Skip to content

Commit fa6b597

Browse files
okynosokynos
authored
Merge pull request #67 from Achiefs/63-add-whodata
Include audit daemon information into Linux monitored files
2 parents 0dcba5d + d9f3c62 commit fa6b597

28 files changed

Lines changed: 2690 additions & 264 deletions

‎.github/workflows/system-tests-workflow.yml‎

Lines changed: 71 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: System tests
22
on: [push]
33
jobs:
4-
system-tests-unix:
4+
monitor-system-tests-unix:
55
runs-on: ${{ matrix.os }}
66
strategy:
77
matrix:
@@ -19,17 +19,17 @@ jobs:
1919

2020
- name: Change configuration to test on Linux
2121
if: runner.os == 'Linux'
22-
run: sed -i 's|tmp/.*|tmp/test|g' config/linux/config.yml
22+
run: sed -i 's|usr/bin/.*|tmp/test|g' config/linux/config.yml
2323

2424
- name: Change configuration to test on macOS
2525
if: runner.os == 'macOS'
26-
run: sed -i '' 's|tmp/.*|tmp/test|g' config/linux/config.yml
26+
run: sed -i '' 's|usr/bin.*|tmp/test|g' config/linux/config.yml
2727

2828
- name: Copy FIM binary to main folder
2929
run: cp ./target/release/fim ./
3030

3131
- name: Create required directories
32-
run: mkdir /tmp/test
32+
run: mkdir -p /tmp/test
3333

3434
- name: Create events file and folder
3535
run: sudo mkdir -p /var/lib/fim/ && sudo touch /var/lib/fim/events.json && sudo chown -R runner:runner /var/lib/fim
@@ -41,10 +41,76 @@ jobs:
4141
run: sudo ./fim &
4242

4343
- name: Launch test suite
44-
run: python3 -m pytest test/system/test_system.py -v
44+
run: python3 -m pytest test/system/monitor.py -v --noconftest
4545

4646
- name: Print events.json file
4747
if: always()
4848
run: cat /var/lib/fim/events.json
4949

5050
- run: echo "Job's status is ${{ job.status }}."
51+
52+
53+
audit-system-tests-unix:
54+
runs-on: self-hosted
55+
56+
steps:
57+
- name: Check out repository code, branch='${{ github.ref }}'
58+
uses: actions/checkout@v2
59+
60+
- name: Build FIM
61+
run: cargo build --release
62+
63+
- name: Change configuration
64+
run: sed -i 's|/tmp|/tmp/test|g' config/linux/config.yml
65+
66+
- name: Copy FIM binary to main folder
67+
run: cp ./target/release/fim ./
68+
69+
- name: Create required directories
70+
run: mkdir -p /tmp/test
71+
72+
- name: Create events file and folder
73+
run: sudo mkdir -p /var/lib/fim/ && sudo touch /var/lib/fim/events.json && sudo chown -R okynos:okynos /var/lib/fim
74+
75+
- name: Create log file and folder
76+
run: sudo mkdir -p /var/log/fim/ && sudo touch /var/log/fim/fim.log && sudo chown -R okynos:okynos /var/log/fim
77+
78+
- name: Start FIM process
79+
run: sudo ./fim &
80+
81+
- name: Launch test suite
82+
run: sudo python3 -m pytest test/system/audit.py -v
83+
84+
- name: Print config file
85+
if: always()
86+
run: cat ${{ github.workspace }}/config/linux/config.yml || true
87+
88+
- name: Print log file
89+
if: always()
90+
run: cat /var/log/fim/fim.log || true
91+
92+
- name: Clean temporal folder
93+
if: always()
94+
run: sudo rm -rf /tmp/test
95+
96+
- name: Clean log folder
97+
if: always()
98+
run: sudo rm -rf /var/log/fim/
99+
100+
- name: Clean lib folder
101+
if: always()
102+
run: sudo rm -rf /var/lib/fim/
103+
104+
- name: Clean workspace
105+
if: always()
106+
run: sudo rm -rf ${{ github.workspace }}/test/system/__pycache__/ ${{ github.workspace }}/test/system/.pytest_cache ${{ github.workspace }}/.pytest_cache
107+
108+
- name: Clean test output
109+
if: always()
110+
run: sudo rm -rf ${{ github.workspace }}/test_*
111+
112+
- name: Stop FIM process
113+
if: always()
114+
run: sudo pkill fim || true
115+
116+
- run: echo "Job's status is ${{ job.status }}."

‎Cargo.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "fim"
3-
version = "0.3.2"
3+
version = "0.4.0"
44
authors = ["José Fernández <´pylott@gmail.com´>"]
55
edition = "2021"
66

@@ -22,6 +22,7 @@ tokio = { version = "1.17.0", features = ["rt", "rt-multi-thread", "macros"] }
2222
tokio-util = { version = "0.7.1", features = ["codec"] }
2323
serde_json = "1.0.79"
2424
time = "0.3.9"
25+
ctrlc = { version = "3.2", features = ["termination"] }
2526

2627
[dev-dependencies]
2728
tokio-test = "*"

