From ff366768c301adc881fefd6fe420f2e6cc4660c7 Mon Sep 17 00:00:00 2001 From: Sylvain Baubeau Date: Mon, 18 Nov 2024 19:36:36 +0100 Subject: [PATCH] [CWS] Move JSON schemas to secl package (#30913) --- .../generators/schemas/policy/main.go | 70 +++ pkg/security/secl/rules/policy_test.go | 468 ++++++++++++++---- .../schemas/activity_dump.schema.json | 0 .../schemas/activity_dump_proto.schema.json | 0 .../secl/schemas/agent_context.schema.json | 53 ++ .../{tests => secl}/schemas/bind.schema.json | 10 +- .../{tests => secl}/schemas/bpf.schema.json | 10 +- .../{tests => secl}/schemas/chmod.schema.json | 6 +- .../{tests => secl}/schemas/chown.schema.json | 6 +- pkg/security/secl/schemas/connect.schema.json | 52 ++ .../schemas/container.schema.json} | 2 +- .../schemas/container_context.schema.json} | 4 +- .../secl/schemas/container_event.schema.json | 12 + .../container_event_no_file.schema.json | 12 + .../schemas/datetime.schema.json} | 2 +- .../{tests => secl}/schemas/dns.schema.json | 12 +- .../schemas/event.schema.json} | 4 +- .../{tests => secl}/schemas/exec.schema.json | 6 +- .../{tests => secl}/schemas/exit.schema.json | 6 +- .../schemas/file.schema.json} | 6 +- pkg/security/secl/schemas/hash.schema.json | 25 + .../schemas/heartbeat.schema.json | 4 +- .../secl/schemas/host_event.schema.json | 23 + .../schemas/host_event_no_file.schema.json | 20 + pkg/security/secl/schemas/imds.schema.json | 93 ++++ pkg/security/secl/schemas/kill.schema.json | 88 ++++ .../{tests => secl}/schemas/link.schema.json | 8 +- .../schemas/load_module.schema.json | 6 +- .../schemas/load_module_no_file.schema.json | 6 +- pkg/security/secl/schemas/message.schema.json | 23 + .../{tests => secl}/schemas/mmap.schema.json | 10 +- .../{tests => secl}/schemas/mount.schema.json | 6 +- .../schemas/mprotect.schema.json | 10 +- .../schemas/network.schema.json} | 2 +- .../{tests => secl}/schemas/open.schema.json | 6 +- pkg/security/secl/schemas/policy.schema.json | 457 +++++++++++++++++ .../schemas/process.schema.json} | 12 +- .../schemas/process_context.schema.json} | 10 +- .../schemas/ptrace.schema.json | 12 +- .../schemas/rename.schema.json | 8 +- .../schemas/ruleset_loaded.schema.json | 4 +- pkg/security/secl/schemas/schemas.go | 16 + .../schemas/self_test_schema.json | 13 +- .../schemas/selinux.schema.json | 6 +- .../schemas/signal.schema.json | 12 +- .../{tests => secl}/schemas/span.schema.json | 8 +- .../schemas/span_context.schema.json} | 2 +- .../schemas/splice.schema.json | 6 +- .../schemas/unload_module.schema.json | 6 +- .../schemas/user_session.schema.json | 8 +- .../schemas/user_session_context.schema.json} | 2 +- .../usr.json => secl/schemas/usr.schema.json} | 2 +- pkg/security/tests/schemas.go | 217 +++++--- .../tests/schemas/container_event.json | 12 - .../schemas/container_event_no_file.json | 12 - pkg/security/tests/schemas/host_event.json | 23 - .../tests/schemas/host_event_no_file.json | 20 - 57 files changed, 1593 insertions(+), 346 deletions(-) create mode 100644 pkg/security/generators/schemas/policy/main.go rename pkg/security/{tests => secl}/schemas/activity_dump.schema.json (100%) rename pkg/security/{tests => secl}/schemas/activity_dump_proto.schema.json (100%) create mode 100644 pkg/security/secl/schemas/agent_context.schema.json rename pkg/security/{tests => secl}/schemas/bind.schema.json (86%) rename pkg/security/{tests => secl}/schemas/bpf.schema.json (91%) rename pkg/security/{tests => secl}/schemas/chmod.schema.json (85%) rename pkg/security/{tests => secl}/schemas/chown.schema.json (78%) create mode 100644 pkg/security/secl/schemas/connect.schema.json rename pkg/security/{tests/schemas/container.json => secl/schemas/container.schema.json} (85%) rename pkg/security/{tests/schemas/container_context.json => secl/schemas/container_context.schema.json} (68%) create mode 100644 pkg/security/secl/schemas/container_event.schema.json create mode 100644 pkg/security/secl/schemas/container_event_no_file.schema.json rename pkg/security/{tests/schemas/datetime.json => secl/schemas/datetime.schema.json} (90%) rename pkg/security/{tests => secl}/schemas/dns.schema.json (87%) rename pkg/security/{tests/schemas/event.json => secl/schemas/event.schema.json} (91%) rename pkg/security/{tests => secl}/schemas/exec.schema.json (81%) rename pkg/security/{tests => secl}/schemas/exit.schema.json (86%) rename pkg/security/{tests/schemas/file.json => secl/schemas/file.schema.json} (90%) create mode 100644 pkg/security/secl/schemas/hash.schema.json rename pkg/security/{tests => secl}/schemas/heartbeat.schema.json (92%) create mode 100644 pkg/security/secl/schemas/host_event.schema.json create mode 100644 pkg/security/secl/schemas/host_event_no_file.schema.json create mode 100644 pkg/security/secl/schemas/imds.schema.json create mode 100644 pkg/security/secl/schemas/kill.schema.json rename pkg/security/{tests => secl}/schemas/link.schema.json (76%) rename pkg/security/{tests => secl}/schemas/load_module.schema.json (84%) rename pkg/security/{tests => secl}/schemas/load_module_no_file.schema.json (82%) create mode 100644 pkg/security/secl/schemas/message.schema.json rename pkg/security/{tests => secl}/schemas/mmap.schema.json (82%) rename pkg/security/{tests => secl}/schemas/mount.schema.json (92%) rename pkg/security/{tests => secl}/schemas/mprotect.schema.json (84%) rename pkg/security/{tests/schemas/network.json => secl/schemas/network.schema.json} (98%) rename pkg/security/{tests => secl}/schemas/open.schema.json (78%) create mode 100644 pkg/security/secl/schemas/policy.schema.json rename pkg/security/{tests/schemas/process.json => secl/schemas/process.schema.json} (95%) rename pkg/security/{tests/schemas/process_context.json => secl/schemas/process_context.schema.json} (74%) rename pkg/security/{tests => secl}/schemas/ptrace.schema.json (76%) rename pkg/security/{tests => secl}/schemas/rename.schema.json (76%) rename pkg/security/{tests => secl}/schemas/ruleset_loaded.schema.json (96%) create mode 100644 pkg/security/secl/schemas/schemas.go rename pkg/security/{tests => secl}/schemas/self_test_schema.json (83%) rename pkg/security/{tests => secl}/schemas/selinux.schema.json (95%) rename pkg/security/{tests => secl}/schemas/signal.schema.json (76%) rename pkg/security/{tests => secl}/schemas/span.schema.json (57%) rename pkg/security/{tests/schemas/span_context.json => secl/schemas/span_context.schema.json} (91%) rename pkg/security/{tests => secl}/schemas/splice.schema.json (86%) rename pkg/security/{tests => secl}/schemas/unload_module.schema.json (79%) rename pkg/security/{tests => secl}/schemas/user_session.schema.json (56%) rename pkg/security/{tests/schemas/user_session_context.json => secl/schemas/user_session_context.schema.json} (95%) rename pkg/security/{tests/schemas/usr.json => secl/schemas/usr.schema.json} (92%) delete mode 100644 pkg/security/tests/schemas/container_event.json delete mode 100644 pkg/security/tests/schemas/container_event_no_file.json delete mode 100644 pkg/security/tests/schemas/host_event.json delete mode 100644 pkg/security/tests/schemas/host_event_no_file.json diff --git a/pkg/security/generators/schemas/policy/main.go b/pkg/security/generators/schemas/policy/main.go new file mode 100644 index 00000000000000..e39d15ebb8a644 --- /dev/null +++ b/pkg/security/generators/schemas/policy/main.go @@ -0,0 +1,70 @@ +// Unless explicitly stated otherwise all files in this repository are licensed +// under the Apache License Version 2.0. