Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CWS][SEC-11641] Fix auto suppression configuration #20882

Merged
merged 1 commit into from
Nov 24, 2023
Merged

[CWS][SEC-11641] Fix auto suppression configuration #20882

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions cmd/system-probe/config/adjust_security.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,16 @@ func adjustSecurity(cfg config.Config) {
return time.Duration(cfg.GetInt(secNS("activity_dump.cgroup_dump_timeout"))) * time.Minute
})

deprecateCustom(
cfg,
secNS("runtime_security_config.security_profile.anomaly_detection.auto_suppression.enabled"),
secNS("runtime_security_config.security_profile.auto_suppression.enabled"),
func(cfg config.Config) interface{} {
// convert old auto suppression parameter to the new one
return cfg.GetBool(secNS("runtime_security_config.security_profile.anomaly_detection.auto_suppression.enabled"))
},
)

if cfg.GetBool(secNS("enabled")) {
// if runtime is enabled then we force fim
cfg.Set(secNS("fim_enabled"), true, model.SourceAgentRuntime)
Expand Down
2 changes: 1 addition & 1 deletion pkg/config/system_probe_cws.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ func initCWSSystemProbeConfig(cfg Config) {
cfg.BindEnvAndSetDefault("runtime_security_config.activity_dump.tag_rules.enabled", true)
cfg.BindEnvAndSetDefault("runtime_security_config.activity_dump.silent_workloads.delay", "10s")
cfg.BindEnvAndSetDefault("runtime_security_config.activity_dump.silent_workloads.ticker", "10s")
cfg.BindEnvAndSetDefault("runtime_security_config.activity_dump.auto_suppression.enabled", false)
cfg.BindEnvAndSetDefault("runtime_security_config.activity_dump.workload_deny_list", []string{})

// CWS - SBOM
Expand Down Expand Up @@ -84,6 +83,7 @@ func initCWSSystemProbeConfig(cfg Config) {
cfg.BindEnvAndSetDefault("runtime_security_config.security_profile.anomaly_detection.rate_limiter.num_events_allowed", 100)
cfg.BindEnvAndSetDefault("runtime_security_config.security_profile.anomaly_detection.tag_rules.enabled", true)
cfg.BindEnvAndSetDefault("runtime_security_config.security_profile.anomaly_detection.silent_rule_events.enabled", false)
cfg.BindEnvAndSetDefault("runtime_security_config.security_profile.auto_suppression.enabled", false)

// CWS - Hash algorithms
cfg.BindEnvAndSetDefault("runtime_security_config.hash_resolver.enabled", true)
Expand Down
20 changes: 10 additions & 10 deletions pkg/security/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,8 +127,6 @@ type RuntimeSecurityConfig struct {
ActivityDumpSilentWorkloadsDelay time.Duration
// ActivityDumpSilentWorkloadsTicker configures ticker that will check if a workload is silent and should be traced
ActivityDumpSilentWorkloadsTicker time.Duration
// ActivityDumpAutoSuppressionEnabled do not send event if part of a profile
ActivityDumpAutoSuppressionEnabled bool

// # Dynamic configuration fields:
// ActivityDumpMaxDumpSize defines the maximum size of a dump
Expand All @@ -148,6 +146,8 @@ type RuntimeSecurityConfig struct {
SecurityProfileRCEnabled bool
// SecurityProfileDNSMatchMaxDepth defines the max depth of subdomain to be matched for DNS anomaly detection (0 to match everything)
SecurityProfileDNSMatchMaxDepth int
// SecurityProfileAutoSuppressionEnabled do not send event if part of a profile
SecurityProfileAutoSuppressionEnabled bool

// AnomalyDetectionEventTypes defines the list of events that should be allowed to generate anomaly detections
AnomalyDetectionEventTypes []model.EventType
Expand Down Expand Up @@ -282,7 +282,6 @@ func NewRuntimeSecurityConfig() (*RuntimeSecurityConfig, error) {
ActivityDumpSilentWorkloadsDelay: coreconfig.SystemProbe.GetDuration("runtime_security_config.activity_dump.silent_workloads.delay"),
ActivityDumpSilentWorkloadsTicker: coreconfig.SystemProbe.GetDuration("runtime_security_config.activity_dump.silent_workloads.ticker"),
ActivityDumpWorkloadDenyList: coreconfig.SystemProbe.GetStringSlice("runtime_security_config.activity_dump.workload_deny_list"),
ActivityDumpAutoSuppressionEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.anomaly_detection.auto_suppression.enabled"),
// activity dump dynamic fields
ActivityDumpMaxDumpSize: func() int {
mds := coreconfig.SystemProbe.GetInt("runtime_security_config.activity_dump.max_dump_size")
Expand All @@ -306,13 +305,14 @@ func NewRuntimeSecurityConfig() (*RuntimeSecurityConfig, error) {
HashResolverCacheSize: coreconfig.SystemProbe.GetInt("runtime_security_config.hash_resolver.cache_size"),

// security profiles
SecurityProfileEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.enabled"),
SecurityProfileDir: coreconfig.SystemProbe.GetString("runtime_security_config.security_profile.dir"),
SecurityProfileWatchDir: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.watch_dir"),
SecurityProfileCacheSize: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.cache_size"),
SecurityProfileMaxCount: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.max_count"),
SecurityProfileRCEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.remote_configuration.enabled"),
SecurityProfileDNSMatchMaxDepth: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.dns_match_max_depth"),
SecurityProfileEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.enabled"),
SecurityProfileDir: coreconfig.SystemProbe.GetString("runtime_security_config.security_profile.dir"),
SecurityProfileWatchDir: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.watch_dir"),
SecurityProfileCacheSize: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.cache_size"),
SecurityProfileMaxCount: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.max_count"),
SecurityProfileRCEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.remote_configuration.enabled"),
SecurityProfileDNSMatchMaxDepth: coreconfig.SystemProbe.GetInt("runtime_security_config.security_profile.dns_match_max_depth"),
SecurityProfileAutoSuppressionEnabled: coreconfig.SystemProbe.GetBool("runtime_security_config.security_profile.auto_suppression.enabled"),

// anomaly detection
AnomalyDetectionEventTypes: parseEventTypeStringSlice(coreconfig.SystemProbe.GetStringSlice("runtime_security_config.security_profile.anomaly_detection.event_types")),
Expand Down
2 changes: 1 addition & 1 deletion pkg/security/security_profile/profile/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ func NewSecurityProfileManager(config *config.Config, statsdClient statsd.Client
if len(config.RuntimeSecurity.SecurityProfileDir) != 0 {
// override the status if autosuppression is enabled
var status model.Status
if config.RuntimeSecurity.ActivityDumpAutoSuppressionEnabled {
if config.RuntimeSecurity.SecurityProfileAutoSuppressionEnabled {
status = model.AnomalyDetection | model.AutoSuppression
}

Expand Down
Loading