## Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[persistent-users]
User=systemcheck

## Apt
[action:apt-get-update-kill-helper]
Command=/usr/libexec/helper-scripts/apt-get-update-kill-helper
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:apt-get-update-simulate]
Command=/usr/libexec/helper-scripts/apt-get-update-simulate
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:apt-check-lock-files]
Command=/usr/bin/fuser /var/lib/dpkg/lock /var/cache/apt/archives/lock
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Tor
[action:tor-verify-config]
Command=/usr/bin/tor --verify-config
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-signal-newnym]
Command=/usr/bin/tor-signal-newnym
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-dormant-check]
Command=/usr/bin/tor-dormant-check
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-bootstrap-check]
Command=/usr/libexec/helper-scripts/tor_bootstrap_check.py
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-circuit-established-check]
Command=/usr/bin/tor-circuit-established-check
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate,tb-updater
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-consensus-valid-after]
Command=/usr/libexec/helper-scripts/tor_consensus_valid-after.py
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate
TargetUser=debian-tor
TargetGroup=debian-tor

[action:tor-consensus-valid-until]
Command=/usr/libexec/helper-scripts/tor_consensus_valid-until.py
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user,sdwdate
TargetUser=debian-tor
TargetGroup=debian-tor

[action:onion-grater-status]
Command=/usr/bin/systemctl --no-pager --no-block status onion-grater
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:whonix-firewall-status]
Command=/usr/bin/systemctl --no-pager --no-block status whonix-firewall
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:check-tor-running]
Command=/usr/libexec/systemcheck/check_tor_running
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Sdwdate
[action:onion-time-pre-script]
Command=/usr/libexec/helper-scripts/onion-time-pre-script
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=sdwdate
TargetGroup=sdwdate

## Qubes
[action:qubes-updates-proxy-status]
Command=/usr/bin/systemctl --no-pager --no-block status qubes-updates-proxy.service
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## anondate
[action:anondate-verified-only-has-consensus]
Command=/usr/sbin/anondate --verified-only --has-consensus
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-has-consensus]
Command=/usr/sbin/anondate --unverified-only --has-consensus
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-current-time-in-valid-range]
Command=/usr/sbin/anondate --verified-only --current-time-in-valid-range
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-current-time-in-valid-range]
Command=/usr/sbin/anondate --unverified-only --current-time-in-valid-range
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-show-valid-after]
Command=/usr/sbin/anondate --verified-only --show-valid-after
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-show-valid-after]
Command=/usr/sbin/anondate --unverified-only --show-valid-after
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-show-valid-until]
Command=/usr/sbin/anondate --verified-only --show-valid-until
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-show-valid-until]
Command=/usr/sbin/anondate --unverified-only --show-valid-until
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-show-middle-range]
Command=/usr/sbin/anondate --verified-only --show-middle-range
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-show-middle-range]
Command=/usr/sbin/anondate --unverified-only --show-middle-range
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-user-permission]
Command=/usr/sbin/anondate --verified-only --user-permission
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-user-permission]
Command=/usr/sbin/anondate --unverified-only --user-permission
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-verified-only-group-permission]
Command=/usr/sbin/anondate --verified-only --group-permission
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-unverified-only-group-permission]
Command=/usr/sbin/anondate --unverified-only --group-permission
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-tor-cert-lifetime-valid]
Command=/usr/sbin/anondate --tor-cert-lifetime-valid
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:anondate-tor-cert-valid-after]
Command=/usr/sbin/anondate --tor-cert-valid-after
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Networking
[action:ifconfig-eth0-info]
Command=/usr/sbin/ifconfig eth0
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:ifconfig-eth1-info]
Command=/usr/sbin/ifconfig eth1
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:eth0-carrier]
Command=/usr/bin/cat /sys/class/net/eth0/carrier
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:eth1-carrier]
Command=/usr/bin/cat /sys/class/net/eth1/carrier
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## {{{ System logs

## Only allowed to user `systemcheck` to avoid exposing unhashed kernel
## addresses to less privileged users. See:
## https://github.com/Kicksecure/security-misc/issues/253
## Logs may also contain sensitive info from other processes (including some
## memory contents in the event of a segfault), or may expose details about
## the system's security configuration that are unsafe to expose.

[action:read-journalctl-logs-this-boot]
## Use '--output cat' to suppress timestamps to be able to de-duplicate.
##
## '--output cat' was too terse, it lacked information about which program was
## emitting warnings. systemcheck is able to ignore the timestamps.
Command=env SYSTEMD_COLORS='no' /usr/bin/journalctl --boot --no-pager --output short
AuthorizedUsers=systemcheck

[action:read-journalctl-logs-last-boot]
Command=env SYSTEMD_COLORS='no' /usr/bin/journalctl --boot=-1 --no-pager --output short
AuthorizedUsers=systemcheck

[action:read-apparmor-info]
Command=/usr/sbin/apparmor-info --boot
AuthorizedUsers=systemcheck

## Wrapper that allows reading limited info from sensitive logs.
[action:log-checker-kernel]
Command=/usr/libexec/systemcheck/log-checker kernel
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=systemcheck

[action:log-checker-check_service_logs_this_boot]
Command=/usr/libexec/systemcheck/log-checker check_service_logs this_boot
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=systemcheck

[action:log-checker-check_service_logs_last_boot]
Command=/usr/libexec/systemcheck/log-checker check_service_logs last_boot
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=systemcheck

[action:log-checker-check_critical_logs]
Command=/usr/libexec/systemcheck/log-checker check_critical_logs
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
TargetUser=systemcheck

## These forms of logs are considered safe to expose directly.
[action:read-journalctl-logs-whonix-firewall]
Command=/usr/bin/journalctl --boot --no-pager  --output cat -u whonix-firewall
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:read-systemctl-logs-failed-units]
Command=/usr/bin/systemctl --no-legend --no-pager --no-block --state=failed,activating,deactivating list-units
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:read-systemctl-logs-failed-units-pretty]
Command=/usr/bin/systemctl --no-pager --no-block --state=failed,activating,deactivating list-units
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## }}}

## Vuln checks
[action:spectre-meltdown-checker]
Command=/usr/bin/spectre-meltdown-checker --paranoid
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Warrant canary
[action:check-warrant-canary]
Command=/usr/bin/systemctl --no-pager --no-block status canary
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Clocksource
[action:sys-current-clocksource]
Command=/usr/bin/cat /sys/devices/system/clocksource/clocksource0/current_clocksource
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:sys-available-clocksource]
Command=/usr/bin/cat /sys/devices/system/clocksource/clocksource0/available_clocksource
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Virtualization detection
[action:systemd-detect-virt]
Command=/usr/bin/systemd-detect-virt
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Checking that privleap works
[action:check-privleap]
Command=/usr/bin/test -x /usr/bin/test
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Checking that privleap runs with correct environment variables
[action:check-privleap-environment-variables]
Command=/usr/libexec/systemcheck/check-env
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Checking that sudo works
[action:check-sudo]
Command=/usr/bin/sudo --non-interactive -- /usr/bin/test -x /usr/bin/test
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## Login security check
[action:get-password-status-list]
Command=/usr/libexec/helper-scripts/get-password-status-list
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

## GRUB security check
[action:grub-password-status-check]
Command=/usr/sbin/grub-password-status-check
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user

[action:user-sysmaint-split-check]
Command=/usr/libexec/systemcheck/user-sysmaint-split-check
AuthorizedGroups=sudo,privleap
AuthorizedUsers=user
