Rfc/privileged rshell helper

.copyright-overrides.yml

@@ -59,6 +59,7 @@ golang.org/x/*: "Copyright (c) 2009 The Go Authors. All rights reserved"
 gopkg.in/DataDog/*: Copyright 2016-Present Datadog, Inc.
 gopkg.in/yaml.v2: "Copyright 2011-2016 Canonical Ltd"
 k8s.io/*: Copyright 2014 The Kubernetes Authors.
+kernel.org/pub/linux/libs/security/libcap/psx: Copyright (c) 2019,20,24 Andrew G. Morgan <morgan@kernel.org>
 sigs.k8s.io/*: Copyright 2017 The Kubernetes Authors.
 contrib.go.opencensus.io/exporter/prometheus: Copyright 2020, OpenCensus Authors
 go.opencensus.io: Copyright 2018, OpenCensus Authors

.wwhrd.yml

@@ -17,6 +17,9 @@ allowlist:
   - FreeBSD
 
 overrides:
+  # libcap/psx is dual-licensed under BSD-3-Clause OR GPL-2.0-only. Select the
+  # permissive option; automatic detection otherwise prefers the GPL text.
+  "kernel.org/pub/linux/libs/security/libcap/psx": BSD-3-Clause
   # https://github.com/bmizerany/pat/blob/master/LICENSE
   "github.com/bmizerany/pat": MIT
   # https://github.com/xi2/xz/blob/master/LICENSE

LICENSE-3rdparty.csv

@@ -285,6 +285,7 @@ core,github.com/DataDog/rshell/allowedpaths,Apache-2.0,"Copyright 2026-present D
 core,github.com/DataDog/rshell/allowedpaths/internal/fsstat,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/allowedpaths/internal/writeopen,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins,Apache-2.0,"Copyright 2026-present Datadog, Inc"
+core,github.com/DataDog/rshell/builtins/awk,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/break,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/cat,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/cd,Apache-2.0,"Copyright 2026-present Datadog, Inc"
@@ -330,6 +331,7 @@ core,github.com/DataDog/rshell/builtins/pwd,Apache-2.0,"Copyright 2026-present D
 core,github.com/DataDog/rshell/builtins/read,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/rm,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/sed,Apache-2.0,"Copyright 2026-present Datadog, Inc"
+core,github.com/DataDog/rshell/builtins/sha256sum,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/sort,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/ss,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/builtins/stat,Apache-2.0,"Copyright 2026-present Datadog, Inc"
@@ -350,6 +352,7 @@ core,github.com/DataDog/rshell/internal/interpoption,Apache-2.0,"Copyright 2026-
 core,github.com/DataDog/rshell/internal/systemd,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/internal/version,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/rshell/interp,Apache-2.0,"Copyright 2026-present Datadog, Inc"
+core,github.com/DataDog/rshell/privilegedhelper,Apache-2.0,"Copyright 2026-present Datadog, Inc"
 core,github.com/DataDog/sketches-go/ddsketch,Apache-2.0,"Copyright 2021 Datadog, Inc"
 core,github.com/DataDog/sketches-go/ddsketch/encoding,Apache-2.0,"Copyright 2021 Datadog, Inc"
 core,github.com/DataDog/sketches-go/ddsketch/mapping,Apache-2.0,"Copyright 2021 Datadog, Inc"
@@ -1564,6 +1567,7 @@ core,github.com/kr/pretty,MIT,Copyright 2012 Keith Rarick
 core,github.com/kr/text,MIT,Copyright 2012 Keith Rarick
 core,github.com/kylelemons/godebug/diff,Apache-2.0,Copyright (c) 2013-2020 Kyle Lemons
 core,github.com/kylelemons/godebug/pretty,Apache-2.0,Copyright (c) 2013-2020 Kyle Lemons
+core,github.com/landlock-lsm/go-landlock/landlock/syscall,MIT,Copyright (c) 2021 Günther Noack
 core,github.com/leodido/go-syslog/v4,MIT,"Copyright (c) 2018, Leonardo Di Donato"
 core,github.com/leodido/go-syslog/v4/auto,MIT,"Copyright (c) 2018, Leonardo Di Donato"
 core,github.com/leodido/go-syslog/v4/ciscoios,MIT,"Copyright (c) 2018, Leonardo Di Donato"
@@ -4498,6 +4502,7 @@ core,k8s.io/utils/path,Apache-2.0,Copyright 2014 The Kubernetes Authors.
 core,k8s.io/utils/ptr,Apache-2.0,Copyright 2014 The Kubernetes Authors.
 core,k8s.io/utils/strings/slices,Apache-2.0,Copyright 2014 The Kubernetes Authors.
 core,k8s.io/utils/trace,Apache-2.0,Copyright 2014 The Kubernetes Authors.
+core,kernel.org/pub/linux/libs/security/libcap/psx,BSD-3-Clause,"Copyright (c) 2019,20,24 Andrew G. Morgan <morgan@kernel.org>"
 core,mellium.im/sasl,BSD-2-Clause,Copyright © 2014 The Mellium Contributors
 core,mvdan.cc/sh/v3/expand,BSD-3-Clause,"Copyright (c) 2016, Daniel Martí. All rights reserved"
 core,mvdan.cc/sh/v3/fileutil,BSD-3-Clause,"Copyright (c) 2016, Daniel Martí. All rights reserved"

