mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 11:29:26 +00:00
fc6d775e5b
Add additional rules related to using pipe installers within a fbash session: - Modify write_etc to only trigger if *not* in a fbash session. There's a new rule write_etc_installer which has the same conditions when in a fbash session, logging at INFO severity. - A new rule write_rpm_database warns if any non package management program tries to write below /var/lib/rpm. - Add a new warning if any program below a fbash session tries to open an outbound network connection on ports other than http(s) and dns. - Add INFO level messages when programs in a fbash session try to run package management binaries (rpm,yum,etc) or service management (systemctl,chkconfig,etc) binaries. In order to test these new INFO level rules, make up a third class of trace files traces-info.zip containing trace files that should result in info-level messages. To differentiate warning and info level detection, add an attribute to the multiplex file "detect_level", which is "Warning" for the files in traces-positive and "Info" for the files in traces-info. Modify falco_test.py to look specifically for a non-zero count for the given detect_level. Doing this exposed a bug in the way the level-specific counts were being recorded--they were keeping counts by level name, not number. Fix that.
76 lines
1.7 KiB
Bash
Executable File
76 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
SCRIPT=$(readlink -f $0)
|
|
SCRIPTDIR=$(dirname $SCRIPT)
|
|
MULT_FILE=$SCRIPTDIR/falco_tests.yaml
|
|
|
|
function download_trace_files() {
|
|
for TRACE in traces-positive traces-negative traces-info ; do
|
|
rm -rf $SCRIPTDIR/$TRACE
|
|
curl -so $SCRIPTDIR/$TRACE.zip https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE.zip &&
|
|
unzip -d $SCRIPTDIR $SCRIPTDIR/$TRACE.zip &&
|
|
rm -rf $SCRIPTDIR/$TRACE.zip
|
|
done
|
|
}
|
|
|
|
function prepare_multiplex_file() {
|
|
echo "trace_files: !mux" > $MULT_FILE
|
|
|
|
for trace in $SCRIPTDIR/traces-positive/*.scap ; do
|
|
[ -e "$trace" ] || continue
|
|
NAME=`basename $trace .scap`
|
|
cat << EOF >> $MULT_FILE
|
|
$NAME:
|
|
detect: True
|
|
detect_level: Warning
|
|
trace_file: $trace
|
|
EOF
|
|
done
|
|
|
|
for trace in $SCRIPTDIR/traces-negative/*.scap ; do
|
|
[ -e "$trace" ] || continue
|
|
NAME=`basename $trace .scap`
|
|
cat << EOF >> $MULT_FILE
|
|
$NAME:
|
|
detect: False
|
|
trace_file: $trace
|
|
EOF
|
|
done
|
|
|
|
for trace in $SCRIPTDIR/traces-info/*.scap ; do
|
|
[ -e "$trace" ] || continue
|
|
NAME=`basename $trace .scap`
|
|
cat << EOF >> $MULT_FILE
|
|
$NAME:
|
|
detect: True
|
|
detect_level: Informational
|
|
trace_file: $trace
|
|
EOF
|
|
done
|
|
|
|
echo "Contents of $MULT_FILE:"
|
|
cat $MULT_FILE
|
|
}
|
|
|
|
function run_tests() {
|
|
CMD="avocado run --multiplex $MULT_FILE --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
|
|
echo "Running: $CMD"
|
|
$CMD
|
|
TEST_RC=$?
|
|
}
|
|
|
|
|
|
function print_test_failure_details() {
|
|
echo "Showing full job logs for any tests that failed:"
|
|
jq '.tests[] | select(.status != "PASS") | .logfile' $SCRIPTDIR/job-results/latest/results.json | xargs cat
|
|
}
|
|
|
|
download_trace_files
|
|
prepare_multiplex_file
|
|
run_tests
|
|
if [ $TEST_RC -ne 0 ]; then
|
|
print_test_failure_details
|
|
fi
|
|
|
|
exit $TEST_RC
|