TMA-ROS-DISCOVERY-RANGE

Ensure ROS 2 discovery is limited to the local host

보통레벨 2자동ros

설명

By default ROS 2 multicasts DDS discovery to the whole subnet, exposing every topic and service to other machines. Humble/Iron use ROS_LOCALHOST_ONLY=1; Jazzy and later use ROS_AUTOMATIC_DISCOVERY_RANGE=LOCALHOST (or OFF). The audit inspects /proc/<pid>/environ of running processes containing ROS_DISTRO (run as root) and fails if none is found or any process allows wider discovery. Multi-host robots that must discover peers should instead use SUBNET with ROS_STATIC_PEERS and SROS2, and document the exception.

점검 방법

감사 방식: 셸 명령

shell

found=0; bad=0
for e in /proc/[0-9]*/environ; do
  env=$( (tr '\0' '\n' < "$e") 2>/dev/null ) || continue
  case "$env" in *ROS_DISTRO=*) ;; *) continue ;; esac
  found=1
  pid=${e#/proc/}; pid=${pid%/environ}
  if printf '%s\n' "$env" | grep -Eqx 'ROS_AUTOMATIC_DISCOVERY_RANGE=(LOCALHOST|OFF)'; then continue; fi
  if printf '%s\n' "$env" | grep -qx 'ROS_LOCALHOST_ONLY=1' && ! printf '%s\n' "$env" | grep -q '^ROS_AUTOMATIC_DISCOVERY_RANGE='; then continue; fi
  echo "pid $pid: discovery not limited to localhost"; bad=1
done
[ "$found" -eq 1 ] || { echo "no running ROS 2 processes found"; exit 1; }
[ "$bad" -eq 0 ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Jazzy+: set ROS_AUTOMATIC_DISCOVERY_RANGE=LOCALHOST (optionally ROS_STATIC_PEERS for known peers). Humble/Iron: set ROS_LOCALHOST_ONLY=1. Apply in the launch environment of every node and restart them.

속성

운영 체제: 모두
태그: rosros2ddsnetwork
참고 자료: CIS-style ROS 2 hardening guidance - Restrict DDS discovery scope (no CIS benchmark section; verify against your hardening standard)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target ros --level 2