28d67a1360
Port the bash prototype to a structured, testable Python codebase while
preserving the same control loop and the seven detection signatures. The bash
implementation stays in src/ as the regression oracle.
Highlights:
- enodia_sentinel/ package (stdlib only — no runtime deps):
- detectors/ : one pure function per signature, detect(state, cfg)->Alerts
- system.py : SystemState — one cached /proc + ss snapshot per sweep,
fully injectable so detectors are unit-testable
- daemon.py : sweep loop, in-process cooldown dedup, threaded snapshot
capture, and a SUID filesystem scan moved OFF the loop
thread onto a slow background cadence
- snapshot.py: forensic text + JSON sidecar with per-signature IR guidance
- config.py : dataclass config via TOML + env overrides
- netutil.py : public-IP / CIDR logic via stdlib ipaddress
- tests/ : 25 stdlib-unittest cases (no root, no /proc, no ss needed)
- TOML config, launcher wrapper, Makefile (pip-free install), hardened
systemd unit (env-resolved ExecStart), updated PKGBUILD, rewritten README
Performance: per-sweep cost ~200 ms (shared cached state); the multi-second
SUID walk no longer blocks detection. scandir-based walk replaces os.walk.
Verified on Arch: all 7 detectors fire on red-team drills (reverse_shell,
ld_preload, deleted_exe, new_listener, new_suid confirmed live end-to-end),
no false positives on a clean sweep, 25/25 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
1.8 KiB
Python
62 lines
1.8 KiB
Python
"""Detector registry.
|
|
|
|
Each detector is a ``Detector`` with a ``name`` and a ``detect(state, cfg)``
|
|
callable yielding ``Alert``s. They are pure functions of the injected
|
|
``SystemState`` + ``Config``, which is what makes them unit-testable without
|
|
root or a live system.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import Callable, Iterable, Iterator
|
|
from dataclasses import dataclass
|
|
|
|
from ..alert import Alert
|
|
from ..config import Config
|
|
from ..system import SystemState
|
|
from . import (
|
|
deleted_exe,
|
|
egress,
|
|
ld_preload,
|
|
new_listener,
|
|
new_suid,
|
|
persistence,
|
|
reverse_shell,
|
|
)
|
|
|
|
DetectFn = Callable[[SystemState, Config], Iterable[Alert]]
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Detector:
|
|
name: str
|
|
detect: DetectFn
|
|
needs_baseline: bool = False # gated until after the grace window
|
|
expensive: bool = False # gated to the slow scan cadence
|
|
|
|
|
|
# Order here is the order signatures appear in a snapshot.
|
|
REGISTRY: tuple[Detector, ...] = (
|
|
Detector("reverse_shell", reverse_shell.detect),
|
|
Detector("ld_preload", ld_preload.detect),
|
|
Detector("deleted_exe", deleted_exe.detect),
|
|
Detector("egress", egress.detect),
|
|
Detector("new_listener", new_listener.detect, needs_baseline=True),
|
|
Detector("persistence", persistence.detect, needs_baseline=True),
|
|
Detector("new_suid", new_suid.detect, needs_baseline=True, expensive=True),
|
|
)
|
|
|
|
|
|
def run_all(
|
|
state: SystemState,
|
|
cfg: Config,
|
|
*,
|
|
include: Iterable[str] | None = None,
|
|
) -> Iterator[Alert]:
|
|
"""Run the enabled detectors whose names are in ``include`` (or all)."""
|
|
wanted = set(include) if include is not None else None
|
|
for det in REGISTRY:
|
|
if not cfg.enabled(det.name):
|
|
continue
|
|
if wanted is not None and det.name not in wanted:
|
|
continue
|
|
yield from det.detect(state, cfg)
|