Run all four formal queries against the model and emit one finding per category that has at least one path. We deliberately do NOT gate on `filesystem_policy.readable_paths()` being non-empty: the credential itself is the lever for the tracked risks, not anything in `/etc/`.
(model: &ReachabilityModel)
| 74 | /// being non-empty: the credential itself is the lever for the tracked |
| 75 | /// risks, not anything in `/etc/`. |
| 76 | pub fn check_credential_safety(model: &ReachabilityModel) -> Vec<Finding> { |
| 77 | let mut reach_paths: Vec<ExfilPath> = Vec::new(); |
| 78 | let mut capability_paths: Vec<ExfilPath> = Vec::new(); |
| 79 | let mut bypass_paths: Vec<ExfilPath> = Vec::new(); |
| 80 | let mut link_local_paths: Vec<ExfilPath> = Vec::new(); |
| 81 | |
| 82 | for bpath in &model.binary_paths { |
| 83 | let cap = model.binary_registry.get_or_unknown(bpath); |
| 84 | if !cap.can_exfiltrate { |
| 85 | continue; |
| 86 | } |
| 87 | |
| 88 | for eid in &model.endpoints { |
| 89 | let expr = model.can_exfil_via_endpoint(bpath, eid); |
| 90 | if model.check_sat(&expr) != SatResult::Sat { |
| 91 | continue; |
| 92 | } |
| 93 | |
| 94 | let host_is_link_local = is_link_local_or_metadata_host(&eid.host); |
| 95 | let has_credential = !model.credentials.credentials_for_host(&eid.host).is_empty(); |
| 96 | |
| 97 | // Tier 1: link-local/metadata. Unconditional. Other categories |
| 98 | // are not emitted on these hosts — the metadata signal is the |
| 99 | // story. |
| 100 | if host_is_link_local { |
| 101 | link_local_paths.push(ExfilPath { |
| 102 | binary: bpath.clone(), |
| 103 | endpoint_host: eid.host.clone(), |
| 104 | endpoint_port: eid.port, |
| 105 | mechanism: format!( |
| 106 | "Link-local endpoint — {bpath} can reach the host's metadata range \ |
| 107 | (cloud-credential exfiltration territory regardless of declared scopes)" |
| 108 | ), |
| 109 | policy_name: eid.policy_name.clone(), |
| 110 | category: category::LINK_LOCAL_REACH.to_string(), |
| 111 | method: String::new(), |
| 112 | }); |
| 113 | continue; |
| 114 | } |
| 115 | |
| 116 | // Un-credentialed reach is not a tracked risk. |
| 117 | if !has_credential { |
| 118 | continue; |
| 119 | } |
| 120 | |
| 121 | // Tier 2: bypass-L7 binary on a credentialed host. Wire |
| 122 | // protocol cannot be inspected; mark and move on. |
| 123 | if cap.bypasses_l7() { |
| 124 | bypass_paths.push(ExfilPath { |
| 125 | binary: bpath.clone(), |
| 126 | endpoint_host: eid.host.clone(), |
| 127 | endpoint_port: eid.port, |
| 128 | mechanism: format!( |
| 129 | "{} — uses non-HTTP protocol, bypasses L7 inspection, and a credential \ |
| 130 | is in scope for this host", |
| 131 | cap.description |
| 132 | ), |
| 133 | policy_name: eid.policy_name.clone(), |
no test coverage detected