Skip to content

Commit e4f6cea

Browse files
author
Cristy
committed
enable coder policy for MVG "write" rights
1 parent eabda19 commit e4f6cea

File tree

4 files changed

+157
-0
lines changed

4 files changed

+157
-0
lines changed

‎config/policy-limited.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@
8585
<!-- Indirect reads are not permitted. -->
8686
<policy domain="path" rights="none" pattern="@*"/>
8787
<!-- These image types are security risks on read, but write is fine -->
88+
<policy domain="coder" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
8889
<policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
8990
<!-- This policy sets the number of times to replace content of certain
9091
memory buffers and temporary files before they are freed or deleted. -->

‎config/policy-open.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,7 @@
140140
<!-- Indirect reads are not permitted. -->
141141
<!-- <policy domain="path" rights="none" pattern="@*"/> -->
142142
<!-- These image types are security risks on read, but write is fine -->
143+
<!-- <policy domain="coder" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/> -->
143144
<!-- <policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/> -->
144145
<!-- This policy sets the number of times to replace content of certain
145146
memory buffers and temporary files before they are freed or deleted. -->

‎config/policy-secure.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@
9393
<!-- Indirect reads are not permitted. -->
9494
<policy domain="path" rights="none" pattern="@*"/>
9595
<!-- These image types are security risks on read, but write is fine -->
96+
<policy domain="coder" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
9697
<policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
9798
<!-- This policy sets the number of times to replace content of certain
9899
memory buffers and temporary files before they are freed or deleted. -->