‎config/index_template.json‎

Lines changed: 92 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,59 @@
33
"index_patterns": [ "fim-*" ],
44
"mappings": {
55
"properties": {
6-
"pid": { "type": "integer" },
6+
"fpid": { "type": "long" },
77
"timestamp": { "type": "date" },
88
"file": { "type": "keyword" },
99
"hostname": { "type": "keyword" },
10-
"kind": { "type": "keyword" },
10+
"operation": { "type": "keyword" },
1111
"node": { "type": "keyword" },
1212
"version": { "type": "keyword" },
1313
"checksum": { "type": "keyword" },
1414
"system": { "type": "keyword" },
15-
"labels": { "type": "keyword" }
15+
"labels": { "type": "keyword" },
16+
"path": { "type": "keyword" },
17+
"command": { "type": "keyword" },
18+
"ogid": { "type": "keyword" },
19+
"rdev": { "type": "keyword" },
20+
"proctitle": { "type": "keyword" },
21+
"cap_fver": { "type": "keyword" },
22+
"inode": { "type": "keyword" },
23+
"cap_fp": { "type": "keyword" },
24+
"cap_fe": { "type": "keyword" },
25+
"item": { "type": "keyword" },
26+
"cap_fi": { "type": "keyword" },
27+
"dev": { "type": "keyword" },
28+
"mode": { "type": "keyword" },
29+
"cap_frootid": { "type": "keyword" },
30+
"ouid": { "type": "keyword" },
31+
"paths": { "type": "nested" },
32+
"cwd": { "type": "keyword" },
33+
"syscall": { "type": "keyword" },
34+
"ppid": { "type": "long" },
35+
"comm": { "type": "keyword" },
36+
"fsuid": { "type": "keyword" },
37+
"pid": { "type": "long" },
38+
"a0": { "type": "keyword" },
39+
"a1": { "type": "keyword" },
40+
"a2": { "type": "keyword" },
41+
"a3": { "type": "keyword" },
42+
"arch": { "type": "keyword" },
43+
"auid": { "type": "keyword" },
44+
"items": { "type": "integer" },
45+
"gid": { "type": "keyword" },
46+
"euid": { "type": "keyword" },
47+
"sgid": { "type": "keyword" },
48+
"uid": { "type": "keyword" },
49+
"tty": { "type": "keyword" },
50+
"success": { "type": "keyword" },
51+
"exit": { "type": "integer" },
52+
"ses": { "type": "keyword" },
53+
"key": { "type": "keyword" },
54+
"suid": { "type": "keyword" },
55+
"egid": { "type": "keyword" },
56+
"fsgid": { "type": "keyword" },
57+
"exe": { "type": "keyword" },
58+
"source": { "type": "keyword" }
1659
}
1760
},
1861
"settings": {
@@ -22,16 +65,59 @@
2265
"auto_expand_replicas": "0-all",
2366
"query": {
2467
"default_field": [
25-
"pid",
68+
"fpid",
2669
"timestamp",
2770
"file",
2871
"hostname",
29-
"kind",
72+
"operation",
3073
"node",
3174
"version",
3275
"checksum",
3376
"system",
34-
"labels"
77+
"labels",
78+
"path",
79+
"command",
80+
"ogid",
81+
"rdev",
82+
"proctitle",
83+
"cap_fver",
84+
"inode",
85+
"cap_fp",
86+
"cap_fe",
87+
"item",
88+
"cap_fi",
89+
"dev",
90+
"mode",
91+
"cap_frootid",
92+
"ouid",
93+
"paths",
94+
"cwd",
95+
"syscall",
96+
"ppid",
97+
"comm",
98+
"fsuid",
99+
"pid",
100+
"a0",
101+
"a1",
102+
"a2",
103+
"a3",
104+
"arch",
105+
"auid",
106+
"items",
107+
"gid",
108+
"euid",
109+
"sgid",
110+
"uid",
111+
"tty",
112+
"success",
113+
"exit",
114+
"ses",
115+
"key",
116+
"suid",
117+
"egid",
118+
"fsgid",
119+
"exe",
120+
"source"
35121
]
36122
}
37123
}

‎config/linux/config.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
1-
nodename: "FIM"
1+
node: "FIM"
22

33
# Events configuration, where to store produced events
44
events:
55
destination: file
66
file: /var/lib/fim/events.json
77

8-
# Monitor files and folders.
8+
# Audit extended files and folders information
9+
audit:
10+
- path: /tmp
11+
labels: ["tmp", "linux"]
12+
ignore: [".swp"]
13+
14+
# Simple files and folders information
915
monitor:
10-
- path: /tmp/
1116
- path: /bin/
1217
- path: /usr/bin/
1318
labels: ["usr/bin", "linux"]

‎config/macos/config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
nodename: "FIM"
1+
node: "FIM"
22

33
# Events configuration, where to store produced events
44
events:

‎config/windows/config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
nodename: "FIM"
1+
node: "FIM"
22

33
# Events configuration, where to store produced events
44
events:

‎pkg/deb/debian/changelog‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
fim (0.3.2-1) bionic; urgency=medium
1+
fim (0.4.0-1) bionic; urgency=medium
22

3-
* More info: https://github.com/Achiefs/fim/releases/tag/v0.3.2
3+
* More info: https://github.com/Achiefs/fim/releases/tag/v0.4.0
44

55
-- Jose Fernandez <support@achiefs.com> Sat, 02 Jul 2022 20:00:00 +0000
66

‎pkg/deb/repository/release/fim_0.4.0-1_amd64.deb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:da9979b4c501804d144c279d36f5e06d923b6519d07a2571271b0a5932c38870
3+
size 1288048

‎pkg/deb/repository/release/fim_0.4.0-1_arm64.deb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:24f4dff9b3b39e46cb9772fd93aa1b1726bbe6c71cff9a9face7c2719be4abaf
3+
size 1165588

‎pkg/deb/repository/test/fim_0.4.0-1_amd64.deb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:da9979b4c501804d144c279d36f5e06d923b6519d07a2571271b0a5932c38870
3+
size 1288048

0 commit comments

Comments
 (0)