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2016-present Datadog, Inc. + +//go:generate go run github.com/DataDog/datadog-agent/pkg/security/generators/schemas/policy -output ../../../secl/schemas/policy.schema.json + +// Package main holds main related files +package main + +import ( + "encoding/json" + "flag" + "os" + "reflect" + "time" + + "github.com/invopop/jsonschema" + + "github.com/DataDog/datadog-agent/pkg/security/secl/rules" +) + +func main() { + var output string + flag.StringVar(&output, "output", "", "output file") + flag.Parse() + + if output == "" { + panic("an output file argument is required") + } + + reflector := jsonschema.Reflector{ + ExpandedStruct: true, + Mapper: func(t reflect.Type) *jsonschema.Schema { + switch t { + case reflect.TypeOf(time.Duration(0)): + return &jsonschema.Schema{ + OneOf: []*jsonschema.Schema{ + { + Type: "string", + Format: "duration", + Description: "Duration in Go format (e.g. 1h30m, see https://pkg.go.dev/time#ParseDuration)", + }, + { + Type: "integer", + Description: "Duration in nanoseconds", + }, + }, + } + } + return nil + }, + } + + if err := reflector.AddGoComments("github.com/DataDog/datadog-agent/pkg/security/secl/rules/model.go", "../../../secl/rules"); err != nil { + panic(err) + } + + schema := reflector.Reflect(&rules.PolicyDef{}) + schema.ID = "https://github.com/DataDog/datadog-agent/tree/main/pkg/security/secl/rules" + + data, err := json.MarshalIndent(schema, "", " ") + if err != nil { + panic(err) + } + + if err := os.WriteFile(output, data, 0644); err != nil { + panic(err) + } +} diff --git a/pkg/security/secl/rules/policy_test.go b/pkg/security/secl/rules/policy_test.go index 150509cb2ac5b8..9f7d11e9668a26 100644 --- a/pkg/security/secl/rules/policy_test.go +++ b/pkg/security/secl/rules/policy_test.go @@ -10,19 +10,23 @@ package rules import ( "fmt" + "net/http" "os" "path/filepath" "strings" "syscall" "testing" + "time" "github.com/google/go-cmp/cmp" - "github.com/google/go-cmp/cmp/cmpopts" + "github.com/xeipuuv/gojsonschema" "github.com/Masterminds/semver/v3" "github.com/hashicorp/go-multierror" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "gopkg.in/yaml.v3" + yamlk8s "sigs.k8s.io/yaml" "github.com/DataDog/datadog-agent/pkg/security/secl/compiler/eval" "github.com/DataDog/datadog-agent/pkg/security/secl/model" @@ -77,14 +81,14 @@ func TestMacroMerge(t *testing.T) { } loader := NewPolicyLoader(provider) - evaluationSet, _ := newTestEvaluationSet([]eval.RuleSetTagValue{DefaultRuleSetTagValue}) - if errs := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() != nil { + rs := newRuleSet() + if errs := rs.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() != nil { t.Error(err) } - macro := evaluationSet.RuleSets[DefaultRuleSetTagValue].evalOpts.MacroStore.Get("test_macro") + macro := rs.evalOpts.MacroStore.Get("test_macro") if macro == nil { - t.Fatalf("failed to find test_macro in ruleset: %+v", evaluationSet.RuleSets[DefaultRuleSetTagValue].evalOpts.MacroStore.List()) + t.Fatalf("failed to find test_macro in ruleset: %+v", rs.evalOpts.MacroStore.List()) } testPolicy2.Macros[0].Combine = "" @@ -93,25 +97,47 @@ func TestMacroMerge(t *testing.T) { t.Fatal(err) } - if err := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); err == nil { + if err := rs.LoadPolicies(loader, PolicyLoaderOpts{}); err == nil { t.Error("expected macro ID conflict") } } func TestRuleMerge(t *testing.T) { testPolicy := &PolicyDef{ - Rules: []*RuleDefinition{{ - ID: "test_rule", - Expression: `open.file.path == "/tmp/test"`, - }}, + Rules: []*RuleDefinition{ + { + ID: "test_rule", + Expression: `open.file.path == "/tmp/test"`, + }, + { + ID: "test_rule_foo", + Expression: `exec.file.name == "foo"`, + }, + { + ID: "test_rule_bar", + Expression: `exec.file.name == "bar"`, + Disabled: true, + }, + }, } testPolicy2 := &PolicyDef{ - Rules: []*RuleDefinition{{ - ID: "test_rule", - Expression: `open.file.path == "/tmp/test"`, - Combine: OverridePolicy, - }}, + Rules: []*RuleDefinition{ + { + ID: "test_rule", + Expression: `open.file.path == "/tmp/test"`, + Combine: OverridePolicy, + }, + { + ID: "test_rule_foo", + Expression: `exec.file.name == "foo"`, + Disabled: true, + }, + { + ID: "test_rule_bar", + Expression: `exec.file.name == "bar"`, + }, + }, } tmpDir := t.TempDir() @@ -130,25 +156,41 @@ func TestRuleMerge(t *testing.T) { } loader := NewPolicyLoader(provider) - evaluationSet, _ := newTestEvaluationSet([]eval.RuleSetTagValue{DefaultRuleSetTagValue}) - if errs := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() != nil { + rs := newRuleSet() + if errs := rs.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() != nil { t.Error(err) } - rule := evaluationSet.RuleSets[DefaultRuleSetTagValue].GetRules()["test_rule"] - if rule == nil { - t.Fatal("failed to find test_rule in ruleset") - } + t.Run("override", func(t *testing.T) { + rule := rs.GetRules()["test_rule"] + if rule == nil { + t.Fatal("failed to find test_rule in ruleset") + } - testPolicy2.Rules[0].Combine = "" + testPolicy2.Rules[0].Combine = "" - if err := savePolicy(filepath.Join(tmpDir, "test2.policy"), testPolicy2); err != nil { - t.Fatal(err) - } + if err := savePolicy(filepath.Join(tmpDir, "test2.policy"), testPolicy2); err != nil { + t.Fatal(err) + } - if err := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); err == nil { - t.Error("expected rule ID conflict") - } + if err := rs.LoadPolicies(loader, PolicyLoaderOpts{}); err == nil { + t.Error("expected rule ID conflict") + } + }) + + t.Run("enabled-disabled", func(t *testing.T) { + rule := rs.GetRules()["test_rule_foo"] + if rule != nil { + t.Fatal("expected test_rule_foo to not be loaded") + } + }) + + t.Run("disabled-enabled", func(t *testing.T) { + rule := rs.GetRules()["test_rule_bar"] + if rule == nil { + t.Fatal("expected test_rule_bar to be loaded") + } + }) } func TestActionSetVariable(t *testing.T) { @@ -248,12 +290,12 @@ func TestActionSetVariable(t *testing.T) { } loader := NewPolicyLoader(provider) - evaluationSet, _ := newTestEvaluationSet([]eval.RuleSetTagValue{DefaultRuleSetTagValue}) - if errs := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() != nil { + rs := newRuleSet() + if err := rs.LoadPolicies(loader, PolicyLoaderOpts{}); err != nil { t.Error(err) } - rule := evaluationSet.RuleSets[DefaultRuleSetTagValue].GetRules()["test_rule"] + rule := rs.GetRules()["test_rule"] if rule == nil { t.Fatal("failed to find test_rule in ruleset") } @@ -266,28 +308,87 @@ func TestActionSetVariable(t *testing.T) { event.SetFieldValue("open.file.path", "/tmp/test2") event.SetFieldValue("open.flags", syscall.O_RDONLY) - if evaluationSet.RuleSets[DefaultRuleSetTagValue].Evaluate(event) { + if rs.Evaluate(event) { t.Errorf("Expected event to match no rule") } event.SetFieldValue("open.file.path", "/tmp/test") - if !evaluationSet.RuleSets[DefaultRuleSetTagValue].Evaluate(event) { + if !rs.Evaluate(event) { t.Errorf("Expected event to match rule") } event.SetFieldValue("open.file.path", "/tmp/test2") - if !evaluationSet.RuleSets[DefaultRuleSetTagValue].Evaluate(event) { + if !rs.Evaluate(event) { t.Errorf("Expected event to match rule") } - scopedVariables := evaluationSet.RuleSets[DefaultRuleSetTagValue].scopedVariables["process"].(*eval.ScopedVariables) + scopedVariables := rs.scopedVariables["process"].(*eval.ScopedVariables) assert.Equal(t, scopedVariables.Len(), 1) event.ProcessCacheEntry.Release() assert.Equal(t, scopedVariables.Len(), 0) } +func TestActionSetVariableTTL(t *testing.T) { + testPolicy := &PolicyDef{ + Rules: []*RuleDefinition{{ + ID: "test_rule", + Expression: `open.file.path == "/tmp/test"`, + Actions: []*ActionDefinition{{ + Set: &SetDefinition{ + Name: "var1", + Append: true, + Value: []string{"foo"}, + TTL: 1 * time.Second, + }, + }}, + }}, + } + + tmpDir := t.TempDir() + + if err := savePolicy(filepath.Join(tmpDir, "test.policy"), testPolicy); err != nil { + t.Fatal(err) + } + + provider, err := NewPoliciesDirProvider(tmpDir, false) + if err != nil { + t.Fatal(err) + } + loader := NewPolicyLoader(provider) + + rs := newRuleSet() + if err := rs.LoadPolicies(loader, PolicyLoaderOpts{}); err != nil { + t.Error(err) + } + + event := model.NewFakeEvent() + event.Type = uint32(model.FileOpenEventType) + processCacheEntry := &model.ProcessCacheEntry{} + processCacheEntry.Retain() + event.ProcessCacheEntry = processCacheEntry + event.SetFieldValue("open.file.path", "/tmp/test") + event.SetFieldValue("open.flags", syscall.O_RDONLY) + + if !rs.Evaluate(event) { + t.Errorf("Expected event to match rule") + } + + opts := rs.evalOpts + + existingVariable := opts.VariableStore.Get("var1") + assert.NotNil(t, existingVariable) + + stringArrayVar, ok := existingVariable.