auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36310

efd6 · 2023-08-14T04:42:35Z

Proposed commit message

In environments where SELinux is employed then it is useful to monitor file metadata for changes to SELinux labels. A change to labeling can impact security posture. Similarly in environments where file ACLs are used (e.g. getfacl, setfacl) it is useful to monitor for changes to these ACLs (just like it is useful to monitor permissions in the file mode). So add support for the filesystem extended attributes (xattrs) named security.selinux and system.posix_acl_access that detail these.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

[ ]

How to test this PR locally

Related issues

For [Auditbeat] file_integrity - Monitor ACL and selinux attributes on Linux #36265

Use cases

Screenshots

Logs

Sample event:

{
  "@metadata": {
    "beat": "auditbeat",
    "type": "_doc",
    "version": "8.10.0"
  },
  "@timestamp": "2023-08-16T14:30:29.388Z",
  "agent": {
    "ephemeral_id": "b7d1b2b6-712a-48d7-8de2-b419afd46d75",
    "id": "1681fe91-1cc8-460e-9e7e-fb1fe9b29348",
    "name": "linux",
    "type": "auditbeat",
    "version": "8.10.0"
  },
  "ecs": {
    "version": "8.0.0"
  },
  "event": {
    "action": [
      "attributes_modified"
    ],
    "category": [
      "file"
    ],
    "dataset": "file",
    "kind": "event",
    "module": "file_integrity",
    "type": [
      "change"
    ]
  },
  "file": {
    "ctime": "2023-08-16T14:30:29.384Z",
    "extension": "bar",
    "gid": "0",
    "group": "root",
    "hash": {
      "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709"
    },
    "inode": "71102",
    "mode": "0674",
    "mtime": "2023-08-14T20:49:03.249Z",
    "owner": "root",
    "path": "/foo.bar",
    "posix_acl_access": [
      "user::rw-",
      "user:landscape:-wx",
      "group::r--",
      "mask::rwx",
      "other::r--"
    ],
    "selinux": "system_u:object_r:quota_db_t:s0",
    "size": 0,
    "type": "file",
    "uid": "0"
  },
  "host": {
    "name": "linux"
  },
  "service": {
    "type": "file_integrity"
  }
}

elasticmachine · 2023-08-14T05:22:32Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-08-16T07:10:11.968+0000
Duration: 138 min 13 sec

Test stats 🧪

Test	Results
Failed	0
Passed	28124
Skipped	2015
Total	30139

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

…l_access xattrs

elasticmachine · 2023-08-14T09:23:22Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

andrewkroh

I tested that changing both selinux and acl attributes triggers an inotify CHMOD event.

This is missing a modification to diffEvents() to detect if these new attributes changed.

beats/auditbeat/module/file_integrity/event.go

Lines 406 to 412 in 2797a04

    
           // Test if metadata has changed. 
        
           if o, n := old.Info, new.Info; o != nil && n != nil { 
        
           	// The owner and group names are ignored (they aren't persisted). 
        
           	if o.Inode != n.Inode || o.UID != n.UID || o.GID != n.GID || o.SID != n.SID || 
        
           		o.Mode != n.Mode || o.Type != n.Type || o.SetUID != n.SetUID || o.SetGID != n.SetGID { 
        
           		result |= AttributesModified 
        
           	}

And it needs a modification in buildMetricbeatEvent() to expose the new fields in events.

beats/auditbeat/module/file_integrity/event.go

Line 260 in 2797a04

func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event {

andrewkroh · 2023-08-14T21:29:10Z

auditbeat/module/file_integrity/fileinfo_posix.go

@@ -67,6 +68,11 @@ func NewMetadata(path string, info os.FileInfo) (*Metadata, error) {
 		fileInfo.Owner = owner.Username
 	}

+	getExtendedAttributes(path, map[string]*string{


Assuming this is linux-only then can we guard this with a if runtime.GOOS == "linux".

The system.posix_acl_access should in principle be available on other OSs.

auditbeat/module/file_integrity/fileinfo_posix.go

andrewkroh · 2023-08-15T17:56:14Z

auditbeat/module/file_integrity/event.go

 		}
 	}
 	return out
 }

+func aclText(s string) ([]string, error) {
+	b, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(s, "0s"))


The value coming back from FGet is actually the raw binary data. It is not a base64 encoded value. The 0s base64 must just be the representation used with getfattr when the value binary. I think this also means the system.posix_acl_access value should not be trimNulled.

I hacked in changes and re-tested, and I observed what I expected in the output event with 👍

"posix_acl_access": [ "user::rw-", "user:landscape:rwx", "group::r--", "mask::rwx", "other::r--" ],

I've kept the POSIXACLAccess field as a string. It sits right on the boundary of making a decision to change it to a []byte, but I think it's just slightly better as string.

