app code attempting to delete /var/lib/securedrop/store

[redshiftzero]

Description

When I'm deleting files I'm seeing an OSSEC alert indicating that the app code is trying to rm /var/lib/securedrop/store (which contains all submissions). It's being stopped thanks to an AppArmor denial but this means there's a potentially very destructive bug and we need to carefully investigate why this is happening.

Expected behavior

No OSSEC alert

Actual behavior

OSSEC HIDS Notification.
2019 Nov 25 21:07:04

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 100012 fired (level 7) -> "Apparmor denied event"
Portion of the log(s):

Nov 25 21:07:04 app kernel: [ 2160.102070] audit: type=1400 audit(1574734024.249:26): apparmor="DENIED" operation="rmdir" profile="/usr/sbin/apache2" name="/var/lib/securedrop/store/" pid=3067 comm="apache2" requested_mask="d" denied_mask="d" fsuid=33 ouid=33



 --END OF NOTIFICATION

Comments

I would first investigate this method as it was recently merged and is performing deletions:

securedrop/securedrop/store.py

Line 235 in 1d8484e

def clear_shredder(self):

[redshiftzero]

Reproducer in dev:

1. Run on ae09438 (adds shredder service to dev env) this is the case even without the shredder running..
2. Sign into Journalist Interface
3. Select all -> Delete
4. Watch the store directory get deleted since we don't have the guard of AppArmor in the dev env

[redshiftzero]

this is due to the use of os.renames in store.Storage.move_to_shredder. The underlying issue is due a difference in behavior between os.rename and os.renames. From the docs:

After the rename, directories corresponding to rightmost path segments of the old name will be pruned away using removedirs().

this is what is deleting /var/lib/securedrop/store

[zenmonkeykstop]

Gonna update the test plan to cover this case. Good catch!