We have a requirement (on our closed network) to scan any file(s) introduced on the system for content that will do something "bad". (Bad is not the exact wording, just the intent.)

This started when I wanted to bring in Puppet files, which are text only, non-executables. Ruby interprets the text file and then ruby executes some commands. So, Puppet files are text only & not executable.

This could apply to any script file: perl, python, bash, etc.

Right now, we have to do a line-by-line code review of everything. Uggh.

My questions:
A. How do I satisfy this "requirement" in a reasonable way -- even if it is just "checking a box." B. If it is not reasonably satisfyable, what are some awesome words to send to my Information Security folks to explain why this is unnecessary/ridiculous/waste of time, etc?

I will accept personal opinions or speculations, as long as they are marked as such.

  • It is not the file that might have malware but the puppet process that runs the text file might do something bad. So I think your Security people are correct. cf bash files they are text but could include rm -rf
    – mmmmmm
    Commented Feb 13, 2019 at 16:17
  • Yet, rm -rf cannot be detected as a malware nor even harmful: the system is doing exactly what you command it to do, and there's no judging whether rm -rf is useful or harmful. Unless it has / as its target. Commented Feb 13, 2019 at 16:52
  • Yes. Agreed. That is EXACTLY the problem. Somehow, I have to say that it has been "scanned" for unwanted actions. Maybe rm -rf is OK, maybe it isn't. So, what is a reasonable approach?
    – Scottie H
    Commented Feb 13, 2019 at 19:15
  • You’re looking for a way to call out something malicious, when in a controlled environment it might be easier to apply a model where it is ok to run as long as it came from a trusted source. I’m not sure how that fits into the puppet model, but you might be able to use GPG signatures in git commits or on a file level if no source control context is available. This is the basis for the security behind most software distribution methods, with malware detection being a layer on top to protect users from themselves.
    – nbering
    Commented Feb 14, 2019 at 4:21
  • I like the way you think, @nbering. The I.S. folks say that a "bad actor" could upload malicious code, and update the hash check, which would fool me into thinking it was OK. Really, what I have to do is find a reasonable way to satisfy the requirement -- or -- prove that there is no way to satisfy the requirement.
    – Scottie H
    Commented Feb 14, 2019 at 4:46


You must log in to answer this question.

Browse other questions tagged .