luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host event rules for bind and capability activity

Browse source
This commit is contained in:
Luna 2026-07-10 04:11:33 -07:00
parent b40ac4252c
commit 9784033f86
No known key found for this signature in database
12 changed files with 316 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

38
tests/test_rule_compat.py
View file

@ -124,6 +124,44 @@ class TestRuleEventCompatibility(unittest.TestCase):
"target_uid": "0",
}))
def test_host_event_accepts_bind_accept_capset_and_module_shapes(self):
self.assertIn(100073, self._sids({
"type": "bind",
"pid": "4242",
"ppid": "1",
"uid": "1000",
"comm": "python3",
"bind_ip": "0.0.0.0",
"bind_port": "4444",
}))
self.assertIn(100076, self._sids({
"event": "accept",
"pid": 4242,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"remote_ip": "8.8.8.8",
"remote_port": "51515",
"local_port": "4444",
}))
self.assertIn(100077, self._sids({
"event": "capset",
"pid": 4242,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"capability": "CAP_SYS_ADMIN",
}))
self.assertIn(100078, self._sids({
"event": "module_load",
"pid": 4242,
"ppid": 1,
"uid": 0,
"comm": "insmod",
"path": "/tmp/evil.ko",
"name": "evil",
}))
def test_unknown_event_shape_still_errors(self):
with self.assertRaisesRegex(
ValueError, "event JSON must be an exec, syscall, or host event"