comp/remote-config/rcclient/def/component.go

@@ -23,6 +23,12 @@ type Component interface {
 	Subscribe(product data.Product, fn func(update map[string]state.RawConfig, applyStateCallback func(string, state.ApplyStatus)))
 }
 
+// TUFProofProvider exposes the Director proof for a Remote Config target.
+type TUFProofProvider interface {
+	// GetConfigTUFProof returns the Director proof for one Remote Config target.
+	GetConfigTUFProof(targetPath string) (state.ConfigTUFProof, bool)
+}
+
 // Params is the input parameter struct for the RC client Component.
 type Params struct {
 	AgentName     string

comp/remote-config/rcclient/impl/rcclient.go

@@ -59,6 +59,8 @@ type rcClient struct {
 	IPC               ipc.Component
 }
 
+var _ rcclient.TUFProofProvider = (*rcClient)(nil)
+
 // Dependencies defines the dependencies for the rcclient component.
 type Dependencies struct {
 	compdef.In
@@ -366,6 +368,14 @@ func (rc *rcClient) Subscribe(product data.Product, fn func(update map[string]st
 	rc.client.Subscribe(string(product), fn)
 }
 
+// GetConfigTUFProof returns the current Director proof for a Remote Config target.
+func (rc *rcClient) GetConfigTUFProof(targetPath string) (state.ConfigTUFProof, bool) {
+	if rc.client == nil {
+		return state.ConfigTUFProof{}, false
+	}
+	return rc.client.GetConfigTUFProof(targetPath)
+}
+
 func (rc *rcClient) agentConfigUpdateCallback(updates map[string]state.RawConfig, applyStateCallback func(string, state.ApplyStatus)) {
 	mergedConfig, err := state.MergeRCAgentConfig(rc.client.UpdateApplyStatus, updates)
 	if err != nil {

deps/go.MODULE.bazel

@@ -56,6 +56,14 @@ go_deps.gazelle_override(
     build_extra_args = ["-build_tags=trivy_no_javadb"],
     path = "github.com/aquasecurity/trivy",
 )
+go_deps.gazelle_override(
+    directives = [
+        "gazelle:go_visibility @@//pkg/privateactionrunner/rshell:__pkg__",
+        "gazelle:resolve go github.com/DataDog/datadog-agent/pkg/fleet/installer/telemetry @@//pkg/fleet/installer/telemetry:telemetry",
+        "gazelle:resolve go github.com/DataDog/datadog-agent/pkg/remoteconfig/state @@//pkg/remoteconfig/state:state",
+    ],
+    path = "github.com/DataDog/rshell",
+)
 use_repo(
     go_deps,
     "cat_dario_mergo",
@@ -209,6 +217,7 @@ use_repo(
     "com_github_kouhin_envflag",
     "com_github_kr_pretty",
     "com_github_kraken_hpc_go_fork",
+    "com_github_landlock_lsm_go_landlock",
     "com_github_lightstep_go_expohisto",
     "com_github_lorenzosaino_go_sysctl",
     "com_github_lxn_walk",

