# Privilege Review Lens

Review operational infrastructure for **least-privilege violations and excessive permissions**.

## What to Look For

### Root & Sudo Usage
- Scripts running as root when not necessary
- `sudo` for operations that don't require it
- `curl ... | sudo bash` - dangerous remote execution pattern
- `NOPASSWD` sudo rules with broad commands or wildcards
- Missing privilege drop after initial setup

### Container Privileges
- Containers running as root (`USER` not set)
- `privileged: true` in Docker/Compose/Kubernetes
- Docker socket mounting (`/var/run/docker.sock`)
- Missing capability drops (`--cap-drop=ALL`)
- Host namespace usage: `--pid=host`, `--network=host`, `--ipc=host`
- K8s: `allowPrivilegeEscalation: true`, `hostPath` mounts, missing `runAsNonRoot`

### File & Binary Permissions
- `chmod 777` or `chmod 666` (world-writable)
- Secrets/keys with permissions broader than `0600`
- setuid/setgid bits on custom binaries (`chmod u+s`, `chmod g+s`)
- Writable paths in root's `$PATH` or systemd unit locations

### Network Binding
- Services binding `0.0.0.0` when `127.0.0.1` suffices
- Database/admin ports exposed globally in Docker Compose
- Binding low ports (<1024) as root instead of using capabilities

### systemd Sandboxing
- Missing `ProtectSystem=strict` (or `full` if strict breaks app)
- Missing `ProtectHome=yes`, `PrivateTmp=yes`, `NoNewPrivileges=yes`
- `User=root` when service could run unprivileged
- Missing `CapabilityBoundingSet=` restrictions
- For low ports: use `AmbientCapabilities=CAP_NET_BIND_SERVICE` instead of root

### Nix/NixOS Specific
- Secrets in Nix store (world-readable!) - use sops-nix/agenix instead
- Services without `DynamicUser=yes` when applicable
- Missing `StateDirectory=`, `CacheDirectory=` (proper isolation)
- Overly permissive `security.sudo.extraRules`

## Output Format

```
[PRIVILEGE] <severity:HIGH|MED|LOW> <file:line>
Issue: <what excessive permission exists>
Suggest: <specific least-privilege alternative>
Evidence: <permission pattern or config found>
```

## Compensating Controls

Downgrade severity if these are present:
- Container: `cap_drop=ALL` + specific `cap_add`, `read_only=true`, `no-new-privileges`
- systemd: `ProtectSystem`, `PrivateTmp`, capability restrictions
- Explicit justification comment for necessary privileges

## Common Fixes

```yaml
# Docker Compose: Least privilege
user: "1000:1000"
read_only: true
security_opt:
  - no-new-privileges:true
cap_drop: [ALL]
cap_add: [NET_BIND_SERVICE]  # only what's needed
```

```ini
# systemd: Hardened service
[Service]
User=myservice
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=CAP_NET_BIND_SERVICE  # for low ports
```

## Guidelines

- **HIGH** = root/privileged without justification, docker.sock mount, world-writable sensitive files
- **MED** = missing sandboxing, broad sudo, root with some restrictions
- **LOW** = could be tighter but has compensating controls
- Ask: "What's the minimum permission needed?"
- Consider compensating controls before flagging HIGH
- Nix store is world-readable - secrets there are HIGH severity
