Skip to content

Commit ab1f7b1

Browse files
roikolrafaeldtinoco
roikol
authored and
rafaeldtinoco
committed
signature: add cgroup_notify_on_release_modification.go sig
1 parent 7a48cea commit ab1f7b1

File tree

3 files changed

+226
-0
lines changed

3 files changed

+226
-0
lines changed

‎signatures/golang/cgroup_notify_on_release_modification.go‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package main
2+
3+
import (
4+
"fmt"
5+
"path"
6+
7+
"github.com/aquasecurity/tracee/signatures/helpers"
8+
"github.com/aquasecurity/tracee/types/detect"
9+
"github.com/aquasecurity/tracee/types/protocol"
10+
"github.com/aquasecurity/tracee/types/trace"
11+
)
12+
13+
type CgroupNotifyOnReleaseModification struct {
14+
cb detect.SignatureHandler
15+
notifyFileName string
16+
}
17+
18+
func (sig *CgroupNotifyOnReleaseModification) Init(cb detect.SignatureHandler) error {
19+
sig.cb = cb
20+
sig.notifyFileName = "notify_on_release"
21+
return nil
22+
}
23+
24+
func (sig *CgroupNotifyOnReleaseModification) GetMetadata() (detect.SignatureMetadata, error) {
25+
return detect.SignatureMetadata{
26+
ID: "TRC-30",
27+
Version: "1",
28+
Name: "Cgroups notify_on_release file modification",
29+
Description: "An attempt to modify Cgroup notify_on_release file was detected. Cgroups are a Linux kernel feature which limits the resource usage of a set of processes. Adversaries may use this feature for container escaping.",
30+
Properties: map[string]interface{}{
31+
"Severity": 3,
32+
"Category": "privilege-escalation",
33+
"Technique": "Escape to Host",
34+
"Kubernetes_Technique": "",
35+
"id": "attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665",
36+
"external_id": "T1611",
37+
},
38+
}, nil
39+
}
40+
41+
func (sig *CgroupNotifyOnReleaseModification) GetSelectedEvents() ([]detect.SignatureEventSelector, error) {
42+
return []detect.SignatureEventSelector{
43+
{Source: "tracee", Name: "security_file_open", Origin: "container"},
44+
}, nil
45+
}
46+
47+
func (sig *CgroupNotifyOnReleaseModification) OnEvent(event protocol.Event) error {
48+
49+
eventObj, ok := event.Payload.(trace.Event)
50+
if !ok {
51+
return fmt.Errorf("invalid event")
52+
}
53+
54+
switch eventObj.EventName {
55+
56+
case "security_file_open":
57+
58+
pathname, err := helpers.GetTraceeStringArgumentByName(eventObj, "pathname")
59+
if err != nil {
60+
return err
61+
}
62+
basename := path.Base(pathname)
63+
64+
flags, err := helpers.GetTraceeStringArgumentByName(eventObj, "flags")
65+
if err != nil {
66+
return err
67+
}
68+
69+
if basename == sig.notifyFileName && helpers.IsFileWrite(flags) {
70+
metadata, err := sig.GetMetadata()
71+
if err != nil {
72+
return err
73+
}
74+
sig.cb(detect.Finding{
75+
SigMetadata: metadata,
76+
Event: event,
77+
Data: nil,
78+
})
79+
}
80+
}
81+
return nil
82+
}
83+
84+
func (sig *CgroupNotifyOnReleaseModification) OnSignal(s detect.Signal) error {
85+
return nil
86+
}
87+
func (sig *CgroupNotifyOnReleaseModification) Close() {}