go.mod

@@ -212,7 +212,7 @@ require (
 	github.com/DataDog/go-acl v1.0.1
 	github.com/DataDog/go-sqllexer v0.2.4
 	github.com/DataDog/jsonapi v0.13.0
-	github.com/DataDog/rshell v0.0.25
+	github.com/DataDog/rshell v0.0.26
 	github.com/DataDog/sketches-go v1.4.8
 	github.com/DataDog/watermarkpodautoscaler/apis v0.0.0-20250108152814-82e58d0231d1
 	github.com/DataDog/zstd v1.5.8-0.20260421145859-31a7e515a571
@@ -325,6 +325,7 @@ require (
 	github.com/kouhin/envflag v0.0.0-20150818174321-0e9a86061649
 	github.com/kr/pretty v0.3.1
 	github.com/kraken-hpc/go-fork v0.1.1
+	github.com/landlock-lsm/go-landlock v0.10.0
 	github.com/lorenzosaino/go-sysctl v0.3.1
 	github.com/lxn/walk v0.0.0-20210112085537-c389da54e794
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e
@@ -1165,6 +1166,7 @@ require (
 	k8s.io/kms v0.35.5 // indirect
 	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
 	k8s.io/sample-controller v0.35.3 // indirect
+	kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect
 	mellium.im/sasl v0.3.2 // indirect
 	modernc.org/sqlite v1.53.0 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect

omnibus/config/software/datadog-agent.rb

@@ -207,6 +207,7 @@
     end
 
     if linux_target?
+      command "bazel run #{omnibazel_flags} //pkg/privateactionrunner/rshell:install -- --destdir=#{install_dir}", :env => env, :live_stream => Omnibus.logger.live_stream(:info)
       command "bazel run #{omnibazel_flags} //pkg/privateactionrunner/par-control:install -- --destdir=#{install_dir}", :env => env, :live_stream => Omnibus.logger.live_stream(:info)
     end
   end

packages/agent/product/BUILD.bazel

@@ -55,6 +55,7 @@ pkg_filegroup(
         "//packages/agent:linux_default": [
             "//pkg/discovery/module/rust:all_files",
             "//pkg/privateactionrunner/par-control:all_files_linux",
+            "//pkg/privateactionrunner/rshell:all_files_linux",
             "//pkg/procmgr/rust:all_files_linux",
         ],
         "//packages/agent:linux_fips": [

pkg/config/example/datadog-agent_windows.yaml.example

@@ -4761,6 +4761,21 @@ api_key:
 #
 #   agent_secret_management_enabled: true
 
+#   # @param restricted_shell - custom object - optional
+#   # Local restrictions for remote rshell actions. Privileged execution has
+#   # an additional administrator-controlled opt-in and requires the systemd
+#   # socket. On Linux, a root-owned /etc/datadog-agent-rshell/policy.json
+#   # can optionally narrow the backend-provided command and path policy.
+#
+#   restricted_shell:
+#     allowed_commands:
+#       - rshell:*
+#     allowed_paths:
+#       - /
+#     privileged:
+#       enabled: false
+#       socket: /run/datadog/rshell-privileged.sock
+
 #   # @param http_timeout_seconds - integer - optional - default: 30
 #   # @env DD_PRIVATE_ACTION_RUNNER_HTTP_TIMEOUT_SECONDS - integer - optional - default: 30
 #   # Maximum time in seconds for HTTP actions before timing out. Must be > 1.

pkg/config/remote/client/BUILD.bazel

@@ -1,8 +1,12 @@
 load("@rules_go//go:def.bzl", "go_library")
+load("//bazel/rules/go:dd_agent_go_test.bzl", "dd_agent_go_test")
 
 go_library(
     name = "client",
-    srcs = ["client.go"],
+    srcs = [
+        "client.go",
+        "tuf_proof.go",
+    ],
     importpath = "github.com/DataDog/datadog-agent/pkg/config/remote/client",
     visibility = ["//visibility:public"],
     deps = [
@@ -19,3 +23,14 @@ go_library(
         "@org_uber_go_atomic//:atomic",
     ],
 )
+
+dd_agent_go_test(
+    name = "client_test",
+    srcs = ["tuf_proof_test.go"],
+    embed = [":client"],
+    deps = [
+        "//pkg/proto/pbgo/core",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

pkg/config/remote/client/client.go

@@ -126,6 +126,11 @@ type Client struct {
 
 	state *state.Repository
 
+	proofMu          sync.RWMutex
+	proofRoots       [][]byte
+	proofTargets     []byte
+	proofTargetFiles map[string][]byte
+
 	listeners map[string][]Listener
 
