586f74b929
Replace MIT with the full GNU GPLv3 text, update license metadata in pyproject.toml (+ trove classifiers) and PKGBUILD, and add SPDX-License-Identifier headers to all Python modules and shell scripts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
81 lines
2.5 KiB
Python
81 lines
2.5 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Command-line entry point.
|
|
|
|
enodia-sentinel run # daemon loop (default; used by systemd)
|
|
enodia-sentinel check # run every detector once, print alerts, exit
|
|
enodia-sentinel baseline # (re)build listener/SUID baselines and exit
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import signal
|
|
import sys
|
|
|
|
from . import __version__, detectors
|
|
from .config import Config
|
|
from .daemon import Sentinel
|
|
from .system import SystemState, scan_suid_binaries
|
|
|
|
|
|
def _cmd_run(cfg: Config) -> int:
|
|
sentinel = Sentinel(cfg)
|
|
signal.signal(signal.SIGTERM, sentinel.stop)
|
|
signal.signal(signal.SIGINT, sentinel.stop)
|
|
sentinel.run()
|
|
return 0
|
|
|
|
|
|
def _cmd_baseline(cfg: Config) -> int:
|
|
sentinel = Sentinel(cfg)
|
|
sentinel.build_baselines()
|
|
print(f"Baselines written under {cfg.log_dir}")
|
|
return 0
|
|
|
|
|
|
def _cmd_check(cfg: Config) -> int:
|
|
# One-shot: arm everything immediately, force the SUID scan.
|
|
sentinel = Sentinel(cfg)
|
|
sentinel.start_time = 0.0 # past the grace window
|
|
sentinel.load_baselines()
|
|
if not sentinel.listener_baseline:
|
|
sentinel.build_baselines()
|
|
alerts = sentinel.sweep(force_suid=True)
|
|
if not alerts:
|
|
print("No alerts.")
|
|
return 0
|
|
for a in sorted(alerts, key=lambda x: -x.severity):
|
|
print(f"[{a.severity}] {a.signature:<14} {a.detail}")
|
|
return 0
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(
|
|
prog="enodia-sentinel",
|
|
description="Host intrusion-detection daemon.",
|
|
)
|
|
parser.add_argument("--version", action="version",
|
|
version=f"enodia-sentinel {__version__}")
|
|
parser.add_argument("-c", "--config", help="path to TOML config")
|
|
sub = parser.add_subparsers(dest="cmd")
|
|
sub.add_parser("run", help="run the daemon loop (default)")
|
|
sub.add_parser("check", help="run detectors once and print alerts")
|
|
sub.add_parser("baseline", help="rebuild listener/SUID baselines")
|
|
sub.add_parser("list-detectors", help="list available detectors")
|
|
|
|
args = parser.parse_args(argv)
|
|
cfg = Config.load(args.config)
|
|
|
|
if args.cmd == "list-detectors":
|
|
for det in detectors.REGISTRY:
|
|
mark = "on " if cfg.enabled(det.name) else "off"
|
|
print(f" [{mark}] {det.name}")
|
|
return 0
|
|
if args.cmd == "baseline":
|
|
return _cmd_baseline(cfg)
|
|
if args.cmd == "check":
|
|
return _cmd_check(cfg)
|
|
return _cmd_run(cfg)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|