Host hash sensor #484

slashben · 2025-02-16T08:16:14Z

This pull request includes several changes to the configuration, Kubernetes deployment, and main application logic to support new features and improve the codebase. The key changes include enabling new sensors, updating the Kubernetes deployment configuration, and modifying the main application logic to handle different modes of operation.

Configuration Updates:

Added new configuration options for enabling full path tracing, runtime detection, and host malware sensor in configuration/node-hash-sensor/config.json.
Updated go.mod to include new dependencies and update existing ones. [1] [2] [3]

Kubernetes Deployment Updates:

Added a new label and changed the service type to LoadBalancer in demo/general_attack/webapp/ping-app.yaml. [1] [2]
Restricted the role permissions to only allow get on pods in demo/general_attack/webapp/ping-app.yaml.

Main Application Logic Updates:

Modified main.go to load configuration from an environment variable and handle Kubernetes and non-Kubernetes modes. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Updated pkg/config/config.go to include new configuration fields for host malware sensor and Kubernetes mode. [1] [2] [3]

Container Watcher Updates:

Added support for reporting events to the host hash sensor and included the host as a container in pkg/containerwatcher/v1/container_watcher.go. [1] [2] [3] [4] [5] [6] [7]

Signed-off-by: Ben <ben@armosec.io>

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Signed-off-by: Ben <ben@armosec.io>

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-16T13:02:59Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-16T15:17:24Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-16T17:50:11Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-16T18:29:24Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

* Added host agent rules Signed-off-by: Afek Berger <afekb@armosec.io> * fixed tests & naming Signed-off-by: Afek Berger <afekb@armosec.io> --------- Signed-off-by: Afek Berger <afekb@armosec.io>

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-16T19:00:55Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Ben <ben@armosec.io>

github-actions · 2025-02-17T08:20:44Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

…ost-agent

github-actions · 2025-02-18T07:48:44Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Ben <ben@armosec.io>

* Adding host network watcher Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Fixing process tree Signed-off-by: Amit Schendel <amitschendel@gmail.com> * adding a goreleaser config Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> --------- Signed-off-by: Amit Schendel <amitschendel@gmail.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Matthias Bertschy <matthias.bertschy@gmail.com>

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Signed-off-by: Ben <ben@armosec.io>

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

…into feature/host-agent

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-18T14:59:39Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-18T18:00:47Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-19T10:10:08Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-19T10:32:46Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

github-actions · 2025-02-19T11:28:35Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

matthyx

let's fix these nits before merging

.gitignore

.goreleaser.yaml

Makefile

cmd/node/main.go

go.mod

pkg/exporters/http_exporter.go

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

amitschendel · 2025-02-20T09:13:17Z

cmd/main.go

@@ -264,7 +264,6 @@ func main() {
 		apc := &objectcache.ApplicationProfileCacheMock{}
 		nnc := &objectcache.NetworkNeighborhoodCacheMock{}
 		dc := &objectcache.DnsCacheMock{}
-		processManager = processmanager.CreateProcessManagerMock()


Why you removed it?

duplicated line with 269

github-actions · 2025-02-20T09:13:23Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: success

slashben and others added 10 commits February 16, 2025 10:14

First commit

089ba7c

Signed-off-by: Ben <ben@armosec.io>

Adding base host rules

c031053

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Fixing conflicts

7062573

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding base code of host rule manager

9d19178

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding mock

2b492f0

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

fixing process details

9a22d96

Signed-off-by: Ben <ben@armosec.io>

Adding main support for rule manager

a77141f

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Removing import

24289b9

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding process tree support

ef5809a

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding fixed config

be4334c

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Chaning log to debug to prevent spamming

5940793

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

amitschendel added 2 commits February 16, 2025 17:28

Adding new code

c0e04c7

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding rules

5cae72b

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

amitschendel added 3 commits February 16, 2025 18:00

Adding fixed rules

ba11c23

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding path and rules

364bb08

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Commenting read env variable from proc

3f325e9

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

afek854 and others added 2 commits February 16, 2025 20:43

Added host agent rules (#485)

b964800

* Added host agent rules Signed-off-by: Afek Berger <afekb@armosec.io> * fixed tests & naming Signed-off-by: Afek Berger <afekb@armosec.io> --------- Signed-off-by: Afek Berger <afekb@armosec.io>

Fixing rule name

7573f89

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

slashben added 2 commits February 17, 2025 09:04

Configuring event receiver export

9083709

Signed-off-by: Ben <ben@armosec.io>

fix

d410544

Signed-off-by: Ben <ben@armosec.io>

amitschendel force-pushed the feature/host-agent branch from 0387b8a to d410544 Compare February 17, 2025 08:34

amitschendel added 3 commits February 17, 2025 08:36

Fixing test

ea505da

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Changing unused params to _

f3091d6

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Merge branch 'main' of github.com:kubescape/node-agent into feature/h…

c4678a5

…ost-agent

matthyx marked this pull request as ready for review February 18, 2025 07:37

Ptracewatcher

10cfd03

Signed-off-by: Ben <ben@armosec.io>

matthyx force-pushed the feature/host-agent branch from badf978 to 10cfd03 Compare February 18, 2025 13:37

amitschendel and others added 8 commits February 18, 2025 15:44

Fixing Dockerfile - @matthias blame

be8762b

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

fix

f7bf41f

Signed-off-by: Ben <ben@armosec.io>

Removing network on host

2bbdc17

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Merge branch 'feature/host-agent' of github.com:kubescape/node-agent …

f41b367

…into feature/host-agent

Clean unused code

02f1cbe

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Removing io_uring init on host

493d27a

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding reporting of open and exec to hash sensor

ce72a15

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Adding injected rule creator

768c48d

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Public validate

a4b1d05

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Removing files

5161f1c

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

Removing host container

727b965

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

matthyx changed the title ~~WIP Host hash sensor~~ Host hash sensor Feb 20, 2025

matthyx requested changes Feb 20, 2025

View reviewed changes

fixing nits before merging

12779ad

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

matthyx approved these changes Feb 20, 2025

View reviewed changes

matthyx added the release Create release label Feb 20, 2025

amitschendel reviewed Feb 20, 2025

View reviewed changes

matthyx merged commit 963c7ef into main Feb 20, 2025
19 checks passed

matthyx deleted the feature/host-agent branch February 20, 2025 09:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Host hash sensor #484

Host hash sensor #484

slashben commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 17, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

matthyx left a comment

amitschendel Feb 20, 2025

matthyx Feb 20, 2025 •

edited

Loading

github-actions bot commented Feb 20, 2025

Host hash sensor #484

Host hash sensor #484

Conversation

slashben commented Feb 16, 2025

Configuration Updates:

Kubernetes Deployment Updates:

Main Application Logic Updates:

Container Watcher Updates:

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 17, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

matthyx left a comment

Choose a reason for hiding this comment

amitschendel Feb 20, 2025

Choose a reason for hiding this comment

matthyx Feb 20, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Feb 20, 2025

matthyx Feb 20, 2025 •

edited

Loading