feat(go): advance validation sidecar toward production

go-agent/internal/config/config.go

@@ -53,18 +53,33 @@ var defaultMemoryObfuscationAllowComms = []string{
 // Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
 // fields are added as their detectors are ported.
 type Config struct {
-	SampleInterval              time.Duration
-	HeartbeatMaxAge             int
-	Detectors                   map[string]bool
-	InputSnooperAllowComms      map[string]bool
-	CredentialAccessAllowComms  map[string]bool
-	CredentialAccessExtraPaths  []string
-	Interpreters                map[string]bool
-	EgressAllowCIDRs            []string
-	StealthNetworkAllowComms    map[string]bool
-	StealthNetworkAllowKinds    map[string]bool
-	MemoryObfuscationAllowComms map[string]bool
-	MemoryObfuscationAllowPaths []string
+	SampleInterval                time.Duration
+	Cooldown                      time.Duration
+	BaselineGrace                 time.Duration
+	SUIDRefresh                   time.Duration
+	SUIDScanInterval              time.Duration
+	HeartbeatMaxAge               int
+	MaxSnapshots                  int
+	MaxSnapshotAgeDays            int
+	Detectors                     map[string]bool
+	InputSnooperAllowComms        map[string]bool
+	CredentialAccessAllowComms    map[string]bool
+	CredentialAccessExtraPaths    []string
+	Interpreters                  map[string]bool
+	EgressAllowCIDRs              []string
+	ListenerAllowPorts            map[string]bool
+	ListenerAllowComms            map[string]bool
+	SuppressPackageOwnedListeners bool
+	FirstSeenEnabled              bool
+	SUIDHotDirs                   []string
+	SUIDScanExtraDirs             []string
+	WatchPersistence              []string
+	StealthNetworkAllowComms      map[string]bool
+	StealthNetworkAllowKinds      map[string]bool
+	MemoryObfuscationAllowComms   map[string]bool
+	MemoryObfuscationAllowPaths   []string
+	ExecRulesFile                 string
+	LogDir                        string
 }
 
 // Default returns Python-compatible defaults for the fields currently used.
@@ -74,23 +89,46 @@ func Default() Config {
 		detectors[name] = true
 	}
 	return Config{
-		SampleInterval:              4 * time.Second,
-		HeartbeatMaxAge:             120,
-		Detectors:                   detectors,
-		InputSnooperAllowComms:      stringSet(defaultInputSnooperAllowComms),
-		CredentialAccessAllowComms:  stringSet(defaultCredentialAccessAllowComms),
-		CredentialAccessExtraPaths:  []string{},
-		Interpreters:                stringSet(defaultInterpreters),
-		EgressAllowCIDRs:            []string{},
+		SampleInterval:                4 * time.Second,
+		Cooldown:                      60 * time.Second,
+		BaselineGrace:                 10 * time.Second,
+		SUIDRefresh:                   time.Hour,
+		SUIDScanInterval:              time.Minute,
+		HeartbeatMaxAge:               120,
+		MaxSnapshots:                  300,
+		MaxSnapshotAgeDays:            60,
+		Detectors:                     detectors,
+		InputSnooperAllowComms:        stringSet(defaultInputSnooperAllowComms),
+		CredentialAccessAllowComms:    stringSet(defaultCredentialAccessAllowComms),
+		CredentialAccessExtraPaths:    []string{},
+		Interpreters:                  stringSet(defaultInterpreters),
+		EgressAllowCIDRs:              []string{},
+		ListenerAllowPorts:            map[string]bool{},
+		ListenerAllowComms:            map[string]bool{},
+		SuppressPackageOwnedListeners: false,
+		FirstSeenEnabled:              true,
+		SUIDHotDirs:                   []string{"/tmp", "/dev/shm", "/var/tmp", "/home", "/run/user"},
+		SUIDScanExtraDirs:             []string{"/tmp", "/dev/shm", "/var/tmp", "/run/user"},
+		WatchPersistence: []string{
+			"/etc/cron.d", "/etc/crontab", "/etc/cron.daily", "/etc/cron.hourly",
+			"/etc/cron.weekly", "/var/spool/cron", "/etc/systemd/system",
+			"/etc/ld.so.preload", "/etc/passwd", "/etc/sudoers", "/etc/sudoers.d",
+			"/root/.ssh/authorized_keys", "/root/.bashrc", "/root/.profile",
+		},
 		StealthNetworkAllowComms:    stringSet(defaultStealthNetworkAllowComms),
 		StealthNetworkAllowKinds:    map[string]bool{},
 		MemoryObfuscationAllowComms: stringSet(defaultMemoryObfuscationAllowComms),
 		MemoryObfuscationAllowPaths: []string{},
+		ExecRulesFile:               "",
+		LogDir:                      envOrDefault("ENODIA_LOG_DIR", "/var/log/enodia-sentinel"),
 	}
 }
 
 // Enabled reports whether a detector is enabled by configuration.
 func (c Config) Enabled(name string) bool {
+	if name == "first_seen" && !c.FirstSeenEnabled {
+		return false
+	}
 	return c.Detectors[name]
 }
 