(*eval.MutableStringArrayVariable) + assert.NotNil(t, stringArrayVar) + assert.True(t, ok) + + assert.True(t, stringArrayVar.LRU.Has("foo")) + time.Sleep(time.Second + 100*time.Millisecond) + assert.False(t, stringArrayVar.LRU.Has("foo")) +} + func TestActionSetVariableConflict(t *testing.T) { testPolicy := &PolicyDef{ Rules: []*RuleDefinition{{ @@ -323,12 +424,31 @@ func TestActionSetVariableConflict(t *testing.T) { } loader := NewPolicyLoader(provider) - evaluationSet, _ := newTestEvaluationSet([]eval.RuleSetTagValue{DefaultRuleSetTagValue}) - if errs := evaluationSet.LoadPolicies(loader, PolicyLoaderOpts{}); errs.ErrorOrNil() == nil { + rs := newRuleSet() + if err := rs.LoadPolicies(loader, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } } +func loadPolicy(t *testing.T, testPolicy *PolicyDef, policyOpts PolicyLoaderOpts) (*RuleSet, *multierror.Error) { + rs := newRuleSet() + + tmpDir := t.TempDir() + + if err := savePolicy(filepath.Join(tmpDir, "test.policy"), testPolicy); err != nil { + t.Fatal(err) + } + + provider, err := NewPoliciesDirProvider(tmpDir, false) + if err != nil { + t.Fatal(err) + } + + loader := NewPolicyLoader(provider) + + return rs, rs.LoadPolicies(loader, policyOpts) +} + func TestRuleErrorLoading(t *testing.T) { testPolicy := &PolicyDef{ Rules: []*RuleDefinition{ @@ -347,8 +467,7 @@ func TestRuleErrorLoading(t *testing.T) { }, } - es, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}) - rs := es.RuleSets[DefaultRuleSetTagValue] + rs, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}) assert.NotNil(t, err) assert.Len(t, err.Errors, 2) assert.ErrorContains(t, err.Errors[0], "rule `testA` error: multiple definition with the same ID") @@ -472,10 +591,10 @@ func TestRuleAgentConstraint(t *testing.T) { } agentVersion, err := semver.NewVersion("7.38") - assert.Nil(t, err) + assert.NoError(t, err) agentVersionFilter, err := NewAgentVersionFilter(agentVersion) - assert.Nil(t, err) + assert.NoError(t, err) policyOpts := PolicyLoaderOpts{ MacroFilters: []MacroFilter{ @@ -486,15 +605,9 @@ func TestRuleAgentConstraint(t *testing.T) { }, } - es, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, policyOpts) - rs := es.RuleSets[DefaultRuleSetTagValue] - - for _, err := range err.(*multierror.Error).Errors { - if rerr, ok := err.(*ErrRuleLoad); ok { - if rerr.Definition.ID != "basic" && rerr.Definition.ID != "range_not" { - t.Errorf("unexpected error: %v", rerr) - } - } + rs, rsErr := loadPolicy(t, testPolicy, policyOpts) + if rsErr != nil { + t.Fatalf("unexpected error: %v\n", rsErr) } for _, exp := range expected { @@ -524,7 +637,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("policy should fail to load") } else { t.Log(err) @@ -549,7 +662,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -574,7 +687,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -595,7 +708,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -627,7 +740,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -658,7 +771,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -690,7 +803,7 @@ func TestActionSetVariableInvalid(t *testing.T) { }}, } - if _, err := loadPolicyIntoProbeEvaluationRuleSet(t, testPolicy, PolicyLoaderOpts{}); err == nil { + if _, err := loadPolicy(t, testPolicy, PolicyLoaderOpts{}); err == nil { t.Error("expected policy to fail to load") } else { t.Log(err) @@ -723,7 +836,7 @@ func TestLoadPolicy(t *testing.T) { ruleFilters: nil, }, want: nil, - wantErr: func(t assert.TestingT, err error, i ...interface{}) bool { + wantErr: func(t assert.TestingT, err error, _ ...interface{}) bool { return assert.EqualError(t, err, ErrPolicyLoad{Name: "myLocal.policy", Err: fmt.Errorf(`EOF`)}.Error()) }, }, @@ -738,7 +851,7 @@ func TestLoadPolicy(t *testing.T) { ruleFilters: nil, }, want: nil, - wantErr: func(t assert.TestingT, err error, i ...interface{}) bool { + wantErr: func(t assert.TestingT, err error, _ ...interface{}) bool { return assert.EqualError(t, err, ErrPolicyLoad{Name: "myLocal.policy", Err: fmt.Errorf(`EOF`)}.Error()) }, }, @@ -756,7 +869,8 @@ rules: want: &Policy{ Name: "myLocal.policy", Source: PolicyProviderTypeRC, - Rules: nil, + rules: map[string][]*PolicyRule{}, + macros: map[string][]*PolicyMacro{}, }, wantErr: assert.NoError, }, @@ -772,7 +886,7 @@ broken ruleFilters: nil, }, want: nil, - wantErr: func(t assert.TestingT, err error, i ...interface{}) bool { + wantErr: func(t assert.TestingT, err error, _ ...interface{}) bool { return assert.ErrorContains(t, err, ErrPolicyLoad{Name: "myLocal.policy", Err: fmt.Errorf(`yaml: unmarshal error`)}.Error()) }, }, @@ -788,21 +902,23 @@ broken macroFilters: nil, ruleFilters: nil, }, - want: &Policy{ + want: fixupRulesPolicy(&Policy{ Name: "myLocal.policy", Source: PolicyProviderTypeRC, - Rules: []*RuleDefinition{ - { - ID: "rule_test", - Expression: "", - Disabled: true, - Policy: &Policy{ - Name: "myLocal.policy", - Source: PolicyProviderTypeRC, + rules: map[string][]*PolicyRule{ + "rule_test": { + { + Def: &RuleDefinition{ + ID: "rule_test", + Expression: "", + Disabled: true, + }, + Accepted: true, }, }, }, - }, + macros: map[string][]*PolicyMacro{}, + }), wantErr: assert.NoError, }, { @@ -818,21 +934,23 @@ broken macroFilters: nil, ruleFilters: nil, }, - want: &Policy{ + want: fixupRulesPolicy(&Policy{ Name: "myLocal.policy", Source: PolicyProviderTypeRC, - Rules: []*RuleDefinition{ - { - ID: "rule_test", - Expression: "open.file.path == \"/etc/gshadow\"", - Combine: OverridePolicy, - Policy: &Policy{ - Name: "myLocal.policy", - Source: PolicyProviderTypeRC, + rules: map[string][]*PolicyRule{ + "rule_test": { + { + Def: &RuleDefinition{ + ID: "rule_test", + Expression: "open.file.path == \"/etc/gshadow\"", + Combine: OverridePolicy, + }, + Accepted: true, }, }, }, - }, + macros: map[string][]*PolicyMacro{}, + }), wantErr: assert.NoError, }, } @@ -846,9 +964,193 @@ broken return } - if !cmp.Equal(tt.want, got, cmpopts.IgnoreFields(RuleDefinition{}, "Policy")) { - t.Errorf("LoadPolicy(%v, %v, %v, %v, %v)", tt.args.name, tt.args.source, r, tt.args.macroFilters, tt.args.ruleFilters) + if !cmp.Equal(tt.want, got, policyCmpOpts...) { + t.Errorf("The loaded policies do not match the expected\nDiff:\n%s", cmp.Diff(tt.want, got, policyCmpOpts...)) } }) } } + +// go test -v github.com/DataDog/datadog-agent/pkg/security/secl/rules --run="TestPolicySchema" +func TestPolicySchema(t *testing.T) { + tests := []struct { + name string + policy string + schemaResultCb func(*testing.T, *gojsonschema.Result) + }{ + { + name: "valid", + policy: policyValid, + schemaResultCb: func(t *testing.T, result *gojsonschema.Result) { + if !assert.True(t, result.Valid(), "schema validation failed") { + for _, err := range result.Errors() { + t.Errorf("%s", err) + } + } + }, + }, + { + name: "missing required rule ID", + policy: policyWithMissingRequiredRuleID, + schemaResultCb: func(t *testing.T, result *gojsonschema.Result) { + require.False(t, result.Valid(), "schema validation should fail") + require.Len(t, result.Errors(), 1) + assert.Contains(t, result.Errors()[0].String(), "id is required") + }, + }, + { + name: "unknown field", + policy: policyWithUnknownField, + schemaResultCb: func(t *testing.T, result *gojsonschema.Result) { + require.False(t, result.Valid(), "schema validation should fail") + require.Len(t, result.Errors(), 1) + assert.Contains(t, result.Errors()[0].String(), "Additional property unknown_field is not allowed") + }, + }, + { + name: "invalid field type", + policy: policyWithInvalidFieldType, + schemaResultCb: func(t *testing.T, result *gojsonschema.Result) { + require.False(t, result.Valid(), "schema validation should fail") + require.Len(t, result.Errors(), 1) + assert.Contains(t, result.Errors()[0].String(), "Invalid type") + + }, + }, + { + name: "multiple actions", + policy: policyWithMultipleActions, + schemaResultCb: func(t *testing.T, result *gojsonschema.Result) { + require.False(t, result.Valid(), "schema validation should fail") + require.Len(t, result.Errors(), 1) + assert.Contains(t, result.Errors()[0].String(), "Must validate one and only one schema") + }, + }, + } + + fs := os.DirFS("../../../../pkg/security/secl/schemas") + schemaLoader := gojsonschema.NewReferenceLoaderFileSystem("file:///policy.schema.json", http.FS(fs)) + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + json, err := yamlk8s.YAMLToJSON([]byte(test.policy)) + require.NoErrorf(t, err, "failed to convert yaml to json: %v", err) + documentLoader := gojsonschema.NewBytesLoader(json) + result, err := gojsonschema.Validate(schemaLoader, documentLoader) + require.NoErrorf(t, err, "failed to validate schema: %v", err) + test.schemaResultCb(t, result) + }) + } +} + +const policyValid = ` +version: 1.2.3 +rules: + - id: basic + expression: exec.file.name == "foo" + - id: with_tags + description: Rule with tags + expression: exec.file.name == "foo" + tags: + tagA: a + tagB: b + - id: disabled + description: Disabled rule + expression: exec.file.name == "foo" + disabled: true + - id: with_tags + description: Rule with combine + expression: exec.file.name == "bar" + combine: override + override_options: + fields: + - expression + - id: with_filters + description: Rule with a filter and agent_version field + expression: exec.file.name == "foo" + agent_version: ">= 7.38" + filters: + - os == "linux" + - id: with_every_silent_group_id + description: Rule with a silent/every/group_id field + expression: exec.file.name == "foo" + silent: true + every: 10s + group_id: "baz_group" + - id: with_set_action_with_field + description: Rule with a set action using