Host hash sensor #484

slashben · 2025-02-16T08:16:14Z

This pull request includes several changes to the configuration, Kubernetes deployment, and main application logic to support new features and improve the codebase. The key changes include enabling new sensors, updating the Kubernetes deployment configuration, and modifying the main application logic to handle different modes of operation.

Configuration Updates:

Added new configuration options for enabling full path tracing, runtime detection, and host malware sensor in configuration/node-hash-sensor/config.json.
Updated go.mod to include new dependencies and update existing ones. [1] [2] [3]

Kubernetes Deployment Updates:

Added a new label and changed the service type to LoadBalancer in demo/general_attack/webapp/ping-app.yaml. [1] [2]
Restricted the role permissions to only allow get on pods in demo/general_attack/webapp/ping-app.yaml.

Main Application Logic Updates:

Modified main.go to load configuration from an environment variable and handle Kubernetes and non-Kubernetes modes. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Updated pkg/config/config.go to include new configuration fields for host malware sensor and Kubernetes mode. [1] [2] [3]

Container Watcher Updates:

Added support for reporting events to the host hash sensor and included the host as a container in pkg/containerwatcher/v1/container_watcher.go. [1] [2] [3] [4] [5] [6] [7]

Signed-off-by: Ben <[email protected]>

Signed-off-by: Amit Schendel <[email protected]>

Signed-off-by: Ben <[email protected]>

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-16T13:02:59Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-16T15:17:24Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-16T17:50:11Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-16T18:29:24Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

* Added host agent rules Signed-off-by: Afek Berger <[email protected]> * fixed tests & naming Signed-off-by: Afek Berger <[email protected]> --------- Signed-off-by: Afek Berger <[email protected]>

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-16T19:00:55Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Ben <[email protected]>

github-actions · 2025-02-17T08:20:44Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

…ost-agent

github-actions · 2025-02-18T07:48:44Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Ben <[email protected]>

* Adding host network watcher Signed-off-by: Amit Schendel <[email protected]> * Fixing process tree Signed-off-by: Amit Schendel <[email protected]> * adding a goreleaser config Signed-off-by: Matthias Bertschy <[email protected]> --------- Signed-off-by: Amit Schendel <[email protected]> Signed-off-by: Matthias Bertschy <[email protected]> Co-authored-by: Matthias Bertschy <[email protected]>

Signed-off-by: Amit Schendel <[email protected]>

Signed-off-by: Ben <[email protected]>

Signed-off-by: Amit Schendel <[email protected]>

…into feature/host-agent

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-18T14:59:39Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-18T18:00:47Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-19T10:10:08Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-19T10:32:46Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

Signed-off-by: Amit Schendel <[email protected]>

github-actions · 2025-02-19T11:28:35Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: failure

matthyx

let's fix these nits before merging

.gitignore

.goreleaser.yaml

Makefile

cmd/node/main.go

go.mod

pkg/exporters/http_exporter.go

Signed-off-by: Matthias Bertschy <[email protected]>

amitschendel · 2025-02-20T09:13:17Z

cmd/main.go

@@ -264,7 +264,6 @@ func main() {
 		apc := &objectcache.ApplicationProfileCacheMock{}
 		nnc := &objectcache.NetworkNeighborhoodCacheMock{}
 		dc := &objectcache.DnsCacheMock{}
-		processManager = processmanager.CreateProcessManagerMock()


Why you removed it?

duplicated line with 269

github-actions · 2025-02-20T09:13:23Z

Summary:

License scan: failure
Credentials scan: failure
Vulnerabilities scan: failure
Unit test: success
Go linting: success