The only impact of this decision to users will be the debug message that shows the old and new metadata. How does go encode a []byte? IIRC it uses base64 which IMO would be slightly nicer in the logs.

{"log.level":"debug","@timestamp":"2023-08-16T10:30:29.388-0400","log.logger":"file_integrity","log.origin":{"file.name":"file_integrity/metricset.go","file.line":296},"message":"File changed since it was last seen","service.name":"auditbeat","file_path":"/foo.bar","took":280205,"event":{"action":"attributes_modified","old":{"timestamp":"2023-08-16T14:30:00.686192244Z","path":"/foo.bar","info":{"inode":71102,"uid":0,"gid":0,"sid":"","owner":"","group":"","size":0,"mtime":"2023-08-14T20:49:03.249161413Z","ctime":"2023-08-15T17:49:52.337561405Z","type":"file","mode":444,"setuid":false,"setgid":false,"origin":null,"selinux":"system_u:object_r:quota_db_t:s0","posix_acl_access":"\u0002\u0000\u0000\u0000\u0001\u0000\u0006\u0000\ufffd\ufffd\ufffd\ufffd\u0002\u0000\u0007\u0000o\u0000\u0000\u0000\u0004\u0000\u0004\u0000\ufffd\ufffd\ufffd\ufffd\u0010\u0000\u0007\u0000\ufffd\ufffd\ufffd\ufffd \u0000\u0004\u0000\ufffd\ufffd\ufffd\ufffd"},"source":"scan","action":"none","hash":{"sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709"}},"new":{"timestamp":"2023-08-16T14:30:29.388513038Z","path":"/foo.bar","info":{"inode":71102,"uid":0,"gid":0,"sid":"","owner":"root","group":"root","size":0,"mtime":"2023-08-14T20:49:03.249161413Z","ctime":"2023-08-16T14:30:29.384200342Z","type":"file","mode":444,"setuid":false,"setgid":false,"origin":null,"selinux":"system_u:object_r:quota_db_t:s0","posix_acl_access":"\u0002\u0000\u0000\u0000\u0001\u0000\u0006\u0000\ufffd\ufffd\ufffd\ufffd\u0002\u0000\u0003\u0000o\u0000\u0000\u0000\u0004\u0000\u0004\u0000\ufffd\ufffd\ufffd\ufffd\u0010\u0000\u0007\u0000\ufffd\ufffd\ufffd\ufffd \u0000\u0004\u0000\ufffd\ufffd\ufffd\ufffd"},"source":"fsnotify","action":"attributes_modified","hash":{"sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709"}},"ecs.version":"1.6.0"}}

We could add a MarshalText method to the POSIXACLAccess field that renders it in the standard format. WDYT?

I guess that's not very different from keeping it as a []byte. I think one of these should be done because note the \ufffd. These are not in the original data; they are the unicode replacement rune because 0xffff is not a valid code point.

efd6 · 2023-08-16T07:57:53Z

run elasticsearch-ci/docs

…l_access xattrs (#36310) (cherry picked from commit d771501)

…l_access xattrs (#36310) (#36350) (cherry picked from commit d771501) Co-authored-by: Dan Kortschak <[email protected]>

…l_access xattrs (elastic#36310)

efd6 added enhancement Auditbeat backport-skip Skip notification from the automated backport with mergify 8.10-candidate labels Aug 14, 2023

efd6 self-assigned this Aug 14, 2023

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 14, 2023

efd6 force-pushed the 36265-xattrs branch from e4a6b54 to 9a7e5f2 Compare August 14, 2023 04:43

efd6 added the Team:Security-External Integrations label Aug 14, 2023

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 14, 2023

efd6 force-pushed the 36265-xattrs branch 2 times, most recently from 99560ee to 9182000 Compare August 14, 2023 05:15

auditbeat/module/file_integrity: add support for selinux and posix_ac…

2797a04

…l_access xattrs

efd6 force-pushed the 36265-xattrs branch from 9182000 to 2797a04 Compare August 14, 2023 06:26

efd6 marked this pull request as ready for review August 14, 2023 09:23

efd6 requested review from a team as code owners August 14, 2023 09:23

andrewkroh reviewed Aug 14, 2023

View reviewed changes

efd6 requested a review from andrewkroh August 15, 2023 01:06

efd6 force-pushed the 36265-xattrs branch 5 times, most recently from 56bfe12 to f7ca8a7 Compare August 15, 2023 07:17

address pr comments

4303194

efd6 force-pushed the 36265-xattrs branch from f7ca8a7 to 4303194 Compare August 15, 2023 07:23