an event field + expression: exec.file.name == "foo" + actions: + - set: + name: process_names + field: process.file.name + append: true + size: 10 + ttl: 10s + - id: with_set_action_with_value + description: Rule with a set action using a value + expression: exec.file.name == "foo" + actions: + - set: + name: global_var_set + value: true + - id: with_set_action_use + description: Rule using a variable set by a previous action + expression: open.file.path == "/tmp/bar" && ${global_var_set} + - id: with_kill_action + description: Rule with a kill action + expression: exec.file.name == "foo" + actions: + - kill: + signal: SIGKILL + scope: process + - id: with_coredump_action + description: Rule with a coredump action + expression: exec.file.name == "foo" + actions: + - coredump: + process: true + dentry: true + mount: true + no_compression: true + - id: with_hash_action + description: Rule with a hash action + expression: exec.file.name == "foo" + actions: + - hash: {} +` +const policyWithMissingRequiredRuleID = ` +version: 1.2.3 +rules: + - description: Rule with missing ID + expression: exec.file.name == "foo" +` + +const policyWithUnknownField = ` +version: 1.2.3 +rules: + - id: rule with unknown field + expression: exec.file.name == "foo" + unknown_field: "bar" +` + +const policyWithInvalidFieldType = ` +version: 1.2.3 +rules: + - id: 2 + expression: exec.file.name == "foo" +` + +const policyWithMultipleActions = ` +version: 1.2.3 +rules: + - id: rule with missing action + expression: exec.file.name == "foo" + actions: + - set: + name: global_var_set + value: true + kill: + signal: SIGKILL + scope: process +` diff --git a/pkg/security/tests/schemas/activity_dump.schema.json b/pkg/security/secl/schemas/activity_dump.schema.json similarity index 100% rename from pkg/security/tests/schemas/activity_dump.schema.json rename to pkg/security/secl/schemas/activity_dump.schema.json diff --git a/pkg/security/tests/schemas/activity_dump_proto.schema.json b/pkg/security/secl/schemas/activity_dump_proto.schema.json similarity index 100% rename from pkg/security/tests/schemas/activity_dump_proto.schema.json rename to pkg/security/secl/schemas/activity_dump_proto.schema.json diff --git a/pkg/security/secl/schemas/agent_context.schema.json b/pkg/security/secl/schemas/agent_context.schema.json new file mode 100644 index 00000000000000..f524a02c9986e1 --- /dev/null +++ b/pkg/security/secl/schemas/agent_context.schema.json @@ -0,0 +1,53 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "agent_context.schema.json", + "type": "object", + "properties": { + "rule_id": { + "type": "string" + }, + "rule_version": { + "type": "string" + }, + "policy_name": { + "type": "string" + }, + "policy_version": { + "type": "string" + }, + "version": { + "type": "string" + }, + "os": { + "type": "string" + }, + "arch": { + "type": "string" + }, + "origin": { + "type": "string" + }, + "rule_actions": { + "type": "array", + "items": { + "oneOf": [ + { + "$ref": "kill.schema.json" + }, + { + "$ref": "hash.schema.json" + } + ] + } + } + }, + "required": [ + "rule_id", + "policy_name", + "policy_version", + "version", + "os", + "arch", + "origin" + ] +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/bind.schema.json b/pkg/security/secl/schemas/bind.schema.json similarity index 86% rename from pkg/security/tests/schemas/bind.schema.json rename to pkg/security/secl/schemas/bind.schema.json index a0351a64a6c759..0e8503fa071c50 100644 --- a/pkg/security/tests/schemas/bind.schema.json +++ b/pkg/security/secl/schemas/bind.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "bind.json", + "$id": "bind.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { diff --git a/pkg/security/tests/schemas/bpf.schema.json b/pkg/security/secl/schemas/bpf.schema.json similarity index 91% rename from pkg/security/tests/schemas/bpf.schema.json rename to pkg/security/secl/schemas/bpf.schema.json index dd423ab1537710..c315002647f53f 100644 --- a/pkg/security/tests/schemas/bpf.schema.json +++ b/pkg/security/secl/schemas/bpf.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "bpf.json", + "$id": "bpf.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { diff --git a/pkg/security/tests/schemas/chmod.schema.json b/pkg/security/secl/schemas/chmod.schema.json similarity index 85% rename from pkg/security/tests/schemas/chmod.schema.json rename to pkg/security/secl/schemas/chmod.schema.json index cf56e011e0e3da..6bd85b45ae8b49 100644 --- a/pkg/security/tests/schemas/chmod.schema.json +++ b/pkg/security/secl/schemas/chmod.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "chmod.json", + "$id": "chmod.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/chown.schema.json b/pkg/security/secl/schemas/chown.schema.json similarity index 78% rename from pkg/security/tests/schemas/chown.schema.json rename to pkg/security/secl/schemas/chown.schema.json index 9fc6f29e5996a5..6c8d52399f538c 100644 --- a/pkg/security/tests/schemas/chown.schema.json +++ b/pkg/security/secl/schemas/chown.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "chown.json", + "$id": "chown.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/secl/schemas/connect.schema.json b/pkg/security/secl/schemas/connect.schema.json new file mode 100644 index 00000000000000..add7097809aba7 --- /dev/null +++ b/pkg/security/secl/schemas/connect.schema.json @@ -0,0 +1,52 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "connect.schema.json", + "type": "object", + "allOf": [ + { + "$ref": "event.schema.json" + }, + { + "$ref": "usr.schema.json" + }, + { + "$ref": "process_context.schema.json" + }, + { + "date": { + "$ref": "datetime.schema.json" + } + }, + { + "properties": { + "connect": { + "type": "object", + "required": [ + "addr" + ], + "properties": { + "addr": { + "type": "object", + "required": [ + "family", + "ip", + "port" + ], + "properties": { + "family": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "port": { + "type": "integer" + } + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/container.json b/pkg/security/secl/schemas/container.schema.json similarity index 85% rename from pkg/security/tests/schemas/container.json rename to pkg/security/secl/schemas/container.schema.json index 42db4215b7d258..9ce795d204fd2c 100644 --- a/pkg/security/tests/schemas/container.json +++ b/pkg/security/secl/schemas/container.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "container.json", + "$id": "container.schema.json", "type": "object", "properties": { "id": { diff --git a/pkg/security/tests/schemas/container_context.json b/pkg/security/secl/schemas/container_context.schema.json similarity index 68% rename from pkg/security/tests/schemas/container_context.json rename to pkg/security/secl/schemas/container_context.schema.json index dc65196a9e48ab..5def87884bb87d 100644 --- a/pkg/security/tests/schemas/container_context.json +++ b/pkg/security/secl/schemas/container_context.schema.json @@ -1,10 +1,10 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "container_context.json", + "$id": "container_context.schema.json", "type": "object", "properties": { "container": { - "$ref": "/schemas/container.json" + "$ref": "container.schema.json" } }, "required": [ diff --git a/pkg/security/secl/schemas/container_event.schema.json b/pkg/security/secl/schemas/container_event.schema.json new file mode 100644 index 00000000000000..4485b5a35c4b7d --- /dev/null +++ b/pkg/security/secl/schemas/container_event.schema.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "container_event.schema.json", + "allOf": [ + { + "$ref": "host_event.schema.json" + }, + { + "$ref": "container_context.schema.json" + } + ] +} diff --git a/pkg/security/secl/schemas/container_event_no_file.schema.json b/pkg/security/secl/schemas/container_event_no_file.schema.json new file mode 100644 index 00000000000000..42481aac800b95 --- /dev/null +++ b/pkg/security/secl/schemas/container_event_no_file.schema.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "container_event_no_file.schema.json", + "allOf": [ + { + "$ref": "host_event_no_file.schema.json" + }, + { + "$ref": "container_context.schema.json" + } + ] +} diff --git a/pkg/security/tests/schemas/datetime.json b/pkg/security/secl/schemas/datetime.schema.json similarity index 90% rename from pkg/security/tests/schemas/datetime.json rename to pkg/security/secl/schemas/datetime.schema.json index 03cfc3d81cdc51..e0e6e8eed8b96b 100644 --- a/pkg/security/tests/schemas/datetime.json +++ b/pkg/security/secl/schemas/datetime.