d835386381
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.
Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.
Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
121 lines
3.2 KiB
Go
121 lines
3.2 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package pkgdb
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"sync"
|
|
"time"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
// Manager owns the slow package-database fingerprint outside the polling path.
|
|
// One check runs at a time; an unavailable pacman database or log fails open
|
|
// rather than turning an environmental read error into a tamper claim.
|
|
type Manager struct {
|
|
Config config.Config
|
|
Now func() time.Time
|
|
Fingerprint func(string) (string, error)
|
|
LastTransaction func(string) (time.Time, bool)
|
|
DBDir string
|
|
PacmanLog string
|
|
|
|
mu sync.Mutex
|
|
initialized bool
|
|
lastRun time.Time
|
|
running bool
|
|
pendingAlerts []model.Alert
|
|
}
|
|
|
|
func New(cfg config.Config) *Manager {
|
|
return &Manager{
|
|
Config: cfg, Now: time.Now, Fingerprint: Fingerprint,
|
|
LastTransaction: LastTransactionTime, DBDir: defaultDBDir, PacmanLog: defaultPacmanLog,
|
|
}
|
|
}
|
|
|
|
func (m *Manager) anchorPath() string {
|
|
return filepath.Join(m.Config.LogDir, anchorFilename)
|
|
}
|
|
|
|
// Initialize records the first available fingerprint synchronously. This is a
|
|
// one-time baseline action before events are emitted; subsequent checks stay
|
|
// asynchronous and never rewrite unexplained drift.
|
|
func (m *Manager) Initialize() error {
|
|
if !m.Config.PackageDBVerify {
|
|
return nil
|
|
}
|
|
m.mu.Lock()
|
|
if m.initialized {
|
|
m.mu.Unlock()
|
|
return nil
|
|
}
|
|
m.mu.Unlock()
|
|
if err := os.MkdirAll(m.Config.LogDir, 0o750); err != nil {
|
|
return err
|
|
}
|
|
if err := m.evaluate(m.Now()); err != nil {
|
|
return err
|
|
}
|
|
m.mu.Lock()
|
|
m.initialized = true
|
|
m.mu.Unlock()
|
|
return nil
|
|
}
|
|
|
|
// MaybeStart starts a due fingerprint in the background. Setting lastRun
|
|
// before launching makes a stalled disk scan self-throttling instead of
|
|
// spawning one goroutine per polling interval.
|
|
func (m *Manager) MaybeStart(now time.Time) {
|
|
if !m.Config.PackageDBVerify {
|
|
return
|
|
}
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
if !m.initialized || m.running || (!m.lastRun.IsZero() && now.Sub(m.lastRun) < m.Config.PackageDBInterval) {
|
|
return
|
|
}
|
|
m.running, m.lastRun = true, now
|
|
go m.run(now)
|
|
}
|
|
|
|
func (m *Manager) run(now time.Time) {
|
|
_ = m.evaluate(now) // Collection errors are intentionally fail-open.
|
|
m.mu.Lock()
|
|
m.running = false
|
|
m.mu.Unlock()
|
|
}
|
|
|
|
func (m *Manager) evaluate(now time.Time) error {
|
|
current, err := m.Fingerprint(m.DBDir)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
anchor, hasAnchor := loadAnchor(m.anchorPath())
|
|
transaction, hasTransaction := m.LastTransaction(m.PacmanLog)
|
|
alert, replacement := check(current, anchor, hasAnchor, transaction, hasTransaction, now)
|
|
if replacement != nil {
|
|
if err := saveAnchor(m.anchorPath(), *replacement); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if alert != nil {
|
|
m.mu.Lock()
|
|
m.pendingAlerts = append(m.pendingAlerts, *alert)
|
|
m.mu.Unlock()
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Drain hands completed findings to Agent, which applies the shared cooldown,
|
|
// snapshot, and event-stream ordering before any finding becomes observable.
|
|
func (m *Manager) Drain() []model.Alert {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
alerts := append([]model.Alert(nil), m.pendingAlerts...)
|
|
m.pendingAlerts = nil
|
|
return alerts
|
|
}
|