andrewkroh reviewed Aug 15, 2023

View reviewed changes

address pr comment

cced9cc

efd6 requested a review from andrewkroh August 15, 2023 21:27

efd6 force-pushed the 36265-xattrs branch from 34e3902 to 7871099 Compare August 16, 2023 06:57

add missing fbDecodeMetadata accesses

0f8dccb

efd6 force-pushed the 36265-xattrs branch from 7871099 to 0f8dccb Compare August 16, 2023 07:09

andrewkroh approved these changes Aug 16, 2023

View reviewed changes

andrewkroh added backport-v8.10.0 Automated backport with mergify and removed backport-skip Skip notification from the automated backport with mergify labels Aug 16, 2023

efd6 merged commit d771501 into elastic:main Aug 16, 2023
8 checks passed

mergify bot pushed a commit that referenced this pull request Aug 16, 2023

auditbeat/module/file_integrity: add support for selinux and posix_ac…

722d920

…l_access xattrs (#36310) (cherry picked from commit d771501)

mergify bot mentioned this pull request Aug 16, 2023

[8.10](backport #36310) auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36350

Merged

efd6 mentioned this pull request Aug 16, 2023

auditbeat/module/file_integrity: encode POSIXACLAccess as []byte #36351

Merged

6 tasks

efd6 added a commit that referenced this pull request Aug 17, 2023

auditbeat/module/file_integrity: add support for selinux and posix_ac…

85afa4a

…l_access xattrs (#36310) (cherry picked from commit d771501)

efd6 added a commit that referenced this pull request Aug 17, 2023

auditbeat/module/file_integrity: add support for selinux and posix_ac…

aec1c13

…l_access xattrs (#36310) (cherry picked from commit d771501)

andrewkroh pushed a commit that referenced this pull request Aug 21, 2023

auditbeat/module/file_integrity: add support for selinux and posix_ac…

714f2d8

…l_access xattrs (#36310) (cherry picked from commit d771501)

efd6 added a commit that referenced this pull request Aug 21, 2023

auditbeat/module/file_integrity: add support for selinux and posix_ac…

31febf5

…l_access xattrs (#36310) (#36350) (cherry picked from commit d771501) Co-authored-by: Dan Kortschak <[email protected]>

Scholar-Li pushed a commit to Scholar-Li/beats that referenced this pull request Feb 5, 2024

auditbeat/module/file_integrity: add support for selinux and posix_ac…

6c41013

…l_access xattrs (elastic#36310)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36310

auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36310

efd6 commented Aug 14, 2023 •

edited by andrewkroh

Loading

elasticmachine commented Aug 14, 2023 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

elasticmachine commented Aug 14, 2023

andrewkroh left a comment

andrewkroh Aug 14, 2023

efd6 Aug 14, 2023

andrewkroh Aug 15, 2023

efd6 Aug 15, 2023 •

edited

Loading

andrewkroh Aug 16, 2023

efd6 Aug 16, 2023

efd6 Aug 16, 2023

efd6 commented Aug 16, 2023

	// Test if metadata has changed.
	if o, n := old.Info, new.Info; o != nil && n != nil {
	// The owner and group names are ignored (they aren't persisted).
	if o.Inode != n.Inode \|\| o.UID != n.UID \|\| o.GID != n.GID \|\| o.SID != n.SID \|\|
	o.Mode != n.Mode \|\| o.Type != n.Type \|\| o.SetUID != n.SetUID \|\| o.SetGID != n.SetGID {
	result \|= AttributesModified
	}

auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36310

auditbeat/module/file_integrity: add support for selinux and posix_acl_access xattrs #36310

Conversation

efd6 commented Aug 14, 2023 • edited by andrewkroh Loading

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

elasticmachine commented Aug 14, 2023 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

elasticmachine commented Aug 14, 2023

andrewkroh left a comment

Choose a reason for hiding this comment

andrewkroh Aug 14, 2023

Choose a reason for hiding this comment

efd6 Aug 14, 2023

Choose a reason for hiding this comment

andrewkroh Aug 15, 2023

Choose a reason for hiding this comment

efd6 Aug 15, 2023 • edited Loading

Choose a reason for hiding this comment

andrewkroh Aug 16, 2023

Choose a reason for hiding this comment

efd6 Aug 16, 2023

Choose a reason for hiding this comment

efd6 Aug 16, 2023

Choose a reason for hiding this comment

efd6 commented Aug 16, 2023

efd6 commented Aug 14, 2023 •

edited by andrewkroh

Loading

elasticmachine commented Aug 14, 2023 •

edited by jenkins-beats-ci bot

Loading

efd6 Aug 15, 2023 •

edited

Loading