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "datetime.json", + "$id": "datetime.schema.json", "allOf": [ { "type": "string", diff --git a/pkg/security/tests/schemas/dns.schema.json b/pkg/security/secl/schemas/dns.schema.json similarity index 87% rename from pkg/security/tests/schemas/dns.schema.json rename to pkg/security/secl/schemas/dns.schema.json index d9d62483a5bc2c..3e697ead51f0af 100644 --- a/pkg/security/tests/schemas/dns.schema.json +++ b/pkg/security/secl/schemas/dns.schema.json @@ -1,23 +1,23 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "dns.json", + "$id": "dns.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { - "$ref": "/schemas/network.json" + "$ref": "network.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { diff --git a/pkg/security/tests/schemas/event.json b/pkg/security/secl/schemas/event.schema.json similarity index 91% rename from pkg/security/tests/schemas/event.json rename to pkg/security/secl/schemas/event.schema.json index 16dcdc0fe6a60e..685f3af7ae28e3 100644 --- a/pkg/security/tests/schemas/event.json +++ b/pkg/security/secl/schemas/event.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "event.json", + "$id": "event.schema.json", "type": "object", "properties": { "evt": { @@ -29,7 +29,7 @@ ] }, "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, "required": [ diff --git a/pkg/security/tests/schemas/exec.schema.json b/pkg/security/secl/schemas/exec.schema.json similarity index 81% rename from pkg/security/tests/schemas/exec.schema.json rename to pkg/security/secl/schemas/exec.schema.json index ba466e3327ad91..2f7d44b03cc5d8 100644 --- a/pkg/security/tests/schemas/exec.schema.json +++ b/pkg/security/secl/schemas/exec.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "exec.json", + "$id": "exec.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/exit.schema.json b/pkg/security/secl/schemas/exit.schema.json similarity index 86% rename from pkg/security/tests/schemas/exit.schema.json rename to pkg/security/secl/schemas/exit.schema.json index d8e9820a804327..341107a3791855 100644 --- a/pkg/security/tests/schemas/exit.schema.json +++ b/pkg/security/secl/schemas/exit.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "exit.json", + "$id": "exit.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/file.json b/pkg/security/secl/schemas/file.schema.json similarity index 90% rename from pkg/security/tests/schemas/file.json rename to pkg/security/secl/schemas/file.schema.json index c78c9fba93a0d6..770b748c4c2816 100644 --- a/pkg/security/tests/schemas/file.json +++ b/pkg/security/secl/schemas/file.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "file.json", + "$id": "file.schema.json", "type": "object", "properties": { "path": { @@ -29,10 +29,10 @@ "type": "string" }, "modification_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "change_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "flags": { "type": "array", diff --git a/pkg/security/secl/schemas/hash.schema.json b/pkg/security/secl/schemas/hash.schema.json new file mode 100644 index 00000000000000..229a60483fe20b --- /dev/null +++ b/pkg/security/secl/schemas/hash.schema.json @@ -0,0 +1,25 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "kill.schema.json", + "type": "object", + "properties": { + "type": { + "type": "string" + }, + "path": { + "type": "string" + }, + "state": { + "type": "string" + }, + "trigger": { + "type": "string" + } + }, + "required": [ + "type", + "path", + "state", + "trigger" + ] +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/heartbeat.schema.json b/pkg/security/secl/schemas/heartbeat.schema.json similarity index 92% rename from pkg/security/tests/schemas/heartbeat.schema.json rename to pkg/security/secl/schemas/heartbeat.schema.json index 038fb54411c5fa..45086fab8415ed 100644 --- a/pkg/security/tests/schemas/heartbeat.schema.json +++ b/pkg/security/secl/schemas/heartbeat.schema.json @@ -1,6 +1,6 @@ { "$schema": "http://json-schema.org/draft-04/schema#", - "$id": "heartbeat.json", + "$id": "heartbeat.schema.json", "type": "object", "properties": { "policy": { @@ -9,7 +9,7 @@ } }, "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, "required": [ diff --git a/pkg/security/secl/schemas/host_event.schema.json b/pkg/security/secl/schemas/host_event.schema.json new file mode 100644 index 00000000000000..357955d548ce72 --- /dev/null +++ b/pkg/security/secl/schemas/host_event.schema.json @@ -0,0 +1,23 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "host_event.schema.json", + "allOf": [ + { + "$ref": "event.schema.json" + }, + { + "file": { "$ref": "file.schema.json" } + }, + { + "$ref": "usr.schema.json" + }, + { + "$ref": "process_context.schema.json" + }, + { + "date": { + "$ref": "datetime.schema.json" + } + } + ] +} diff --git a/pkg/security/secl/schemas/host_event_no_file.schema.json b/pkg/security/secl/schemas/host_event_no_file.schema.json new file mode 100644 index 00000000000000..2d260efa55250e --- /dev/null +++ b/pkg/security/secl/schemas/host_event_no_file.schema.json @@ -0,0 +1,20 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "host_event_no_file.schema.json", + "allOf": [ + { + "$ref": "event.schema.json" + }, + { + "$ref": "usr.schema.json" + }, + { + "$ref": "process_context.schema.json" + }, + { + "date": { + "$ref": "datetime.schema.json" + } + } + ] +} diff --git a/pkg/security/secl/schemas/imds.schema.json b/pkg/security/secl/schemas/imds.schema.json new file mode 100644 index 00000000000000..a8fd8ed7bcb7be --- /dev/null +++ b/pkg/security/secl/schemas/imds.schema.json @@ -0,0 +1,93 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "imds.schema.json", + "type": "object", + "allOf": [ + { + "$ref": "event.schema.json" + }, + { + "$ref": "usr.schema.json" + }, + { + "$ref": "process_context.schema.json" + }, + { + "$ref": "network.schema.json" + }, + { + "date": { + "$ref": "datetime.schema.json" + } + }, + { + "properties": { + "imds": { + "type": "object", + "required": [ + "cloud_provider", + "type" + ], + "properties": { + "type": { + "type": "string" + }, + "cloud_provider": { + "type": "string" + }, + "host": { + "type": "string" + }, + "url": { + "type": "string" + }, + "user_agent": { + "type": "string" + }, + "server": { + "type": "string" + }, + "aws": { + "type": "object", + "required": [ + "is_imds_v2" + ], + "properties": { + "is_imds_v2": { + "type": "boolean" + }, + "security_credentials": { + "type": "object", + "required": [ + "code", + "type", + "access_key_id", + "last_updated", + "expiration" + ], + "properties": { + "code": { + "type": "string" + }, + "type": { + "type": "string" + }, + "access_key_id": { + "type": "string" + }, + "last_updated": { + "type": "string" + }, + "expiration": { + "type": "string" + } + } + } + } + } + } + } + } + } + ] +} diff --git a/pkg/security/secl/schemas/kill.schema.json b/pkg/security/secl/schemas/kill.schema.json new file mode 100644 index 00000000000000..7ad33dcf8a0be4 --- /dev/null +++ b/pkg/security/secl/schemas/kill.schema.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "kill.schema.json", + "type": "object", + "properties": { + "type": { + "type": "string" + }, + "signal": { + "type": "string" + }, + "scope": { + "type": "string" + }, + "created_at": { + "$ref": "datetime.schema.json" + }, + "detected_at": { + "$ref": "datetime.schema.json" + }, + "killed_at": { + "$ref": "datetime.schema.json" + }, + "exited_at": { + "$ref": "datetime.schema.json" + }, + "ttr": { + "type": "string" + } + }, + "anyOf": [ + { + "properties": { + "signal": { + "const": "SIGKILL" + }, + "status": { + "const": "performed" + } + }, + "required": [ + "type", + "signal", + "scope", + "status", + "created_at", + "detected_at", + "killed_at", + "exited_at", + "ttr" + ] + }, + { + "properties": { + "signal": { + "const": "SIGUSR2" + }, + "status": { + "const": "performed" + } + }, + "required": [ + "type", + "signal", + "scope", + "status", + "created_at", + "detected_at", + "killed_at" + ] + }, + { + "properties": { + "status": { + "const": "rule_disarmed" + } + }, + "required": [ + "type", + "signal", + "scope", + "status", + "created_at", + "detected_at" + ] + } + ] +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/link.schema.json b/pkg/security/secl/schemas/link.schema.json similarity index 76% rename from pkg/security/tests/schemas/link.schema.json rename to pkg/security/secl/schemas/link.schema.json index 98b94a81f285cf..e618ebd5172fa2 100644 --- a/pkg/security/tests/schemas/link.schema.json +++ b/pkg/security/secl/schemas/link.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "link.json", + "$id": "link.