("File read protect mod - with stacktrace"):
requires(version: ARMR/2.7)
filesystem("Protect read access in specific directory"):
read("/tmp/*")
protect(message: "Unauthorized file read blocked", severity: 8, stacktrace: "full")
endfilesystem
endapp
Windows
app("File read protect mod - with stacktrace"):
requires(version: ARMR/2.7)
filesystem("Protect read access in specific directory"):
read("C:\\Windows\\*")
protect(message: "Unauthorized file read blocked", severity: 8, stacktrace: "full")
endfilesystem
endapp
Logging
<10>1 2021-03-29T12:05:25.019+01:00 userX_system java 15891 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect read access in specific directory|Execute Rule|High|rt=Mar 29 2021 12:05:25.019 +0100 dvchost=userX_system procid=15891 appVersion=1 ruleType=filesystem securityFeature=filesystem read act=protect msg=Unauthorized file read blocked stacktrace=java.util.Scanner.<init>(Scanner.java:611)\ncom.waratek.spiracle.file.FileServlet.readFile(FileServlet.java:109)\ncom.waratek.spiracle.file.FileServlet.read(FileServlet.java:90)\ncom.waratek.spiracle.file.FileServlet.executeRequest(FileServlet.java:71)\ncom.waratek.spiracle.file.FileServlet.doPost(FileServlet.java:60)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:650)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:731)\nsun.reflect.GeneratedMethodAccessor32.invoke(Unknown Source)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\nsun.reflect.GeneratedMethodAccessor46.invoke(Unknown Source)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\norg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)\norg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1082)\norg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)\norg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:748) path=/tmp/somefile.txt
<10>1 2021-03-29T12:55:25.034+01:00 userX_system java 14222 - - CEF:0|ARMR:ARMR|ARMR|2.7|Protect read access in specific directory|Execute Rule|High|rt=Mar 29 2021 12:55:25.034 +0100 dvchost=userX_system procid=14222 appVersion=1 ruleType=filesystem securityFeature=filesystem read act=protect msg=Unauthorized file read blocked stacktrace=java.util.Scanner.<init>(Scanner.java:611)\ncom.waratek.spiracle.file.FileServlet.readFile(FileServlet.java:109)\ncom.waratek.spiracle.file.FileServlet.read(FileServlet.java:90)\ncom.waratek.spiracle.file.FileServlet.executeRequest(FileServlet.java:71)\ncom.waratek.spiracle.file.FileServlet.doPost(FileServlet.java:60)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:650)\njavax.servlet.http.HttpServlet.service(HttpServlet.java:731)\nsun.reflect.GeneratedMethodAccessor32.invoke(Unknown Source)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\nsun.reflect.GeneratedMethodAccessor46.invoke(Unknown Source)\nsun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\njava.lang.reflect.Method.invoke(Method.java:498)\norg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\norg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\norg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)\norg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\norg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\norg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\norg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\norg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\norg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\norg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)\norg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1082)\norg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)\norg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\njava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\njava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\norg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\njava.lang.Thread.run(Thread.java:748) path=C:\\Windows\\somefile.txt
Prevent reading any file
app("File read protect mod - wildcard all"):
requires(version: ARMR/2.7)
filesystem("Protect all read access"):
read("*")
protect(message: "Unauthorized file read blocked", severity: 8)
endfilesystem
endapp
Prevent writing to any file
app("File write protect mod - wildcard all"):
requires(version: ARMR/2.7)
filesystem("Protect all write access"):
write("*")
protect(message: "Unauthorized file write blocked", severity: 8)
endfilesystem
endapp
Prevent reading specific files
Unix
app("File read protect mod - specific files"):
requires(version: ARMR/2.7)
filesystem("Protect read access to specific files"):
read("/tmp/somefile.txt", "/tmp/somefile2.txt")
protect(message: "Unauthorized file read blocked", severity: 8)
endfilesystem
endapp
Windows
app("File read protect mod - specific files"):
requires(version: ARMR/2.7)
filesystem("Protect read access to specific files"):
read("C:\\Windows\\somefile.txt", "C:\\Windows\\somefile2.txt")
protect(message: "Unauthorized file read blocked", severity: 8)
endfilesystem
endapp
Detect attempts to write to a particular directory
Unix
app("File write detect mod - particular directory"):
requires(version: ARMR/2.7)
filesystem("Detect write operations"):
write("/tmp/")
detect(message: "Unauthorized file write detected", severity: 5)
endfilesystem
endapp
Windows
app("File write detect mod - particular directory"):
requires(version: ARMR/2.7)
filesystem("Detect write operations"):
write("C:\\Windows\\")
detect(message: "Unauthorized file write detected", severity: 5)
endfilesystem
endapp
Detect reading of any file with a specific name
app("File read detect mod - specific filename"):
requires(version: ARMR/2.7)
filesystem("Detect read of a file with a specific name"):
read("somefile.txt")
detect(message: "Unauthorized file read detected", severity: 5)
endfilesystem
endapp
Prevent writing to any file where the filename ends with a specific string
app("File write protect mod - file extension"):
requires(version: ARMR/2.7)
filesystem("Protect write access to .txt files"):
write("*.txt")
protect(message: "Unauthorized file write blocked", severity: 8)
endfilesystem
endapp
Prevent reading any file of a given name in any immediate sub-directories of a particular directory
Unix
app("File read protect mod"):
requires(version: ARMR/2.7)
filesystem("Protect read access"):
read("/tmp/*/somefile.txt")
protect(message: "Unauthorized file read blocked", severity: Medium)
endfilesystem
endapp
Windows
app("File read protect mod"):
requires(version: ARMR/2.7)
filesystem("Protect read access"):
read("C:\\Windows\\*\\somefile.txt")
protect(message: "Unauthorized file read blocked", severity: Medium)
endfilesystem
endapp
Prevent reading of all files in a directory, but allow reading of a specific file in this directory
Unix
app("File read controls"):
requires(version: ARMR/2.7)
filesystem("Protect read access to files in /tmp"):
read("/tmp/")
protect(message: "Unauthorized file read blocked", severity: High)
endfilesystem
filesystem("Allow read access to /tmp/somefile.txt"):
read("/tmp/somefile.txt")
allow(message: "Read access to /tmp/somefile.txt allowed", severity: Medium)
endfilesystem
endapp
Windows
app("File read controls"):
requires(version: ARMR/2.7)
filesystem("Protect read access to files in C:\\Windows"):
read("C:\\Windows\\")
protect(message: "Unauthorized file read blocked", severity: High)
endfilesystem
filesystem("Allow read access to C:\\Windows\somefile.txt"):
read("C:\\Windows\\somefile.txt")
allow(message: "Read access to C:\\Windows\somefile.txt allowed", severity: Medium)
endfilesystem
endapp
Logging On/Off Example
In the following example, logging is switched ON in the protect rule by the inclusion of the protect action message attribute. As the message attribute is defined as an empty string (""), a default message will be included in the security event msg extension. The allow rule allows read access of the specified file. Logging is switched OFF in the allow rule by the omission of the action message attribute.
app("File read controls"):
requires(version: ARMR/2.7)
filesystem("Protect read access to files in /tmp . Logging ON"):
read("/tmp/")
protect(message: "", severity: High)
endfilesystem
filesystem("Allow read access to /tmp/somefile.txt . Logging OFF"):
read("/tmp/somefile.txt")
allow(severity: Medium)
endfilesystem
endapp