Create mongo key file securely

monkey/monkey_island/cc/server_utils/consts.py

@@ -1,8 +1,8 @@
 import os
 from pathlib import Path
 
-from monkey_island.cc.environment.utils import is_windows_os
 from monkey_island.cc.server_utils import file_utils
+from monkey_island.cc.server_utils.file_utils import is_windows_os
 
 __author__ = "itay.mizeretz"
 

monkey/monkey_island/cc/server_utils/encryptor.py

@@ -6,6 +6,8 @@
 from Crypto import Random  # noqa: DUO133  # nosec: B413
 from Crypto.Cipher import AES  # noqa: DUO133  # nosec: B413
 
+from monkey_island.cc.server_utils.file_utils import get_file_descriptor_for_new_secure_file
+
 __author__ = "itay.mizeretz"
 
 _encryptor = None
@@ -25,7 +27,7 @@ def __init__(self, password_file_dir):
 
     def _init_key(self, password_file):
         self._cipher_key = Random.new().read(self._BLOCK_SIZE)
-        with open(password_file, "wb") as f:
+        with open(get_file_descriptor_for_new_secure_file(path=password_file), "wb") as f:
             f.write(self._cipher_key)
 
     def _load_existing_key(self, password_file):

monkey/monkey_island/cc/server_utils/file_utils.py

@@ -1,5 +1,110 @@
+import logging
 import os
+import platform
+import stat
+
+LOG = logging.getLogger(__name__)
+
+
+def is_windows_os() -> bool:
+    return platform.system() == "Windows"
+
+
+if is_windows_os():
+    import win32file
+    import win32job
+    import win32security
+
+    import monkey_island.cc.server_utils.windows_permissions as windows_permissions
 
 
 def expand_path(path: str) -> str:
     return os.path.expandvars(os.path.expanduser(path))
+
+
+def create_secure_directory(path: str):
+    if not os.path.isdir(path):
+        if is_windows_os():
+            _create_secure_directory_windows(path)
+        else:
+            _create_secure_directory_linux(path)
+
+
+def _create_secure_directory_linux(path: str):
+    try:
+        # Don't split directory creation and permission setting
+        # because it will temporarily create an accessible directory which anyone can use.
+        os.mkdir(path, mode=stat.S_IRWXU)
+
+    except Exception as ex:
+        LOG.error(f'Could not create a directory at "{path}": {str(ex)}')
+        raise ex
+
+
+def _create_secure_directory_windows(path: str):
+    try:
+        security_attributes = win32security.SECURITY_ATTRIBUTES()
+        security_attributes.SECURITY_DESCRIPTOR = (
+            windows_permissions.get_security_descriptor_for_owner_only_perms()
+        )
+        win32file.CreateDirectory(path, security_attributes)
+
+    except Exception as ex:
+        LOG.error(f'Could not create a directory at "{path}": {str(ex)}')
+        raise ex
+
+
+def get_file_descriptor_for_new_secure_file(path: str) -> int:
+    if is_windows_os():
+        return _get_file_descriptor_for_new_secure_file_windows(path)
+    else:
+        return _get_file_descriptor_for_new_secure_file_linux(path)
+
+
+def _get_file_descriptor_for_new_secure_file_linux(path: str) -> int:
+    try:
+        mode = stat.S_IRUSR | stat.S_IWUSR
+        flags = (
+            os.O_RDWR | os.O_CREAT | os.O_EXCL
+        )  # read/write, create new, throw error if file exists
+        fd = os.open(path, flags, mode)
+
+        return fd
+
+    except Exception as ex:
+        LOG.error(f'Could not create a file at "{path}": {str(ex)}')
+        raise ex
+
+
+def _get_file_descriptor_for_new_secure_file_windows(path: str) -> int:
+    try:
+        file_access = win32file.GENERIC_READ | win32file.GENERIC_WRITE
+        # subsequent open operations on the object will succeed only if read access is requested
+        file_sharing = win32file.FILE_SHARE_READ
+        security_attributes = win32security.SECURITY_ATTRIBUTES()
+        security_attributes.SECURITY_DESCRIPTOR = (
+            windows_permissions.get_security_descriptor_for_owner_only_perms()
+        )
+        file_creation = win32file.CREATE_NEW  # fails if file exists
+        file_attributes = win32file.FILE_FLAG_BACKUP_SEMANTICS
+
+        fd = win32file.CreateFile(
+            path,
+            file_access,
+            file_sharing,
+            security_attributes,
+            file_creation,
+            file_attributes,
+            _get_null_value_for_win32(),
+        )
+
+        return fd
+
+    except Exception as ex:
+        LOG.error(f'Could not create a file at "{path}": {str(ex)}')
+        raise ex
+
+
+def _get_null_value_for_win32() -> None:
+    # https://stackoverflow.com/questions/46800142/in-python-with-pywin32-win32job-the-createjobobject-function-how-do-i-pass-nu  # noqa: E501
+    return win32job.CreateJobObject(None, "")

monkey/monkey_island/cc/setup/config_setup.py

@@ -2,9 +2,9 @@
 
 from monkey_island.cc.arg_parser import IslandCmdArgs
 from monkey_island.cc.environment import server_config_handler
-from monkey_island.cc.environment.utils import create_secure_directory
 from monkey_island.cc.server_utils import file_utils
 from monkey_island.cc.server_utils.consts import DEFAULT_SERVER_CONFIG_PATH
+from monkey_island.cc.server_utils.file_utils import create_secure_directory
 from monkey_island.cc.setup.island_config_options import IslandConfigOptions
 
 

monkey/monkey_island/cc/setup/mongo/mongo_setup.py

@@ -5,7 +5,7 @@
 import time
 
 from monkey_island.cc.database import get_db_version, is_db_server_up
-from monkey_island.cc.environment.utils import create_secure_directory
+from monkey_island.cc.server_utils.file_utils import create_secure_directory
 from monkey_island.cc.setup.mongo import mongo_connector
 from monkey_island.cc.setup.mongo.mongo_connector import MONGO_DB_HOST, MONGO_DB_NAME, MONGO_DB_PORT
 from monkey_island.cc.setup.mongo.mongo_db_process import MongoDbProcess