Commit Graph

6 Commits

Author SHA1 Message Date
Mark Stemm
995e61210e Add regression tests for json output.
Modify falco_test.py to look for a boolean multiplex attribute
'json_output'. If true, examine the lines of the output and for any line
that begins with '{', parse it as json and ensure it has the 4
attributes we expect.

Modify run_regression_tests to have a utility function
prepare_multiplex_fileset that does the work of looping over files in a
directory, along with detect, level, and json output arguments. The
appropriate multiplex attributes are added for each file.

Use that utility function to test json output for the positive and
informational  directories along with non-json output. The negative
directory is only tested once.
2016-06-07 14:04:53 -07:00
Mark Stemm
fc6d775e5b Add additional rules/tests for pipe installers.
Add additional rules related to using pipe installers within a fbash
session:

 - Modify write_etc to only trigger if *not* in a fbash session. There's
   a new rule write_etc_installer which has the same conditions when in
   a fbash session, logging at INFO severity.

 - A new rule write_rpm_database warns if any non package management
   program tries to write below /var/lib/rpm.

 - Add a new warning if any program below a fbash session tries to open
   an outbound network connection on ports other than http(s) and dns.

 - Add INFO level messages when programs in a fbash session try to run
   package management binaries (rpm,yum,etc) or service
   management (systemctl,chkconfig,etc) binaries.

In order to test these new INFO level rules, make up a third class of
trace files traces-info.zip containing trace files that should result in
info-level messages.

To differentiate warning and info level detection, add an attribute to
the multiplex file "detect_level", which is "Warning" for the files in
traces-positive and "Info" for the files in traces-info. Modify
falco_test.py to look specifically for a non-zero count for the given
detect_level.

Doing this exposed a bug in the way the level-specific counts were being
recorded--they were keeping counts by level name, not number. Fix that.
2016-06-06 10:29:41 -07:00
Mark Stemm
b3ae480fac Another round of rule cleanups.
Do another round of rule cleanups now that we have a larger set of
positive and negative trace files to work with. Outside of this commit,
there are now trace files for all the positive rules, a docker-compose
startup and teardown, and some trace files from the sysdig cloud staging
environment.

Also add a script that runs sysdig with a filter that removes all the
syscalls not handled by falco as well as a few other high-volume,
low-information syscalls. This script was used to create the staging
environment trace files.

Notable rule changes:

 - The direction for write_binary_dir/write_etc needs to be exit instead
   of enter, as the bin_dir clause works on the file descriptor returned
   by the open/openat call.

 - Add login as a trusted binary that can read sensitive files (occurs
   for direct console logins).

 - sshd can read sensitive files well after startup, so exclude it from
   the set of binaries that can trigger
   read_sensitive_file_trusted_after_startup.

 - limit run_shell_untrusted to non-containers.

 - Disable the ssh_error_syslog rule for now. With the current
   restriction on system calls (no read/write/sendto/recvfrom/etc), you
   won't see the ssh error messages. Nevertheless, add a string to look
   for to indicate ssh errors and add systemd's true location for the
   syslog device.

 - Sshd attemps to setuid even when it's not running as root, so exclude
   it from the set of binaries to monitor for now.

 - Let programs that are direct decendants of systemd spawn user
   management tasks for now.

 - Temporarily disable the EACCESS rule. This rule is exposing a bug in
   sysdig in debug mode, https://github.com/draios/sysdig/issues/598. The
   rule is also pretty noisy so I'll keep it disabled until the sysdig bug
   is fixed.

 - The etc_dir and bin_dir macros both have the problem that they match
   pathnames with /etc/, /bin/, etc in the middle of the path, as sysdig
   doesn't have a "begins with" comparison. Add notes for that.

 - Change spawn_process to spawned_process to indicate that it's for the
   exit side of the execve. Also use it in a few places that were
   looking for the same conditions without any macro.

 - Get rid of adduser_binaries and fold any programs not already present
   into shadowutils_binaries.

 - Add new groups sysdigcloud_binaries and sysdigcloud_binaries_parent
   and add them as exceptions for write_etc/write_binary_dir.

 - Add yum as a package management binary and add it as an exception to
   write_etc/write_binary_dir.

 - Change how db_program_spawned_process works. Since all of the useful
   information is on the exit side of the event, you can't really add a
   condition based on the process being new. Isntead, have the rule
   check for a non-database-related program being spawned by a
   database-related program.

 - Allow dragent to run shells.

 - Add sendmail, sendmail-msp as a program that attempts to setuid.

 - Some of the *_binaries macros that were based on dpkg -L accidentally
   contained directories in addition to end files. Trim those.

 - Add systemd-logind as a login_binary.

 - Add unix_chkpwd as a shadowutils_binary.

 - Add parentheses around any macros that group items using or. I found
   this necessary when the macro is used in the middle of a list of and
   conditions.

 - Break out system_binaries into a new subset user_mgmt_binaries
   containing login_, passwd_, and shadowutils_ binaries. That way you
   don't have to pull in all of system_binaries when looking for
   sensisitive files or user management activity.

 - Rename fs-bash to fbash, thinking ahead to its more likely name.
2016-05-25 17:40:01 -07:00
Mark Stemm
4751546c03 Add correctness tests using Avocado
Start using the Avocado framework for automated regression
testing. Create a test FalcoTest in falco_test.py which can run on a
collection of trace files. The script test/run_regression_tests.sh is
responsible for pulling zip files containing the positive (falco should
detect) and negative (falco should not detect) trace files, creating a
Avocado multiplex file that defines all the tests (one for each trace
file), running avocado on all the trace files, and showing full logs for
any test that didn't pass.

The old regression script, which simply ran falco, has been removed.

Modify falco's stats output to show the total number of events detected
for use in the tests.

In travis.yml, pull a known stable version of avocado and build it,
including installing any dependencies, as a part of the build process.
2016-05-24 13:56:48 -07:00
Mark Stemm
450c347ef3 Add a basic test to run falco.
Add a basic test that loads the kernel module from the source directory
and runs falco. No testing of behavior yet.
2016-05-17 17:43:09 -07:00
Mark Stemm
c9d2550ecd Add minimal travis support.
Add minimal travis.yml file that builds and packages falco. No actual
tests yet.
2016-05-17 16:16:34 -07:00