diff --git a/go.mod b/go.mod index dfa7fe165a5bbd0b74f52ade64efaefdc28d32c6..b55aacc0ad99775fc74b94b4a4ba78775e8e18c0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,8 @@ module culinux -go 1.17 +go 1.21 + +toolchain go1.21.4 require ( github.com/aquasecurity/libbpfgo v0.4.6-libbpf-1.1.0 diff --git a/pkg/audit/fileaccess/manager.go b/pkg/audit/fileaccess/manager.go index 80d09963f5740f292696ea3f7c162e502a1be68d..2047fb5b21ea5177a432160ac38aa9d10ef3995c 100644 --- a/pkg/audit/fileaccess/manager.go +++ b/pkg/audit/fileaccess/manager.go @@ -51,7 +51,9 @@ func (m *Manager) Attach() error { "restricted_path_unlink", "restricted_path_rmdir", "restricted_path_rename", - "restricted_file_receive"} { //, "restricted_mmap_file", "restricted_file_ioctl"} { + "restricted_file_receive"} { + //"restricted_mmap_file", + //"restricted_file_ioctl" prog, err := m.mod.GetProgram(prog_name) if err != nil { return err diff --git a/pkg/audit/mount/audit.go b/pkg/audit/mount/audit.go index e4d268f54766adec33dcb36b56f78964e41b6e6a..39b93565bf3cb86c10ba9c2495913025a46fbd5b 100644 --- a/pkg/audit/mount/audit.go +++ b/pkg/audit/mount/audit.go @@ -21,16 +21,18 @@ import ( const ( BPF_OBJECT_NAME = "restricted-mount" - BPF_PROGRAM_NAME = "restricted_mount" + MODULE = "module" NEW_UTS_LEN = 64 TASK_COMM_LEN = 16 PATH_MAX = 255 ) +var BPF_PROGRAM_NAME []string = []string{"restricted_mount", "restricted_move_mount"} type auditLog struct { CGroupID uint64 PID uint32 + UID uint32 Ret int32 Nodename [NEW_UTS_LEN + 1]byte Command [TASK_COMM_LEN]byte @@ -112,6 +114,7 @@ func RunAudit(ctx context.Context, wg *sync.WaitGroup, conf *config.Config) erro func newAuditLog(event auditLog) log.RestrictedMountLog { auditEvent := log.AuditEventLog{ + Module: MODULE, Action: retToaction(event.Ret), Hostname: helpers.NodenameToString(event.Nodename), PID: event.PID, diff --git a/pkg/log/logger.go b/pkg/log/logger.go index 8df37afd4d0c26dd9a38e10d0369cae638d53781..fb93d52bd5106a81c5bb9cb9c4ce8608fa9300b5 100644 --- a/pkg/log/logger.go +++ b/pkg/log/logger.go @@ -113,6 +113,7 @@ type LogLabels struct { } type AuditEventLog struct { + Module string Action string Hostname string PID uint32 @@ -180,6 +181,7 @@ func (l *RestrictedFileAccessLog) Info() { func (l *RestrictedMountLog) Info() { Logger.WithFields(logrus.Fields{ + "Module": l.Module, "Action": l.Action, "Hostname": l.Hostname, "PID": l.PID,