File System
Protect global configuration files from unauthorized write access
Target group: System administrators
Description: CODESYS 4 stores global configuration files in a system-wide configuration folder. On Linux, this folder is located at /etc/CODESYS-4. It is created via the .deb package during installation and by default it is writable only by administrators. On Windows, CODESYS 4 stores a secured subfolder in %ProgramData% and will refuse to run if its permissions are not set appropriately. No credentials are saved in the global settings.
Action: Make sure that the global configuration folder is writable only by administrators – or the package manager c4-pkm – and the permissions are correctly set. Otherwise CODESYS 4 will refuse to start on Windows.
Reasoning: If ordinary users could change the global configuration, then the behavior of CODESYS 4 could be manipulated for all users of the system. In particular, extensions – and therefore also compiled libraries – could be injected in this way without this being noticed or tracked. Extensions could also execute arbitrary code as the current user (see also: Install and use only trusted extensions).
Harden certificate stores and trust anchors
Target group: System administrators
Description: For signature verification of packages and libraries, CODESYS 4 uses the system certificate store or the trust anchors stored there. Windows uses the system certificate store by default.
Action: Protect the certificate store and the trust anchors from being modified by local users by setting file-system permissions and regularly updating the trust anchors – comparable to maintaining ca-certificates on Linux.
Reasoning: If a local user can modify the trust anchors or add their own, then signatures of malicious packages or libraries may be accepted as trusted during verification. Malicious extensions, which have previously been blocked due to signature verification, could now be installed in this way. Only the installation itself is logged, not the fact that the signature is based on a trust anchor injected afterwards – for example, a self-signed root CA.
Provide the log directory with restrictive permissions
Target group: System administrators
Description: By default, CODESYS 4 writes debug logs to the %APPDATA%\CODESYS-4\logs folder on Windows and to the ~/.config/CODESYS-4/logs folder on Linux. The log files are rotated when they reach a size of approximately 1 MB and are kept for 14 days, thereby limiting the storage consumption.
Action: Set restrictive permissions to the log directory so that only authorized users can read the log files.
Reasoning: Log files can contain sensitive and personal information (see also: Consider personal data in debug logs). A log directory which is not adequately protected allows other users to read this information or manipulate the log files.
Set up shared working directories with correct permissions
Target group: System administrators
Description: CODESYS 4 does not have its own access control list (ACL) for project and working directories. Access protection is based entirely on the file system permissions of the operating system. By default, there are no shared working directories.
Action: When setting up shared team working directories, safeguard them with correct group or ACL permissions so that exclusively the intended group of users can read and write.
Reasoning: Incorrectly set permissions allow users outside the intended team to view, manipulate, or damage shared projects – and therefore the intellectual property of your team – which can result in data loss.