NAME
bogosec - source-code security quality metric using established static
source-code scanners
SYNOPSIS
bogosec [-l] [--log-dir directory ] [--min-sev 0-10 ] [--nhf] [-p
plugin_name [args] ] [--plugin-dir directory ] [--sev-range-max num ]
[--timeout num ] [--temp-log-dir directory ] [-v 0|1 ] [--xp
plugin_name ] [--xv vuln_list ] TARGET
DESCRIPTION
BogoSec attempts to influence developers to produce more secure source-
code over time. Various existing scanners point developers to
potentially insecure sections of code. BogoSec broadens the scope of
source-code scans by utilizing multiple independent scanners and
compiling the results into high level calculated metrics. These
metrics can help developers and users alike to comparatively judge the
security quality of source-code.
OPTIONS
-l Turn on scanner output logging. Log will be called
<scanner_name>.log and created in current working directory,
unless --log-dir is used to specify a different location.
--log-dir directory
Specify a directory for scanner output logs (only makes sense if
-l is also used). Default is current working directory.
--min-sev minimum_severity_level
Specify a minimum severity level. Any vulnerabilities reported
by the scanners whose score falls below this number will be
ignored. The argument must be a number 0-10. Default is 0.
--nhf, --no-header-files
Do not scan header files. Useful if the scanners being used do
not support scanning header files.
-p, --plugin plugin_name [args]
Specify a plugin to use. If no plugins are defined on the
command line, all of the plugins in the plugins_dir will be
used. This option can be passed more than once, to specify a set
of scanners to use. Each scanner requires a separate instance of
the --plugin flag (please see examples). Optionally, a set of
command line arguments can be passed to the scanner -- this
feature must be used with care. Keep in mind that the plugin
requires a certain formatting of the scanner output (for
example, ’-SQ’ is always passed to flawfinder, and ’-w 3’ is
always passed to rats). You can pass additional command line
arguments using this option, but be aware of the effect it might
have on the formatting of the scanner output, and the effect
that will have on the plugin’s ability to parse it correctly.
If you must change the defaults (’-SQ’, ’-w 3’, etc.) you must
edit the plugin directly.
--plugin-dir directory
Specify the directory where the plugins are stored. Default is
/usr/lib/bogosec/plugins.
--sev-range-max number
Specify the maximum severity value to be used in calculating the
severity value range. The default is 10. For example, setting
--sev-range-max to 50 would mean that the severity results would
now be on a scale of 0-50 instead of on a scale of 0-10. This
can be used to scale the result if more granularity is required.
NOTE: -v 1 will not work if this option is used.
--timeout number
Specify the cpu time limit in seconds. Some scanners might hang,
in order to overcome this problem you may choose to set the
timeout to an appropriate period to kill the scanner process.
For example setting --timeout 60, will kill any remaining
scanner processes after 60 seconds, and return control to the
main bogosec process. This option uses the ulimit command,
please refer to ulimit manpage for additional information.
--temp-log-dir directory
Specify a directory where you want the temporary files used by
BogoSec to be stored (scanner output logs, etc.) The default is
/tmp/.
-v, --verbosity 0|1
Specify verbosity level (default is 0). If 1, then a graph of
the severity points is shown, which breaks the results down by
severity levels. This option does not work if the
--sev-range-max is changed from 10.
--xp, --exclude-plugin plugin_name
Do not run plugin defined by plugin_name.
--xv, --exclude-vuln vuln_list
Exclude the vulnerabilites in the vuln_list from the final
bogosec calculation. vuln_list is a ":" separated list of
vulnerability identifiers.
TOOLS
bogosec_wrapper provides a method to run bogosec automatically on a
directory containing multiple targets. Please refer to bogosec_wrapper
man page for additional information.
FILES
/etc/bogosec.conf
Global configuration file. The settings here are overwritten by
any settings in user’s ~/.bogosecrc file.
~/.bogosecrc
Default user configuration file (overrides the settings in
/etc/bogosec.conf). This file is not created during an
installation, you must create it yourself.
/usr/lib/bogosec/plugins/
Default plugins directory. Can be changed with --plugin-dir
option. Plugins must be executable, and must end in .pm as per
convention.
/usr/lib/bogosec/documents/
Directory of BogoSec documentation and other germane documents.
SCANNERS
FlawFinder : http://www.dwheeler.com/flawfinder
RATS : http://www.securesoftware.com/resources/tools.html
BUGS
Not all input validated. Not all environmental variables checked.
This program expects to be run by trusted users.
AUTHORS
Developed by Dustin Kirkland, Agoston Petz, and Loulwa Salem at the IBM
Linux Technology Center.
http://sourceforge.net/projects/bogosec/