 	// Elements that can be changed during the execution of listeners
@@ -321,17 +326,18 @@ func newClient(cf ConfigFetcher, opts ...func(opts *Options)) (*Client, error) {
 	installerState.Store(&pbgo.ClientUpdater{})
 
 	return &Client{
-		Options:        options,
-		ID:             generateID(),
-		startupSync:    sync.Once{},
-		ctx:            ctx,
-		closeFn:        cloneFn,
-		cwsWorkloads:   cwsWorkloads,
-		installerState: installerState,
-		state:          repository,
-		backoffPolicy:  backoffPolicy,
-		listeners:      make(map[string][]Listener),
-		configFetcher:  cf,
+		Options:          options,
+		ID:               generateID(),
+		startupSync:      sync.Once{},
+		ctx:              ctx,
+		closeFn:          cloneFn,
+		cwsWorkloads:     cwsWorkloads,
+		installerState:   installerState,
+		state:            repository,
+		proofTargetFiles: make(map[string][]byte),
+		backoffPolicy:    backoffPolicy,
+		listeners:        make(map[string][]Listener),
+		configFetcher:    cf,
 	}, nil
 }
 
@@ -563,7 +569,12 @@ func (c *Client) applyUpdate(pbUpdate *pbgo.ClientGetConfigsResponse) ([]string,
 		ClientConfigs: pbUpdate.ClientConfigs,
 	}
 
-	return c.state.Update(update)
+	changedProducts, err := c.state.Update(update)
+	if err != nil {
+		return nil, err
+	}
+	c.storeConfigTUFProof(pbUpdate)
+	return changedProducts, nil
 }
 
 // newUpdateRequests builds a new request for the agent based on the current state of the

pkg/config/remote/client/tuf_proof.go

@@ -0,0 +1,70 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2026-present Datadog, Inc.
+
+package client
+
+import (
+	"slices"
+
+	pbgo "github.com/DataDog/datadog-agent/pkg/proto/pbgo/core"
+	"github.com/DataDog/datadog-agent/pkg/remoteconfig/state"
+)
+
+// GetConfigTUFProof returns a defensive copy of the current Director proof for
+// targetPath. It returns false until the target and signed Targets metadata have
+// both been received from the Core Agent.
+func (c *Client) GetConfigTUFProof(targetPath string) (state.ConfigTUFProof, bool) {
+	c.proofMu.RLock()
+	defer c.proofMu.RUnlock()
+
+	targetFile, ok := c.proofTargetFiles[targetPath]
+	if !ok || len(c.proofTargets) == 0 {
+		return state.ConfigTUFProof{}, false
+	}
+	return state.ConfigTUFProof{
+		Roots:      cloneByteSlices(c.proofRoots),
+		Targets:    slices.Clone(c.proofTargets),
+		TargetPath: targetPath,
+		TargetFile: slices.Clone(targetFile),
+	}, true
+}
+
+// storeConfigTUFProof retains the complete proof chain from the bootstrap root
+// reported by this downstream client. It is called only after the corresponding
+// repository update has been accepted.
+func (c *Client) storeConfigTUFProof(update *pbgo.ClientGetConfigsResponse) {
+	if len(update.Targets) == 0 {
+		return
+	}
+
+	c.proofMu.Lock()
+	defer c.proofMu.Unlock()
+
+	for _, root := range update.Roots {
+		c.proofRoots = append(c.proofRoots, slices.Clone(root))
+	}
+	c.proofTargets = slices.Clone(update.Targets)
+
+	currentTargets := make(map[string]struct{}, len(update.ClientConfigs))
+	for _, targetPath := range update.ClientConfigs {
+		currentTargets[targetPath] = struct{}{}
+	}
+	for targetPath := range c.proofTargetFiles {
+		if _, ok := currentTargets[targetPath]; !ok {
+			delete(c.proofTargetFiles, targetPath)
+		}
+	}
+	for _, targetFile := range update.TargetFiles {
+		c.proofTargetFiles[targetFile.Path] = slices.Clone(targetFile.Raw)
+	}
+}
+
+func cloneByteSlices(values [][]byte) [][]byte {
+	cloned := make([][]byte, len(values))
+	for i, value := range values {
+		cloned[i] = slices.Clone(value)
+	}
+	return cloned
+}