luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Browse source 
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
This commit is contained in:
Luna 2026-07-24 09:59:09 -07:00
parent 1d1dee7f6e
commit d835386381
No known key found for this signature in database
43 changed files with 3419 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

101
go-agent/internal/config/config.go
View file

@ -53,11 +53,25 @@ var defaultMemoryObfuscationAllowComms = []string{
// Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
// fields are added as their detectors are ported.
type Config struct {
SampleInterval time.Duration
Cooldown time.Duration
BaselineGrace time.Duration
SUIDRefresh time.Duration
SUIDScanInterval time.Duration
SampleInterval time.Duration
Cooldown time.Duration
BaselineGrace time.Duration
SUIDRefresh time.Duration
SUIDScanInterval time.Duration
// Integrity engines are parsed with the shared configuration for parity,
// but main attaches them only to an explicitly stateful Go sidecar. That
// preserves Python's production baselines and management authority.
FIMEnabled bool
FIMPaths []string
FIMScanInterval time.Duration
FIMPackageVerify bool
FIMPackageVerifyInterval time.Duration
PackageDBVerify bool
PackageDBInterval time.Duration
RootcheckEnabled bool
RootcheckInterval time.Duration
RootcheckPIDCap int
RootcheckModuleAllow map[string]bool
HeartbeatMaxAge int
MaxSnapshots int
MaxSnapshotAgeDays int
@ -97,6 +111,17 @@ func Default() Config {
BaselineGrace: 10 * time.Second,
SUIDRefresh: time.Hour,
SUIDScanInterval: time.Minute,
FIMEnabled: true,
FIMPaths: []string{},
FIMScanInterval: 5 * time.Minute,
FIMPackageVerify: false,
FIMPackageVerifyInterval: 6 * time.Hour,
PackageDBVerify: true,
PackageDBInterval: 10 * time.Minute,
RootcheckEnabled: true,
RootcheckInterval: 5 * time.Minute,
RootcheckPIDCap: 65536,
RootcheckModuleAllow: map[string]bool{},
HeartbeatMaxAge: 120,
MaxSnapshots: 300,
MaxSnapshotAgeDays: 60,
@ -192,6 +217,72 @@ func Load(path string) (Config, error) {
return Config{}, fmt.Errorf("suid_scan_interval: %w", err)
}
cfg.SUIDScanInterval = duration
case "fim_enabled":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("fim_enabled: %w", err)
}
cfg.FIMEnabled = enabled
case "fim_paths":
paths, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("fim_paths: %w", err)
}
cfg.FIMPaths = paths
case "fim_scan_interval":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("fim_scan_interval: %w", err)
}
cfg.FIMScanInterval = duration
case "fim_pkg_verify":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("fim_pkg_verify: %w", err)
}
cfg.FIMPackageVerify = enabled
case "fim_pkg_verify_interval":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("fim_pkg_verify_interval: %w", err)
}
cfg.FIMPackageVerifyInterval = duration
case "pkgdb_verify":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("pkgdb_verify: %w", err)
}
cfg.PackageDBVerify = enabled
case "pkgdb_interval":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("pkgdb_interval: %w", err)
}
cfg.PackageDBInterval = duration
case "rootcheck_enabled":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("rootcheck_enabled: %w", err)
}
cfg.RootcheckEnabled = enabled
case "rootcheck_interval":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("rootcheck_interval: %w", err)
}
cfg.RootcheckInterval = duration
case "rootcheck_pid_cap":
cap, err := nonNegativeInt(value)
if err != nil {
return Config{}, fmt.Errorf("rootcheck_pid_cap: %w", err)
}
cfg.RootcheckPIDCap = cap
case "rootcheck_module_allow":
modules, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("rootcheck_module_allow: %w", err)
}
cfg.RootcheckModuleAllow = stringSet(modules)
case "heartbeat_max_age":
age, err := strconv.Atoi(value)
if err != nil || age < 0 {

22
go-agent/internal/config/config_test.go
View file

@ -14,6 +14,11 @@ func TestDefaultsMatchPython(t *testing.T) {
if cfg.SampleInterval != 4*time.Second || cfg.Cooldown != 60*time.Second ||
cfg.BaselineGrace != 10*time.Second ||
cfg.SUIDRefresh != time.Hour || cfg.SUIDScanInterval != time.Minute ||
!cfg.FIMEnabled || cfg.FIMScanInterval != 5*time.Minute ||
cfg.FIMPackageVerify || cfg.FIMPackageVerifyInterval != 6*time.Hour ||
!cfg.PackageDBVerify || cfg.PackageDBInterval != 10*time.Minute ||
!cfg.RootcheckEnabled || cfg.RootcheckInterval != 5*time.Minute ||
cfg.RootcheckPIDCap != 65536 || len(cfg.RootcheckModuleAllow) != 0 ||
cfg.HeartbeatMaxAge != 120 || cfg.MaxSnapshots != 300 ||
cfg.MaxSnapshotAgeDays != 60 || !cfg.IncidentTracking ||
cfg.IncidentWindow != 1800 || cfg.IncidentLineageDepth != 8 ||
@ -33,6 +38,17 @@ cooldown = 30
baseline_grace = 2.5
suid_refresh = 120
suid_scan_interval = 15
fim_enabled = false
fim_paths = ["/srv/critical"]
fim_scan_interval = 25
fim_pkg_verify = true
fim_pkg_verify_interval = 300
pkgdb_verify = false
pkgdb_interval = 75
rootcheck_enabled = false
rootcheck_interval = 40
rootcheck_pid_cap = 1234
rootcheck_module_allow = ["vendor_gpu"]
heartbeat_max_age = 45
max_snapshots = 25
max_snapshot_age_days = 7
@ -72,6 +88,12 @@ unknown_future_key = true
if cfg.SampleInterval != 1500*time.Millisecond || cfg.Cooldown != 30*time.Second ||
cfg.BaselineGrace != 2500*time.Millisecond ||
cfg.SUIDRefresh != 2*time.Minute || cfg.SUIDScanInterval != 15*time.Second ||
cfg.FIMEnabled || len(cfg.FIMPaths) != 1 || cfg.FIMPaths[0] != "/srv/critical" ||
cfg.FIMScanInterval != 25*time.Second || !cfg.FIMPackageVerify ||
cfg.FIMPackageVerifyInterval != 5*time.Minute ||
cfg.PackageDBVerify || cfg.PackageDBInterval != 75*time.Second ||
cfg.RootcheckEnabled || cfg.RootcheckInterval != 40*time.Second ||
cfg.RootcheckPIDCap != 1234 || !cfg.RootcheckModuleAllow["vendor_gpu"] ||
cfg.HeartbeatMaxAge != 45 || cfg.MaxSnapshots != 25 || cfg.MaxSnapshotAgeDays != 7 ||
cfg.IncidentTracking || cfg.IncidentWindow != 90 || cfg.IncidentLineageDepth != 3 {
t.Fatalf("unexpected parsed config: %+v", cfg)