search

SUSE / linux-security-sensor

Linux security sensor
Other
18 stars 9 forks source link

Add chattr plugin #21

Closed lorddoskias closed 2 years ago

lorddoskias commented 2 years ago

This prq adds the chattr plugin as per SENS-20. Example json output of an event: 

 {
  "Timestamp": "2022-04-12 13:50:42",
  "Path": "/root/get-num-extwriters.py",
  "Dir": false,
  "Sha256sum": "f01b48d4763f5b122d218c1faff8419ca41b27b1f3161984790f82b90fa85675",
  "Action": "SET"
 }

In case we have a directory the hash sum won't be calculated. THe bpf code is coded such that an event is triggered only when it will result in an actual change of immutable state i.e 2 or more consecutive set or clear operations would result in a single event being produced.

Tested on both 5.3 kernel and upstream.

lorddoskias commented 2 years ago

Superseded by #31