TMA-ROS-DISCOVERY-RANGE

Ensure ROS 2 discovery is limited to the local host

中级别 2自动化ros

说明

By default ROS 2 multicasts DDS discovery to the whole subnet, exposing every topic and service to other machines. Humble/Iron use ROS_LOCALHOST_ONLY=1; Jazzy and later use ROS_AUTOMATIC_DISCOVERY_RANGE=LOCALHOST (or OFF). The audit inspects /proc/<pid>/environ of running processes containing ROS_DISTRO (run as root) and fails if none is found or any process allows wider discovery. Multi-host robots that must discover peers should instead use SUBNET with ROS_STATIC_PEERS and SROS2, and document the exception.

检查方式

审计方法: Shell 命令

shell

found=0; bad=0
for e in /proc/[0-9]*/environ; do
  env=$( (tr '\0' '\n' < "$e") 2>/dev/null ) || continue
  case "$env" in *ROS_DISTRO=*) ;; *) continue ;; esac
  found=1
  pid=${e#/proc/}; pid=${pid%/environ}
  if printf '%s\n' "$env" | grep -Eqx 'ROS_AUTOMATIC_DISCOVERY_RANGE=(LOCALHOST|OFF)'; then continue; fi
  if printf '%s\n' "$env" | grep -qx 'ROS_LOCALHOST_ONLY=1' && ! printf '%s\n' "$env" | grep -q '^ROS_AUTOMATIC_DISCOVERY_RANGE='; then continue; fi
  echo "pid $pid: discovery not limited to localhost"; bad=1
done
[ "$found" -eq 1 ] || { echo "no running ROS 2 processes found"; exit 1; }
[ "$bad" -eq 0 ] && echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Jazzy+: set ROS_AUTOMATIC_DISCOVERY_RANGE=LOCALHOST (optionally ROS_STATIC_PEERS for known peers). Humble/Iron: set ROS_LOCALHOST_ONLY=1. Apply in the launch environment of every node and restart them.

属性

操作系统: 任意
标签: rosros2ddsnetwork
参考: CIS-style ROS 2 hardening guidance - Restrict DDS discovery scope (no CIS benchmark section; verify against your hardening standard)

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target ros --level 2