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ @@ -20,7 +20,7 @@ ], "properties": { "destination": { - "$ref": "/schemas/file.json" + "$ref": "file.schema.json" } } } diff --git a/pkg/security/tests/schemas/load_module.schema.json b/pkg/security/secl/schemas/load_module.schema.json similarity index 84% rename from pkg/security/tests/schemas/load_module.schema.json rename to pkg/security/secl/schemas/load_module.schema.json index 4e86932fa111ce..2fc2d99e86ae3f 100644 --- a/pkg/security/tests/schemas/load_module.schema.json +++ b/pkg/security/secl/schemas/load_module.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "load_module.json", + "$id": "load_module.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/load_module_no_file.schema.json b/pkg/security/secl/schemas/load_module_no_file.schema.json similarity index 82% rename from pkg/security/tests/schemas/load_module_no_file.schema.json rename to pkg/security/secl/schemas/load_module_no_file.schema.json index c878d0f3b39339..c3a1e7c1c1ddbc 100644 --- a/pkg/security/tests/schemas/load_module_no_file.schema.json +++ b/pkg/security/secl/schemas/load_module_no_file.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "load_module_no_file.json", + "$id": "load_module_no_file.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event_no_file.json" + "$ref": "container_event_no_file.schema.json" }, { - "$ref": "/schemas/host_event_no_file.json" + "$ref": "host_event_no_file.schema.json" } ], "allOf": [ diff --git a/pkg/security/secl/schemas/message.schema.json b/pkg/security/secl/schemas/message.schema.json new file mode 100644 index 00000000000000..f3d8d2534bc97a --- /dev/null +++ b/pkg/security/secl/schemas/message.schema.json @@ -0,0 +1,23 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "message.schema.json", + "allOf": [ + { + "properties": { + "agent": { + "$ref": "agent_context.schema.json" + } + } + }, + { + "properties": { + "evt": { + "type": "object" + } + }, + "required": [ + "evt" + ] + } + ] +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/mmap.schema.json b/pkg/security/secl/schemas/mmap.schema.json similarity index 82% rename from pkg/security/tests/schemas/mmap.schema.json rename to pkg/security/secl/schemas/mmap.schema.json index 21244fc74cc6e3..06090e86ed626c 100644 --- a/pkg/security/tests/schemas/mmap.schema.json +++ b/pkg/security/secl/schemas/mmap.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "mmap.json", + "$id": "mmap.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { diff --git a/pkg/security/tests/schemas/mount.schema.json b/pkg/security/secl/schemas/mount.schema.json similarity index 92% rename from pkg/security/tests/schemas/mount.schema.json rename to pkg/security/secl/schemas/mount.schema.json index 1b2570ea2e2b47..b4fa7741e516ad 100644 --- a/pkg/security/tests/schemas/mount.schema.json +++ b/pkg/security/secl/schemas/mount.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "mount.json", + "$id": "mount.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/mprotect.schema.json b/pkg/security/secl/schemas/mprotect.schema.json similarity index 84% rename from pkg/security/tests/schemas/mprotect.schema.json rename to pkg/security/secl/schemas/mprotect.schema.json index 5d10f010f467ee..9d48937725a73a 100644 --- a/pkg/security/tests/schemas/mprotect.schema.json +++ b/pkg/security/secl/schemas/mprotect.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "mprotect.json", + "$id": "mprotect.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { diff --git a/pkg/security/tests/schemas/network.json b/pkg/security/secl/schemas/network.schema.json similarity index 98% rename from pkg/security/tests/schemas/network.json rename to pkg/security/secl/schemas/network.schema.json index 814f2ab76255a3..22d8c2374c802c 100644 --- a/pkg/security/tests/schemas/network.json +++ b/pkg/security/secl/schemas/network.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "network.json", + "$id": "network.schema.json", "type": "object", "properties": { "network": { diff --git a/pkg/security/tests/schemas/open.schema.json b/pkg/security/secl/schemas/open.schema.json similarity index 78% rename from pkg/security/tests/schemas/open.schema.json rename to pkg/security/secl/schemas/open.schema.json index 00d79202b53acb..96f8936906c084 100644 --- a/pkg/security/tests/schemas/open.schema.json +++ b/pkg/security/secl/schemas/open.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "open.json", + "$id": "open.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/secl/schemas/policy.schema.json b/pkg/security/secl/schemas/policy.schema.json new file mode 100644 index 00000000000000..5fceb63011b5b3 --- /dev/null +++ b/pkg/security/secl/schemas/policy.schema.json @@ -0,0 +1,457 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://github.com/DataDog/datadog-agent/tree/main/pkg/security/secl/rules", + "$defs": { + "ActionDefinition": { + "oneOf": [ + { + "required": [ + "set" + ], + "title": "SetAction" + }, + { + "required": [ + "kill" + ], + "title": "KillAction" + }, + { + "required": [ + "coredump" + ], + "title": "CoreDumpAction" + }, + { + "required": [ + "hash" + ], + "title": "HashAction" + } + ], + "properties": { + "filter": { + "type": "string" + }, + "set": { + "$ref": "#/$defs/SetDefinition" + }, + "kill": { + "$ref": "#/$defs/KillDefinition" + }, + "coredump": { + "$ref": "#/$defs/CoreDumpDefinition" + }, + "hash": { + "$ref": "#/$defs/HashDefinition" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ActionDefinition describes a rule action section" + }, + "CoreDumpDefinition": { + "anyOf": [ + { + "required": [ + "process" + ], + "title": "CoreDumpWithProcess" + }, + { + "required": [ + "mount" + ], + "title": "CoreDumpWithMount" + }, + { + "required": [ + "dentry" + ], + "title": "CoreDumpWithDentry" + } + ], + "properties": { + "process": { + "type": "boolean" + }, + "mount": { + "type": "boolean" + }, + "dentry": { + "type": "boolean" + }, + "no_compression": { + "type": "boolean" + } + }, + "additionalProperties": false, + "type": "object", + "description": "CoreDumpDefinition describes the 'coredump' action" + }, + "HashDefinition": { + "properties": {}, + "additionalProperties": false, + "type": "object", + "description": "HashDefinition describes the 'hash' section of a rule action" + }, + "HookPointArg": { + "properties": { + "n": { + "type": "integer", + "description": "Zero-based argument index" + }, + "kind": { + "type": "string", + "enum": [ + "uint", + "null-terminated-string" + ] + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "n", + "kind" + ], + "description": "HookPointArg represents the definition of a hook point argument" + }, + "KillDefinition": { + "properties": { + "signal": { + "type": "string", + "description": "A valid signal name", + "examples": [ + "SIGKILL", + "SIGTERM" + ] + }, + "scope": { + "type": "string", + "enum": [ + "process", + "container" + ] + }, + "disarmer": { + "$ref": "#/$defs/KillDisarmerDefinition" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "signal" + ], + "description": "KillDefinition describes the 'kill' section of a rule action" + }, + "KillDisarmerDefinition": { + "properties": { + "container": { + "$ref": "#/$defs/KillDisarmerParamsDefinition" + }, + "executable": { + "$ref": "#/$defs/KillDisarmerParamsDefinition" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KillDisarmerDefinition describes the 'disarmer' section of a kill action" + }, + "KillDisarmerParamsDefinition": { + "properties": { + "max_allowed": { + "type": "integer", + "description": "The maximum number of allowed kill actions within the period", + "examples": [ + 5 + ] + }, + "period": { + "oneOf": [ + { + "type": "string", + "format": "duration", + "description": "Duration in Go format (e.g. 1h30m, see https://pkg.go.dev/time#ParseDuration)" + }, + { + "type": "integer", + "description": "Duration in nanoseconds" + } + ], + "description": "The period of time during which the maximum number of allowed kill actions is calculated" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KillDisarmerParamsDefinition describes the parameters of a kill action disarmer" + }, + "MacroDefinition": { + "oneOf": [ + { + "required": [ + "expression" + ], + "title": "MacroWithExpression" + }, + { + "required": [ + "values" + ], + "title": "MacroWithValues" + } + ], + "properties": { + "id": { + "type": "string" + }, + "expression": { + "type": "string" + }, + "description": { + "type": "string" + }, + "agent_version": { + "type": "string" + }, + "filters": { + "items": { + "type": "string" + }, + "type": "array" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + }, + "combine": { + "type": "string", + "enum": [ + "merge", + "override" + ] + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "id" + ], + "description": "MacroDefinition holds the definition of a macro" + }, + "OnDemandHookPoint": { + "properties": { + "name": { + "type": "string" + }, + "syscall": { + "type": "boolean" + }, + "args": { + "items": { + "$ref": "#/$defs/HookPointArg" + }, + "type": "array" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "name" + ], + "description": "OnDemandHookPoint represents a hook point definition" + }, + "OverrideOptions": { + "properties": { + "fields": { + "items": { + "type": "string", + "enum": [ + "all", + "expression", + "actions", + "every", + "tags" + ] + }, + "type": "array" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "fields" + ], + "description": "OverrideOptions defines combine options" + }, + "RuleDefinition": { + "properties": { + "id": { + "type": "string" + }, + "version": { + "type": "string" + }, + "expression": { + "type": "string" + }, + "description": { + "type": "string" + }, + "tags": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "agent_version": { + "type": "string" + }, + "filters": { + "items": { + "type": "string" + }, + "type": "array" + }, + "disabled": { + "type": "boolean" + }, + "combine": { + "type": "string", + "enum": [ + "override" + ] + }, + "override_options": { + "$ref": "#/$defs/OverrideOptions" + }, + "actions": { + "items": { + "$ref": "#/$defs/ActionDefinition" + }, + "type": "array" + }, + "every": { + "oneOf": [ + { + "type": "string", + "format": "duration", + "description": "Duration in Go format (e.g. 1h30m, see https://pkg.go.dev/time#ParseDuration)" + }, + { + "type": "integer", + "description": "Duration in nanoseconds" + } + ] + }, + "limiter_token": { + "items": { + "type": "string" + }, + "type": "array" + }, + "silent": { + "type": "boolean" + }, + "group_id": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "id" + ], + "description": "RuleDefinition holds the definition of a rule" + }, + "SetDefinition": { + "oneOf": [ + { + "required": [ + "value" + ], + "title": "SetWithValue" + }, + { + "required": [ + "field" + ], + "title": "SetWithField" + } + ], + "properties": { + "name": { + "type": "string" + }, + "value": true, + "field": { + "type": "string" + }, + "append": { + "type": "boolean" + }, + "scope": { + "type": "string", + "enum": [ + "process", + "container" + ] + }, + "size": { + "type": "integer" + }, + "ttl": { + "oneOf": [ + { + "type": "string", + "format": "duration", + "description": "Duration in Go format (e.g. 1h30m, see https://pkg.go.dev/time#ParseDuration)" + }, + { + "type": "integer", + "description": "Duration in nanoseconds" + } + ] + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "name" + ], + "description": "SetDefinition describes the 'set' section of a rule action" + } + }, + "properties": { + "version": { + "type": "string" + }, + "macros": { + "items": { + "$ref": "#/$defs/MacroDefinition" + }, + "type": "array" + }, + "rules": { + "items": { + "$ref": "#/$defs/RuleDefinition" + }, + "type": "array" + }, + "hooks": { + "items": { + "$ref": "#/$defs/OnDemandHookPoint" + }, + "type": "array" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "version", + "rules" + ], + "description": "PolicyDef represents a policy file definition" +} \ No newline at end of file diff --git a/pkg/security/tests/schemas/process.json b/pkg/security/secl/schemas/process.schema.json similarity index 95% rename from pkg/security/tests/schemas/process.json rename to pkg/security/secl/schemas/process.schema.json index 8cd4e967e62a0b..a517391d001cb2 100644 --- a/pkg/security/tests/schemas/process.json +++ b/pkg/security/secl/schemas/process.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "process.json", + "$id": "process.schema.json", "type": "object", "properties": { "tid": { @@ -37,10 +37,10 @@ ] }, "fork_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "exec_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "is_kthread": { "type": "boolean" @@ -150,10 +150,10 @@ "type": "integer" }, "modification_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "change_time": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "envs": { "type": "array", @@ -176,7 +176,7 @@ ] }, "container": { - "$ref": "/schemas/container.json" + "$ref": "container.schema.json" } }, "oneOf": [ diff --git a/pkg/security/tests/schemas/process_context.json b/pkg/security/secl/schemas/process_context.schema.json similarity index 74% rename from pkg/security/tests/schemas/process_context.json rename to pkg/security/secl/schemas/process_context.schema.json index 3e60de7d63caa4..84147f66c81dcf 100644 --- a/pkg/security/tests/schemas/process_context.json +++ b/pkg/security/secl/schemas/process_context.schema.json @@ -1,26 +1,26 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "process_context.json", + "$id": "process_context.schema.json", "type": "object", "properties": { "process": { "allOf": [ { - "$ref": "/schemas/process.json" + "$ref": "process.schema.json" }, { "properties": { "parent": { - "$ref": "/schemas/process.json" + "$ref": "process.schema.json" }, "ancestors": { "type": "array", "items": { - "$ref": "/schemas/process.json" + "$ref": "process.schema.json" } }, "container": { - "$ref": "/schemas/container.json" + "$ref": "container.schema.json" } }, "required": [ diff --git a/pkg/security/tests/schemas/ptrace.schema.json b/pkg/security/secl/schemas/ptrace.schema.json similarity index 76% rename from pkg/security/tests/schemas/ptrace.schema.json rename to pkg/security/secl/schemas/ptrace.schema.json index a8a023197ea747..d30872b27e64cd 100644 --- a/pkg/security/tests/schemas/ptrace.schema.json +++ b/pkg/security/secl/schemas/ptrace.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "ptrace.json", + "$id": "ptrace.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { @@ -32,7 +32,7 @@ "type": "string" }, "tracee": { - "$ref": "/schemas/process.json" + "$ref": "process.schema.json" } } } diff --git a/pkg/security/tests/schemas/rename.schema.json b/pkg/security/secl/schemas/rename.schema.json similarity index 76% rename from pkg/security/tests/schemas/rename.schema.json rename to pkg/security/secl/schemas/rename.schema.json index a972cfd8692b9b..d7dc7f38d4c8aa 100644 --- a/pkg/security/tests/schemas/rename.schema.json +++ b/pkg/security/secl/schemas/rename.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "rename.json", + "$id": "rename.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ @@ -20,7 +20,7 @@ ], "properties": { "destination": { - "$ref": "/schemas/file.json" + "$ref": "file.schema.json" } } } diff --git a/pkg/security/tests/schemas/ruleset_loaded.schema.json b/pkg/security/secl/schemas/ruleset_loaded.schema.json similarity index 96% rename from pkg/security/tests/schemas/ruleset_loaded.schema.json rename to pkg/security/secl/schemas/ruleset_loaded.schema.json index 92777b10cba2f8..68b252a9e77274 100644 --- a/pkg/security/tests/schemas/ruleset_loaded.schema.json +++ b/pkg/security/secl/schemas/ruleset_loaded.schema.json @@ -1,6 +1,6 @@ { "$schema": "http://json-schema.org/draft-04/schema#", - "$id": "ruleset_loaded.json", + "$id": "ruleset_loaded.schema.json", "type": "object", "properties": { "policies": { @@ -10,7 +10,7 @@ } }, "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, "required": [ diff --git a/pkg/security/secl/schemas/schemas.go b/pkg/security/secl/schemas/schemas.go new file mode 100644 index 00000000000000..8c3866583f1a84 --- /dev/null +++ b/pkg/security/secl/schemas/schemas.go @@ -0,0 +1,16 @@ +// Unless explicitly stated otherwise all files in this repository are licensed +// under the Apache License Version 2.0. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2016-present Datadog, Inc. + +// Package schemas holds JSON schemas validation code +package schemas + +import ( + "embed" +) + +// AssetFS holds the embedded JSON schemas +// +//go:embed *.schema.json +var AssetFS embed.FS diff --git a/pkg/security/tests/schemas/self_test_schema.json b/pkg/security/secl/schemas/self_test_schema.json similarity index 83% rename from pkg/security/tests/schemas/self_test_schema.json rename to pkg/security/secl/schemas/self_test_schema.json index 506b8395c5fa00..4c2604c21cd7e9 100644 --- a/pkg/security/tests/schemas/self_test_schema.json +++ b/pkg/security/secl/schemas/self_test_schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "self_test.json", + "$id": "self_test.schema.json", "type": "object", "properties": { "agent": { @@ -16,7 +16,7 @@ "required": ["rule_id", "version"] }, "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" }, "hostname": { "type": "string" @@ -49,13 +49,16 @@ "type": "object", "properties": { "datadog_agent_cws_self_test_rule_open": { - "$ref": "/schemas/open.json" + "$ref": "open.schema.json" }, "datadog_agent_cws_self_test_rule_chmod": { - "$ref": "/schemas/chmod.json" + "$ref": "chmod.schema.json" }, "datadog_agent_cws_self_test_rule_chown": { - "$ref": "/schemas/chown.json" + "$ref": "chown.schema.json" + }, + "datadog_agent_cws_self_test_rule_exec": { + "$ref": "exec.schema.json" } } } diff --git a/pkg/security/tests/schemas/selinux.schema.json b/pkg/security/secl/schemas/selinux.schema.json similarity index 95% rename from pkg/security/tests/schemas/selinux.schema.json rename to pkg/security/secl/schemas/selinux.schema.json index 5cff42b712ef4b..54619cf41f6503 100644 --- a/pkg/security/tests/schemas/selinux.schema.json +++ b/pkg/security/secl/schemas/selinux.