luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host event rules for bind and capability activity

Browse source
This commit is contained in:
Luna 2026-07-10 04:11:33 -07:00
parent b40ac4252c
commit 9784033f86
No known key found for this signature in database
12 changed files with 316 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

52
tests/test_ruleops.py
View file

@ -24,6 +24,10 @@ class TestRuleOps(unittest.TestCase):
self.assertIn(100070, sids)
self.assertIn(100071, sids)
self.assertIn(100072, sids)
self.assertIn(100073, sids)
self.assertIn(100076, sids)
self.assertIn(100077, sids)
self.assertIn(100078, sids)
exec_rule = next(r for r in rules if r["sid"] == 100002)
self.assertEqual(exec_rule["event"], "exec")
self.assertIn("argv_regex", exec_rule["conditions"])
@ -36,6 +40,9 @@ class TestRuleOps(unittest.TestCase):
write_rule = next(r for r in rules if r["sid"] == 100069)
self.assertEqual(write_rule["event"], "file_write")
self.assertIn("path_prefixes", write_rule["conditions"])
cap_rule = next(r for r in rules if r["sid"] == 100077)
self.assertEqual(cap_rule["event"], "capset")
self.assertIn("capabilities_any", cap_rule["conditions"])
def test_configured_exec_rule_is_listed(self):
with tempfile.TemporaryDirectory() as d:
@ -135,6 +142,51 @@ exec_comm = ["id"]
}
self.assertEqual(ruleops.test_event(cfg, event), [])
def test_matches_bind_accept_capset_and_module_load_events(self):
cfg = Config()
cases = (
(100073, {
"event": "bind",
"pid": 42,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"local_ip": "0.0.0.0",
"local_port": 4444,
}),
(100076, {
"event": "accept",
"pid": 42,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"peer_ip": "8.8.8.8",
"peer_port": 51515,
"local_ip": "0.0.0.0",
"local_port": 4444,
}),
(100077, {
"event": "capset",
"pid": 42,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"capabilities": ["CAP_SYS_ADMIN"],
}),
(100078, {
"event": "module_load",
"pid": 42,
"ppid": 1,
"uid": 0,
"comm": "insmod",
"path": "/tmp/evil.ko",
"module_name": "evil",
}),
)
for sid, event in cases:
with self.subTest(sid=sid):
self.assertIn(sid, {a.sid for a in ruleops.test_event(cfg, event)})
def test_render_markdown_documents_rules(self):
text = ruleops.render_markdown(Config())
self.assertIn("# Enodia Sentinel Event Rule Reference", text)