slashben and others added 10 commits February 16, 2025 10:14

First commit

089ba7c

Signed-off-by: Ben <[email protected]>

Adding base host rules

c031053

Signed-off-by: Amit Schendel <[email protected]>

Fixing conflicts

7062573

Signed-off-by: Amit Schendel <[email protected]>

Adding base code of host rule manager

9d19178

Signed-off-by: Amit Schendel <[email protected]>

Adding mock

2b492f0

Signed-off-by: Amit Schendel <[email protected]>

fixing process details

9a22d96

Signed-off-by: Ben <[email protected]>

Adding main support for rule manager

a77141f

Signed-off-by: Amit Schendel <[email protected]>

Removing import

24289b9

Signed-off-by: Amit Schendel <[email protected]>

Adding process tree support

ef5809a

Signed-off-by: Amit Schendel <[email protected]>

Adding fixed config

be4334c

Signed-off-by: Amit Schendel <[email protected]>

Chaning log to debug to prevent spamming

5940793

Signed-off-by: Amit Schendel <[email protected]>

amitschendel added 2 commits February 16, 2025 17:28

Adding new code

c0e04c7

Signed-off-by: Amit Schendel <[email protected]>

Adding rules

5cae72b

Signed-off-by: Amit Schendel <[email protected]>

amitschendel added 3 commits February 16, 2025 18:00

Adding fixed rules

ba11c23

Signed-off-by: Amit Schendel <[email protected]>

Adding path and rules

364bb08

Signed-off-by: Amit Schendel <[email protected]>

Commenting read env variable from proc

3f325e9

Signed-off-by: Amit Schendel <[email protected]>

afek854 and others added 2 commits February 16, 2025 20:43

Added host agent rules (#485)

b964800

* Added host agent rules Signed-off-by: Afek Berger <[email protected]> * fixed tests & naming Signed-off-by: Afek Berger <[email protected]> --------- Signed-off-by: Afek Berger <[email protected]>

Fixing rule name

7573f89

Signed-off-by: Amit Schendel <[email protected]>

slashben added 2 commits February 17, 2025 09:04

Configuring event receiver export

9083709

Signed-off-by: Ben <[email protected]>

fix

d410544

Signed-off-by: Ben <[email protected]>

amitschendel force-pushed the feature/host-agent branch from 0387b8a to d410544 Compare February 17, 2025 08:34

amitschendel added 3 commits February 17, 2025 08:36

Fixing test

ea505da

Signed-off-by: Amit Schendel <[email protected]>

Changing unused params to _

f3091d6

Signed-off-by: Amit Schendel <[email protected]>

Merge branch 'main' of github.com:kubescape/node-agent into feature/h…

c4678a5

…ost-agent

matthyx marked this pull request as ready for review February 18, 2025 07:37

Ptracewatcher

10cfd03

Signed-off-by: Ben <[email protected]>

matthyx force-pushed the feature/host-agent branch from badf978 to 10cfd03 Compare February 18, 2025 13:37

amitschendel and others added 8 commits February 18, 2025 15:44

Fixing Dockerfile - @matthias blame

be8762b

Signed-off-by: Amit Schendel <[email protected]>

fix

f7bf41f

Signed-off-by: Ben <[email protected]>

Removing network on host

2bbdc17

Signed-off-by: Amit Schendel <[email protected]>

Merge branch 'feature/host-agent' of github.com:kubescape/node-agent …

f41b367

…into feature/host-agent

Clean unused code

02f1cbe

Signed-off-by: Amit Schendel <[email protected]>

Removing io_uring init on host

493d27a

Signed-off-by: Amit Schendel <[email protected]>

Adding reporting of open and exec to hash sensor

ce72a15

Signed-off-by: Amit Schendel <[email protected]>

Adding injected rule creator

768c48d

Signed-off-by: Amit Schendel <[email protected]>

Public validate

a4b1d05

Signed-off-by: Amit Schendel <[email protected]>

Removing files

5161f1c

Signed-off-by: Amit Schendel <[email protected]>

Removing host container

727b965

Signed-off-by: Amit Schendel <[email protected]>

matthyx changed the title ~~WIP Host hash sensor~~ Host hash sensor Feb 20, 2025

matthyx requested changes Feb 20, 2025

View reviewed changes

fixing nits before merging

12779ad

Signed-off-by: Matthias Bertschy <[email protected]>

matthyx approved these changes Feb 20, 2025

View reviewed changes

matthyx added the release Create release label Feb 20, 2025

amitschendel reviewed Feb 20, 2025

View reviewed changes

matthyx merged commit 963c7ef into main Feb 20, 2025
19 checks passed

matthyx deleted the feature/host-agent branch February 20, 2025 09:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Host hash sensor #484

Host hash sensor #484

slashben commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 17, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

matthyx left a comment

amitschendel Feb 20, 2025

matthyx Feb 20, 2025 •

edited

Loading

github-actions bot commented Feb 20, 2025

Host hash sensor #484

Host hash sensor #484

Conversation

slashben commented Feb 16, 2025

Configuration Updates:

Kubernetes Deployment Updates:

Main Application Logic Updates:

Container Watcher Updates:

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 16, 2025

github-actions bot commented Feb 17, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

github-actions bot commented Feb 19, 2025

matthyx left a comment

Choose a reason for hiding this comment

amitschendel Feb 20, 2025

Choose a reason for hiding this comment

matthyx Feb 20, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Feb 20, 2025

matthyx Feb 20, 2025 •

edited

Loading