-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added event for default rule "Read SSH Information" #112
Changes from 8 commits
c4e29ce
4aaabc7
27dda87
725a1f4
5ef78dc
d58635d
5bb343d
68e48e0
2059280
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,51 @@ | ||
//go:build linux | ||
// +build linux | ||
|
||
// SPDX-License-Identifier: Apache-2.0 | ||
/* | ||
Copyright (C) 2023 The Falco Authors. | ||
Licensed under the Apache License, Version 2.0 (the "License"); | ||
you may not use this file except in compliance with the License. | ||
You may obtain a copy of the License at | ||
http://www.apache.org/licenses/LICENSE-2.0 | ||
Unless required by applicable law or agreed to in writing, software | ||
distributed under the License is distributed on an "AS IS" BASIS, | ||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
See the License for the specific language governing permissions and | ||
limitations under the License. | ||
*/ | ||
|
||
package syscall | ||
|
||
import ( | ||
"path/filepath" | ||
|
||
"github.com/falcosecurity/event-generator/events" | ||
|
||
"os" | ||
) | ||
|
||
var _ = events.Register( | ||
ReadSshInformation, | ||
events.WithDisabled(), // the rule is not enabled by default, so disable the action too | ||
) | ||
|
||
func ReadSshInformation(h events.Helper) error { | ||
// Also creates .ssh directory inside tempDirectory | ||
tempDirectoryName, err := createSshDirectoryUnderHome() | ||
if err != nil { | ||
return err | ||
} | ||
sshDir := filepath.Join(tempDirectoryName, ".ssh") | ||
defer os.RemoveAll(tempDirectoryName) | ||
|
||
GLVSKiriti marked this conversation as resolved.
Show resolved
Hide resolved
|
||
// Create known_hosts file. os.Create is enough to trigger the rule | ||
filename := filepath.Join(sshDir, "known_hosts") | ||
if _, err := os.Create(filename); err != nil { | ||
return err | ||
} | ||
|
||
h.Log().Info("attempting to simulate SSH information read") | ||
|
||
return nil | ||
} |
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -18,8 +18,10 @@ limitations under the License. | |||||
package syscall | ||||||
|
||||||
import ( | ||||||
"os" | ||||||
"os/exec" | ||||||
"os/user" | ||||||
"path/filepath" | ||||||
"strconv" | ||||||
sys "syscall" | ||||||
|
||||||
|
@@ -91,3 +93,24 @@ func runAsUser(h events.Helper, username string, cmdName string, cmdArgs ...stri | |||||
} | ||||||
return cmd.Run() | ||||||
} | ||||||
|
||||||
// Creates a temp directory and .ssh directory inside it. | ||||||
func createSshDirectoryUnderHome() (string, error) { | ||||||
// Creates temporary data for testing. | ||||||
var ( | ||||||
tempDirectoryName string | ||||||
err error | ||||||
) | ||||||
// Loop until a unique temporary directory is successfully created | ||||||
if tempDirectoryName, err = os.MkdirTemp("/home", "falco-event-generator-"); err != nil { | ||||||
return "", err | ||||||
} | ||||||
|
||||||
// Create the SSH directory | ||||||
sshDir := filepath.Join(tempDirectoryName, ".ssh") | ||||||
if err := os.Mkdir(sshDir, 0755); err != nil { | ||||||
return "", err | ||||||
} | ||||||
|
||||||
return tempDirectoryName, nil | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I got #112 (comment), what if this function also returns a return sshDir, func() { _ = os.RemoveAll(tempDirectoryName) }, nil then the caller will just There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yepp!! Awesome |
||||||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We don't need this line right? Since
createSshDirectoryUnderHome
already creates.ssh
folder inside the temp folder it can just returnsshDir
!There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@FedeDP Yes we can do that! But before the function return we should also clean the temp folder created by createSshDirectoryUnderHome .
defer os.RemoveAll(tempDirectoryName)
So if we return sshDir instead of tempDir . How can we clean tempDir ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So if we return sshdir then one valid approach is trimming the last 5 characters in sshDir gives tempdir path. Is that ok?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I got it, your are right! Nope, i'd leave another comment on the helper function!