feat(go): port process access detectors

go-agent/internal/detectors/credential_access.go

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+var exactCredentialFiles = map[string]bool{
+	"/etc/shadow": true, "/etc/gshadow": true, "/etc/security/opasswd": true,
+}
+
+var browserSecretNames = map[string]bool{
+	"logins.json": true, "key4.db": true, "Login Data": true, "Cookies": true,
+}
+
+var browserPathMarkers = []string{
+	"/.mozilla/", "/firefox/", "/chromium/", "/google-chrome/",
+	"/chrome/", "/brave", "/vivaldi/", "/edge/",
+}
+
+// CredentialAccess ports the Python credential_access detector (SID 100033).
+func CredentialAccess(state model.State, cfg config.Config) []model.Alert {
+	alerts := make([]model.Alert, 0)
+	for _, process := range state.Processes {
+		comm := process.Comm
+		if comm == "" {
+			comm = "?"
+		}
+		if cfg.CredentialAccessAllowComms[comm] {
+			continue
+		}
+		for _, fd := range sortedFDs(process.FDTargets) {
+			target := strings.TrimSuffix(process.FDTargets[fd], " (deleted)")
+			kind := sensitiveCredentialKind(target, cfg.CredentialAccessExtraPaths)
+			if kind == "" {
+				continue
+			}
+			alerts = append(alerts, model.Alert{
+				SID:       100033,
+				Severity:  "CRITICAL",
+				Signature: "credential_access",
+				Classtype: "credential-theft",
+				Key:       fmt.Sprintf("cred:%d:%s", process.PID, target),
+				Detail: fmt.Sprintf(
+					"pid=%d comm=%s fd=%s has %s open: %s",
+					process.PID, comm, fd, kind, target),
+				PIDs: []int{process.PID},
+			})
+			break
+		}
+	}
+	return alerts
+}
+
+func sensitiveCredentialKind(path string, extraPaths []string) string {
+	if !strings.HasPrefix(path, "/") {
+		return ""
+	}
+	if exactCredentialFiles[path] {
+		return "system credential database"
+	}
+	if matchesExtraPath(path, extraPaths) {
+		return "configured credential path"
+	}
+	if strings.Contains(path, "/.ssh/") {
+		name := filepath.Base(path)
+		if strings.HasPrefix(name, "id_") || strings.HasSuffix(name, ".pem") || strings.HasSuffix(name, ".key") {
+			return "private SSH key"
+		}
+	}
+	if strings.HasPrefix(path, "/etc/NetworkManager/system-connections/") {
+		return "NetworkManager secret profile"
+	}
+	if browserSecretNames[filepath.Base(path)] {
+		lowered := strings.ToLower(path)
+		for _, marker := range browserPathMarkers {
+			if strings.Contains(lowered, marker) {
+				return "browser credential store"
+			}
+		}
+	}
+	return ""
+}
+
+func matchesExtraPath(path string, entries []string) bool {
+	for _, entry := range entries {
+		if entry == "" {
+			continue
+		}
+		if strings.HasSuffix(entry, "/") && strings.HasPrefix(path, entry) {
+			return true
+		}
+		if path == entry || strings.HasPrefix(path, strings.TrimRight(entry, "/")+"/") {
+			return true
+		}
+	}
+	return false
+}