‎signatures/golang/cgroup_notify_on_release_modification_test.go‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
package main
2+
3+
import (
4+
"testing"
5+
6+
"github.com/aquasecurity/tracee/signatures/signaturestest"
7+
"github.com/aquasecurity/tracee/types/detect"
8+
"github.com/aquasecurity/tracee/types/trace"
9+
"github.com/stretchr/testify/assert"
10+
"github.com/stretchr/testify/require"
11+
)
12+
13+
func TestCgroupNotifyOnReleaseModification(t *testing.T) {
14+
testCases := []struct {
15+
Name string
16+
Events []trace.Event
17+
Findings map[string]detect.Finding
18+
}{
19+
{
20+
Name: "should trigger detection",
21+
Events: []trace.Event{
22+
{
23+
EventName: "security_file_open",
24+
Args: []trace.Argument{
25+
{
26+
ArgMeta: trace.ArgMeta{
27+
Name: "pathname",
28+
},
29+
Value: interface{}("/tmp/cgrp/x/notify_on_release"),
30+
},
31+
{
32+
ArgMeta: trace.ArgMeta{
33+
Name: "flags",
34+
},
35+
Value: interface{}("O_WRONLY"),
36+
},
37+
},
38+
},
39+
},
40+
Findings: map[string]detect.Finding{
41+
"TRC-30": {
42+
Data: nil,
43+
Event: trace.Event{
44+
EventName: "security_file_open",
45+
Args: []trace.Argument{
46+
{
47+
ArgMeta: trace.ArgMeta{
48+
Name: "pathname",
49+
},
50+
Value: interface{}("/tmp/cgrp/x/notify_on_release"),
51+
},
52+
{
53+
ArgMeta: trace.ArgMeta{
54+
Name: "flags",
55+
},
56+
Value: interface{}("O_WRONLY"),
57+
},
58+
},
59+
}.ToProtocol(),
60+
SigMetadata: detect.SignatureMetadata{
61+
ID: "TRC-30",
62+
Version: "1",
63+
Name: "Cgroups notify_on_release file modification",
64+
Description: "An attempt to modify Cgroup notify_on_release file was detected. Cgroups are a Linux kernel feature which limits the resource usage of a set of processes. Adversaries may use this feature for container escaping.",
65+
Properties: map[string]interface{}{
66+
"Severity": 3,
67+
"Category": "privilege-escalation",
68+
"Technique": "Escape to Host",
69+
"Kubernetes_Technique": "",
70+
"id": "attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665",
71+
"external_id": "T1611",
72+
},
73+
},
74+
},
75+
},
76+
},
77+
{
78+
Name: "should not trigger detection - wrong open flags",
79+
Events: []trace.Event{
80+
{
81+
EventName: "security_file_open",
82+
Args: []trace.Argument{
83+
{
84+
ArgMeta: trace.ArgMeta{
85+
Name: "pathname",
86+
},
87+
Value: interface{}("/tmp/cgrp/x/notify_on_release"),
88+
},
89+
{
90+
ArgMeta: trace.ArgMeta{
91+
Name: "flags",
92+
},
93+
Value: interface{}("O_RDONLY"),
94+
},
95+
},
96+
},
97+
},
98+
Findings: map[string]detect.Finding{},
99+
},
100+
{
101+
Name: "should not trigger detection - wrong path",
102+
Events: []trace.Event{
103+
{
104+
EventName: "security_file_open",
105+
Args: []trace.Argument{
106+
{
107+
ArgMeta: trace.ArgMeta{
108+
Name: "pathname",
109+
},
110+
Value: interface{}("/tmp/something"),
111+
},
112+
{
113+
ArgMeta: trace.ArgMeta{
114+
Name: "flags",
115+
},
116+
Value: interface{}("O_WRONLY"),
117+
},
118+
},
119+
},
120+
},
121+
Findings: map[string]detect.Finding{},
122+
},
123+
}
124+
125+
for _, tc := range testCases {
126+
t.Run(tc.Name, func(t *testing.T) {
127+
holder := signaturestest.FindingsHolder{}
128+
sig := CgroupNotifyOnReleaseModification{}
129+
sig.Init(holder.OnFinding)
130+
131+
for _, e := range tc.Events {
132+
err := sig.OnEvent(e.ToProtocol())
133+
require.NoError(t, err)
134+
}
135+
assert.Equal(t, tc.Findings, holder.GroupBySigID())
136+
})
137+
}
138+
}

‎signatures/golang/export.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@ var ExportedSignatures = []detect.Signature{
1313
&DockerAbuse{},
1414
&ScheduledTaskModification{},
1515
&LdPreload{},
16+
&CgroupNotifyOnReleaseModification{},
1617
}

0 commit comments

Comments
 (0)