Netplan security¶
Overview of security aspects of Netplan.
Storing credentials¶
Credentials, such as VPN keys and Wi-Fi passwords, are stored along with the rest
of the configuration in YAML files. The recommended set of file permissions is
to have all YAML files owned by and only readable/writable by the root user (chmod 600
).
When using Network Manager to manage WireGuard tunnels, you can rely on an
external key chain to store your private keys. For more details, see private-key-flags
in the Netplan YAML configuration reference.
Important
Security advice: ensure all YAML files in /etc/netplan
, /run/netplan
and
/lib/netplan
are not readable by non-privileged users.
Static analysis with Coverity¶
To ensure that common issues do not sneak undetected in our code base, we scan it periodically with Coverity. Through Coverity static analysis, we can achieve a degree of confidence that some types of issues, such as obvious memory leaks, do not stay unnoticed in the code.
Memory issue checks¶
As part of our CI (continuous integration) workflows, we build Netplan with the GCC address sanitiser and run unit tests and the Netplan generator against a number of YAML files. This helps us to detect issues, such as memory leaks and buffer overflows, at runtime using real configuration as input. When a memory issue is detected, the process crashes, indicating that some issue was introduced in the change.
Every time a pull request is created or changes are merged to the main branch, CI executes these tests, and, if a crash happens, the workflow fails.
Binary package hardening¶
On Ubuntu and Debian, Netplan is built (and in fact most of the binary packages are)
with a number of security flags that apply some hardening to the resulting binary.
That is intended to make the life of attackers harder in case any security issue is
discovered. See the dpkg-buildflags(1)
manual page for details.