49 lines
1.4 KiB
Go
49 lines
1.4 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
// NewSUID ports the Python new_suid detector (SID 100014).
|
|
// The filesystem scan and baseline are supplied by the caller; absent values
|
|
// remain fail-open until the sidecar gains its own slow-scan persistence.
|
|
func NewSUID(state model.State, cfg config.Config) []model.Alert {
|
|
if state.SUIDBinaries == nil || state.SUIDBaseline == nil {
|
|
return []model.Alert{}
|
|
}
|
|
baseline := make(map[string]bool, len(state.SUIDBaseline))
|
|
for _, path := range state.SUIDBaseline {
|
|
baseline[path] = true
|
|
}
|
|
alerts := make([]model.Alert, 0)
|
|
for _, path := range state.SUIDBinaries {
|
|
if baseline[path] {
|
|
continue
|
|
}
|
|
hot := false
|
|
for _, directory := range cfg.SUIDHotDirs {
|
|
directory = strings.TrimRight(directory, "/")
|
|
if directory != "" && strings.HasPrefix(path, directory+"/") {
|
|
hot = true
|
|
break
|
|
}
|
|
}
|
|
severity := "HIGH"
|
|
detail := "new SUID/SGID binary: " + path
|
|
if hot {
|
|
severity = "CRITICAL"
|
|
detail = "SUID/SGID binary in writable dir: " + path
|
|
}
|
|
alerts = append(alerts, model.Alert{
|
|
SID: 100014, Severity: severity, Signature: "new_suid",
|
|
Classtype: "privilege-escalation", Key: "suid:" + path,
|
|
Detail: detail, PIDs: []int{},
|
|
})
|
|
}
|
|
return alerts
|
|
}
|