‎config/policy.xml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE policymap [
3+
<!ELEMENT policymap (policy)*>
4+
<!ATTLIST policymap xmlns CDATA #FIXED "">
5+
<!ELEMENT policy EMPTY>
6+
<!ATTLIST policy xmlns CDATA #FIXED "">
7+
<!ATTLIST policy domain NMTOKEN #REQUIRED>
8+
<!ATTLIST policy name NMTOKEN #IMPLIED>
9+
<!ATTLIST policy pattern CDATA #IMPLIED>
10+
<!ATTLIST policy rights NMTOKEN #IMPLIED>
11+
<!ATTLIST policy stealth NMTOKEN #IMPLIED>
12+
<!ATTLIST policy value CDATA #IMPLIED>
13+
]>
14+
<!--
15+
Creating a security policy that fits your specific local environment
16+
before making use of ImageMagick is highly advised. You can find guidance on
17+
setting up this policy at https://imagemagick.org/script/security-policy.php,
18+
and it's important to verify your policy using the validation tool located
19+
at https://imagemagick-secevaluator.doyensec.com/.
20+
21+
22+
Open ImageMagick security policy:
23+
24+
The default policy for ImageMagick installations is the open security
25+
policy. This policy is designed for usage in secure settings like those
26+
protected by firewalls or within Docker containers. Within this framework,
27+
ImageMagick enjoys broad access to resources and functionalities. This policy
28+
provides convenient and adaptable options for image manipulation. However,
29+
it's important to note that it might present security vulnerabilities in
30+
less regulated conditions. Thus, organizations should thoroughly assess
31+
the appropriateness of the open policy according to their particular use
32+
case and security prerequisites.
33+
34+
ImageMagick security policies in a nutshell:
35+
36+
Domains include system, delegate, coder, filter, module, path, or resource.
37+
38+
Rights include none, read, write, execute and all. Use | to combine them,
39+
for example: "read | write" to permit read from, or write to, a path.
40+
41+
Use a glob expression as a pattern.
42+
43+
Suppose we do not want users to process MPEG video images, use this policy:
44+
45+
<policy domain="delegate" rights="none" pattern="mpeg:decode" />
46+
47+
Here we do not want users reading images from HTTP:
48+
49+
<policy domain="coder" rights="none" pattern="HTTP" />
50+
51+
The /repository file system is restricted to read only. We use a glob
52+
expression to match all paths that start with /repository:
53+
54+
<policy domain="path" rights="read" pattern="/repository/*" />
55+
56+
Prevent users from executing any image filters:
57+
58+
<policy domain="filter" rights="none" pattern="*" />
59+
60+
Cache large images to disk rather than memory:
61+
62+
<policy domain="resource" name="area" value="1GP"/>
63+
64+
Use the default system font unless overridden by the application:
65+
66+
<policy domain="system" name="font" value="/usr/share/fonts/favorite.ttf"/>
67+
68+
Define arguments for the memory, map, area, width, height and disk resources
69+
with SI prefixes (.e.g 100MB). In addition, resource policies are maximums
70+
for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
71+
exceeds policy maximum so memory limit is 1GB).
72+
73+
Rules are processed in order. Here we want to restrict ImageMagick to only
74+
read or write a small subset of proven web-safe image types:
75+
76+
<policy domain="delegate" rights="none" pattern="*" />
77+
<policy domain="filter" rights="none" pattern="*" />
78+
<policy domain="coder" rights="none" pattern="*" />
79+
<policy domain="coder" rights="read|write" pattern="{GIF,JPEG,PNG,WEBP}" />
80+
81+
See https://imagemagick.org/script/security-policy.php for a deeper
82+
understanding of ImageMagick security policies.
83+
-->
84+
<policymap>
85+
<policy domain="Undefined" rights="none"/>
86+
<!-- Set maximum parallel threads. -->
87+
<!-- <policy domain="resource" name="thread" value="2"/> -->
88+
<!-- Set maximum time to live in seconds or mnemonics, e.g. "2 minutes". When
89+
this limit is exceeded, an exception is thrown and processing stops. -->
90+
<!-- <policy domain="resource" name="time" value="120"/> -->
91+
<!-- Set maximum number of open pixel cache files. When this limit is
92+
exceeded, any subsequent pixels cached to disk are closed and reopened
93+
on demand. -->
94+
<!-- <policy domain="resource" name="file" value="768"/> -->
95+
<!-- Set maximum amount of memory in bytes to allocate for the pixel cache
96+
from the heap. When this limit is exceeded, the image pixels are cached
97+
to memory-mapped disk. -->
98+
<!-- <policy domain="resource" name="memory" value="256MiB"/> -->
99+
<!-- Set maximum amount of memory map in bytes to allocate for the pixel
100+
cache. When this limit is exceeded, the image pixels are cached to
101+
disk. -->
102+
<!-- <policy domain="resource" name="map" value="512MiB"/> -->
103+
<!-- Set the maximum width * height of an image that can reside in the pixel
104+
cache memory. Images that exceed the area limit are cached to disk. -->
105+
<!-- <policy domain="resource" name="area" value="16KP"/> -->
106+
<!-- Set maximum amount of disk space in bytes permitted for use by the pixel
107+
cache. When this limit is exceeded, the pixel cache is not be created
108+
and an exception is thrown. -->
109+
<!-- <policy domain="resource" name="disk" value="1GiB"/> -->
110+
<!-- Set the maximum length of an image sequence. When this limit is
111+
exceeded, an exception is thrown. -->
112+
<!-- <policy domain="resource" name="list-length" value="32"/> -->
113+
<!-- Set the maximum width of an image. When this limit is exceeded, an
114+
exception is thrown. -->
115+
<!-- <policy domain="resource" name="width" value="8KP"/> -->
116+
<!-- Set the maximum height of an image. When this limit is exceeded, an
117+
exception is thrown. -->
118+
<!-- <policy domain="resource" name="height" value="8KP"/> -->
119+
<!-- Periodically yield the CPU for at least the time specified in
120+
milliseconds. -->
121+
<!-- <policy domain="resource" name="throttle" value="2"/> -->
122+
<!-- Do not create temporary files in the default shared directories, instead
123+
specify a private area to store only ImageMagick temporary files. -->
124+
<!-- <policy domain="resource" name="temporary-path" value="/magick/tmp/"/> -->
125+
<!-- Force memory initialization by memory mapping select memory
126+
allocations. -->
127+
<!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
128+
<!-- Ensure all image data is fully flushed and synchronized to disk. -->
129+
<!-- <policy domain="cache" name="synchronize" value="true"/> -->
130+
<!-- Replace passphrase for secure distributed processing -->
131+
<!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
132+
<!-- Do not permit any delegates to execute. -->
133+
<!-- <policy domain="delegate" rights="none" pattern="*"/> -->
134+
<!-- Do not permit any image filters to load. -->
135+
<!-- <policy domain="filter" rights="none" pattern="*"/> -->
136+
<!-- Don't read/write from/to stdin/stdout. -->
137+
<!-- <policy domain="path" rights="none" pattern="-"/> -->
138+
<!-- don't read sensitive paths. -->
139+
<!-- <policy domain="path" rights="none" pattern="/etc/*"/> -->
140+
<!-- Indirect reads are not permitted. -->
141+
<!-- <policy domain="path" rights="none" pattern="@*"/> -->
142+
<!-- These image types are security risks on read, but write is fine -->
143+
<!-- <policy domain="coder" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/> -->
144+
<!-- <policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/> -->
145+
<!-- This policy sets the number of times to replace content of certain
146+
memory buffers and temporary files before they are freed or deleted. -->
147+
<!-- <policy domain="system" name="shred" value="1"/> -->
148+
<!-- Enable the initialization of buffers with zeros, resulting in a minor
149+
performance penalty but with improved security. -->
150+
<!-- <policy domain="system" name="memory-map" value="anonymous"/> -->
151+
<!-- Set the maximum amount of memory in bytes that are permitted for
152+
allocation requests. -->
153+
<!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
154+
</policymap>

0 commit comments

Comments
 (0)