@@ -124,12 +162,48 @@ func Load(path string) (Config, error) {
 				return Config{}, fmt.Errorf("sample_interval must be positive: %q", value)
 			}
 			cfg.SampleInterval = time.Duration(seconds * float64(time.Second))
+		case "cooldown":
+			duration, err := nonNegativeSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("cooldown: %w", err)
+			}
+			cfg.Cooldown = duration
+		case "baseline_grace":
+			duration, err := nonNegativeSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("baseline_grace: %w", err)
+			}
+			cfg.BaselineGrace = duration
+		case "suid_refresh":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("suid_refresh: %w", err)
+			}
+			cfg.SUIDRefresh = duration
+		case "suid_scan_interval":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("suid_scan_interval: %w", err)
+			}
+			cfg.SUIDScanInterval = duration
 		case "heartbeat_max_age":
 			age, err := strconv.Atoi(value)
 			if err != nil || age < 0 {
 				return Config{}, fmt.Errorf("heartbeat_max_age must be non-negative: %q", value)
 			}
 			cfg.HeartbeatMaxAge = age
+		case "max_snapshots":
+			count, err := strconv.Atoi(value)
+			if err != nil || count < 0 {
+				return Config{}, fmt.Errorf("max_snapshots must be non-negative: %q", value)
+			}
+			cfg.MaxSnapshots = count
+		case "max_snapshot_age_days":
+			days, err := strconv.Atoi(value)
+			if err != nil || days < 0 {
+				return Config{}, fmt.Errorf("max_snapshot_age_days must be non-negative: %q", value)
+			}
+			cfg.MaxSnapshotAgeDays = days
 		case "detectors":
 			names, err := stringArray(value)
 			if err != nil {
@@ -171,6 +245,48 @@ func Load(path string) (Config, error) {
 				return Config{}, fmt.Errorf("egress_allow_cidrs: %w", err)
 			}
 			cfg.EgressAllowCIDRs = cidrs
+		case "listener_allow_ports":
+			ports, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("listener_allow_ports: %w", err)
+			}
+			cfg.ListenerAllowPorts = stringSet(ports)
+		case "listener_allow_comms":
+			comms, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("listener_allow_comms: %w", err)
+			}
+			cfg.ListenerAllowComms = stringSet(comms)
+		case "suppress_package_owned_listeners":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("suppress_package_owned_listeners: %w", err)
+			}
+			cfg.SuppressPackageOwnedListeners = enabled
+		case "first_seen_enabled":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("first_seen_enabled: %w", err)
+			}
+			cfg.FirstSeenEnabled = enabled
+		case "suid_hot_dirs":
+			dirs, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("suid_hot_dirs: %w", err)
+			}
+			cfg.SUIDHotDirs = dirs
+		case "suid_scan_extra_dirs":
+			dirs, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("suid_scan_extra_dirs: %w", err)
+			}
+			cfg.SUIDScanExtraDirs = dirs
+		case "watch_persistence":
+			paths, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("watch_persistence: %w", err)
+			}
+			cfg.WatchPersistence = paths
 		case "stealth_network_allow_comms":
 			names, err := stringArray(value)
 			if err != nil {
@@ -195,11 +311,57 @@ func Load(path string) (Config, error) {
 				return Config{}, fmt.Errorf("memory_obfuscation_allow_paths: %w", err)
 			}
 			cfg.MemoryObfuscationAllowPaths = paths
+		case "exec_rules_file":
+			path, err := strconv.Unquote(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("exec_rules_file must be a string: %q", value)
+			}
+			cfg.ExecRulesFile = path
+		case "log_dir":
+			path, err := strconv.Unquote(value)
+			if err != nil || path == "" {
+				return Config{}, fmt.Errorf("log_dir must be a non-empty string: %q", value)
+			}
+			cfg.LogDir = path
 		}
 	}
 	return cfg, nil
 }
 
+func envOrDefault(name, fallback string) string {
+	if value := os.Getenv(name); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func positiveSeconds(value string) (time.Duration, error) {
+	seconds, err := strconv.ParseFloat(value, 64)
+	if err != nil || seconds <= 0 {
+		return 0, fmt.Errorf("must be positive: %q", value)
+	}
+	return time.Duration(seconds * float64(time.Second)), nil
+}
+
+func nonNegativeSeconds(value string) (time.Duration, error) {
+	seconds, err := strconv.ParseFloat(value, 64)
+	if err != nil || seconds < 0 {
+		return 0, fmt.Errorf("must be non-negative: %q", value)
+	}
+	return time.Duration(seconds * float64(time.Second)), nil
+}
+
+func boolean(value string) (bool, error) {
+	switch value {
+	case "true":
+		return true, nil
+	case "false":
+		return false, nil
+	default:
+		return false, fmt.Errorf("must be true or false: %q", value)
+	}
+}
+
 func stringSet(values []string) map[string]bool {
 	result := make(map[string]bool, len(values))
 	for _, value := range values {