Mozilla scribe host policy evaluator
Clone or download
Zack Mullaly
Latest commit fb71baf Jul 11, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
scribecmd gofmt some missed files Jul 19, 2017
scribevulnpolicy Fixed the error field in shortVulnResponse Jul 11, 2018
test make raw test a go test Jul 19, 2017
vendor vendor lib/pq Jul 18, 2017
.gitignore update gitignore to ignore generated test json files Jul 18, 2017
.travis.yml Update travis-ci to 1.6 Mar 18, 2016
LICENSE Initial commit Jul 7, 2015
Makefile remove external testing reference from Makefile Jul 19, 2017
README.md fix typo in README Jul 19, 2017
chain.go Use standard GOPATH Mar 18, 2016
concat.go Use standard GOPATH Mar 18, 2016
document.go remove exported GetTest and make existing getTest exported Jul 19, 2017
evr.go fix various golint warnings Jul 19, 2017
evrops.go fix various golint warnings Jul 19, 2017
evrops_test.go make evr tests actual go tests Jul 19, 2017
exactmatch.go fix various golint warnings Jul 19, 2017
filecontent.go fix various golint warnings Jul 19, 2017
filename.go fix various golint warnings Jul 19, 2017
fileops_test.go make filename tests a go test Jul 19, 2017
hasline.go fix various golint warnings Jul 19, 2017
meta_test.go make raw test a go test Jul 19, 2017
noop.go Use standard GOPATH Mar 18, 2016
object.go fix various golint warnings Jul 19, 2017
package.go fix various golint warnings Jul 19, 2017
package_test.go remove duplicate code and add a generic policy runner for tests Jul 19, 2017
parser.go fix various golint warnings Jul 19, 2017
pkgmgr.go fix various golint warnings Jul 19, 2017
raw.go fix various golint warnings Jul 19, 2017
regexp.go fix various golint warnings Jul 19, 2017
result.go remove exported GetTest and make existing getTest exported Jul 19, 2017
scribe.go fix various golint warnings Jul 19, 2017
scribe_test.go remove duplicate code and add a generic policy runner for tests Jul 19, 2017
test.go remove exported GetTest and make existing getTest exported Jul 19, 2017
variable.go fix various golint warnings Jul 19, 2017

README.md

scribe

scribe is a host policy evaluator written in Go.

Build Status Go Report Card

Overview

scribe is a Go library and frontend used to evaluate policies on systems. Policies are specified as a JSON or YAML document containing a series of tests, and these tests return a status indicating if the test criteria matched or not.

Tests reference objects in the policy file. An object can be considered an abstraction of some data from the system, for example a package version or the contents of a specific file. The tests also specify criteria that will be applied to the referenced object. For example, if an object returns a line from a given file, the test could indicate that the data must match specific content. If the match succeeeds, the test returns true.

It is intended to perform functions such as:

  • Identification of software versions that do not meet a specific requirement
  • Evaluation of hardening criteria or other system security policies
  • Any other functions involving extraction and analysis of host information

The software is designed to return only test status criteria, and meta-data associated with the test. It runs directly on the system being evaluated, and requires no data from the system to be returned to a central server for additional processing.

It's primary purpose is integration with Mozilla MIG which allows investigators to perform system evaluation by sending a policy to the MIG agent for execution. It is also suited to executing policies as part of an instance build and testing process, or periodically on an installed system.

Usage

Scribe policies can be evaluated using the scribecmd command line tool, or alternatively the scribe library can be included in another go application.

This example shows evaluation of a given policy file, where only tests that return true are displayed in the results.

$ ./scribecmd -f mypolicy.json -T

scribecmd supports other runtime options, see the usage output for details.

Vulnerability scanning

scribe can be used to perform vulnerability scanning directly on the system using a suitable policy file. The library implements various criteria specifications such as EVR (epoch/version/release) testing that can be used to determine if a given package version is less than what is required.

scribevulnpolicy is a policy generator that integrates with clair for vulnerability data. This tool can be used to generate scribe vulnerability check policies for supported platforms. For details on usage see the documentation for scribevulnpolicy.

Additional documentation

Additional documentation on the library is available at godoc.org.