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "selinux.json", + "$id": "selinux.schema.json", "definitions": { "bool": { "type": "object", @@ -74,10 +74,10 @@ "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "properties": { diff --git a/pkg/security/tests/schemas/signal.schema.json b/pkg/security/secl/schemas/signal.schema.json similarity index 76% rename from pkg/security/tests/schemas/signal.schema.json rename to pkg/security/secl/schemas/signal.schema.json index a1c0fdff431919..ec9851a087e374 100644 --- a/pkg/security/tests/schemas/signal.schema.json +++ b/pkg/security/secl/schemas/signal.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "signal.json", + "$id": "signal.schema.json", "type": "object", "allOf": [ { - "$ref": "/schemas/event.json" + "$ref": "event.schema.json" }, { - "$ref": "/schemas/usr.json" + "$ref": "usr.schema.json" }, { - "$ref": "/schemas/process_context.json" + "$ref": "process_context.schema.json" }, { "date": { - "$ref": "/schemas/datetime.json" + "$ref": "datetime.schema.json" } }, { @@ -34,7 +34,7 @@ "type": "integer" }, "target": { - "$ref": "/schemas/process.json" + "$ref": "process.schema.json" } } } diff --git a/pkg/security/tests/schemas/span.schema.json b/pkg/security/secl/schemas/span.schema.json similarity index 57% rename from pkg/security/tests/schemas/span.schema.json rename to pkg/security/secl/schemas/span.schema.json index 8ef452ac1bb6fb..f12ab4c05b96b8 100644 --- a/pkg/security/tests/schemas/span.schema.json +++ b/pkg/security/secl/schemas/span.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "span.json", + "$id": "span.schema.json", "type": "object", "allOf": [ { "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ] }, { - "$ref": "/schemas/span_context.json" + "$ref": "span_context.schema.json" } ] } \ No newline at end of file diff --git a/pkg/security/tests/schemas/span_context.json b/pkg/security/secl/schemas/span_context.schema.json similarity index 91% rename from pkg/security/tests/schemas/span_context.json rename to pkg/security/secl/schemas/span_context.schema.json index eb259271fa4639..149b85c48a6a64 100644 --- a/pkg/security/tests/schemas/span_context.json +++ b/pkg/security/secl/schemas/span_context.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "span_context.json", + "$id": "span_context.schema.json", "type": "object", "properties": { "dd": { diff --git a/pkg/security/tests/schemas/splice.schema.json b/pkg/security/secl/schemas/splice.schema.json similarity index 86% rename from pkg/security/tests/schemas/splice.schema.json rename to pkg/security/secl/schemas/splice.schema.json index 36220d5e69a8ba..aaf433f77915f7 100644 --- a/pkg/security/tests/schemas/splice.schema.json +++ b/pkg/security/secl/schemas/splice.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "splice.json", + "$id": "splice.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/unload_module.schema.json b/pkg/security/secl/schemas/unload_module.schema.json similarity index 79% rename from pkg/security/tests/schemas/unload_module.schema.json rename to pkg/security/secl/schemas/unload_module.schema.json index fbec0b070d9514..d026c73578ca34 100644 --- a/pkg/security/tests/schemas/unload_module.schema.json +++ b/pkg/security/secl/schemas/unload_module.schema.json @@ -1,13 +1,13 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "unload_module.json", + "$id": "unload_module.schema.json", "type": "object", "anyOf": [ { - "$ref": "/schemas/container_event_no_file.json" + "$ref": "container_event_no_file.schema.json" }, { - "$ref": "/schemas/host_event_no_file.json" + "$ref": "host_event_no_file.schema.json" } ], "allOf": [ diff --git a/pkg/security/tests/schemas/user_session.schema.json b/pkg/security/secl/schemas/user_session.schema.json similarity index 56% rename from pkg/security/tests/schemas/user_session.schema.json rename to pkg/security/secl/schemas/user_session.schema.json index 8f7ba10082fb94..9fd49e1fb5ac91 100644 --- a/pkg/security/tests/schemas/user_session.schema.json +++ b/pkg/security/secl/schemas/user_session.schema.json @@ -1,20 +1,20 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "user_session.json", + "$id": "user_session.schema.json", "type": "object", "allOf": [ { "anyOf": [ { - "$ref": "/schemas/container_event.json" + "$ref": "container_event.schema.json" }, { - "$ref": "/schemas/host_event.json" + "$ref": "host_event.schema.json" } ] }, { - "$ref": "/schemas/user_session_context.json" + "$ref": "user_session_context.schema.json" } ] } diff --git a/pkg/security/tests/schemas/user_session_context.json b/pkg/security/secl/schemas/user_session_context.schema.json similarity index 95% rename from pkg/security/tests/schemas/user_session_context.json rename to pkg/security/secl/schemas/user_session_context.schema.json index 4e380a3c30d43a..04c03f4233d66a 100644 --- a/pkg/security/tests/schemas/user_session_context.json +++ b/pkg/security/secl/schemas/user_session_context.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "user_session_context.json", + "$id": "user_session_context.schema.json", "type": "object", "properties": { "process": { diff --git a/pkg/security/tests/schemas/usr.json b/pkg/security/secl/schemas/usr.schema.json similarity index 92% rename from pkg/security/tests/schemas/usr.json rename to pkg/security/secl/schemas/usr.schema.json index 132e029f6aaa30..4279c1430aa6ab 100644 --- a/pkg/security/tests/schemas/usr.json +++ b/pkg/security/secl/schemas/usr.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "usr.json", + "$id": "usr.schema.json", "type": "object", "properties": { "usr": { diff --git a/pkg/security/tests/schemas.go b/pkg/security/tests/schemas.go index 5e062fdefa7d80..0ee7d7767b9e7b 100644 --- a/pkg/security/tests/schemas.go +++ b/pkg/security/tests/schemas.go @@ -9,75 +9,43 @@ package tests import ( - "embed" + "fmt" "math/big" "net/http" + "os" "testing" - "github.com/xeipuuv/gojsonschema" - "github.com/DataDog/datadog-agent/pkg/security/events" "github.com/DataDog/datadog-agent/pkg/security/resolvers/dentry" "github.com/DataDog/datadog-agent/pkg/security/secl/model" + "github.com/DataDog/datadog-agent/pkg/security/secl/schemas" "github.com/DataDog/datadog-agent/pkg/security/serializers" + "github.com/xeipuuv/gojsonschema" ) -//nolint:deadcode,unused -//go:embed schemas -var schemaAssetFS embed.FS +func getUpstreamEventSchema() string { + sha, _ := os.LookupEnv("CI_COMMIT_SHA") + if sha == "" { + sha = "main" + } + return fmt.Sprintf("https://raw.githubusercontent.com/DataDog/datadog-agent/%s/docs/cloud-workload-security/backend_linux.schema.json", sha) +} -// ValidInodeFormatChecker defines the format inode checker -// -//nolint:deadcode,unused -type ValidInodeFormatChecker struct{} +var upstreamEventSchema = getUpstreamEventSchema() -// IsFormat check inode format -// //nolint:deadcode,unused -func (v ValidInodeFormatChecker) IsFormat(input interface{}) bool { - - var inode uint64 - switch t := input.(type) { - case float64: - inode = uint64(t) - case *big.Int: - inode = t.Uint64() - case *big.Float: - inode, _ = t.Uint64() - case *big.Rat: - f, _ := t.Float64() - inode = uint64(f) - default: - return false - } - return !dentry.IsFakeInode(inode) +func validateActivityDumpProtoSchema(t *testing.T, ad string) bool { + t.Helper() + return validateUrlSchema(t, ad, "file:///activity_dump_proto.schema.json") } //nolint:deadcode,unused -func validateStringSchema(t *testing.T, json string, path string) bool { +func validateMessageSchema(t *testing.T, msg string) bool { t.Helper() - - fs := http.FS(schemaAssetFS) - gojsonschema.FormatCheckers.Add("ValidInode", ValidInodeFormatChecker{}) - - documentLoader := gojsonschema.NewStringLoader(json) - schemaLoader := gojsonschema.NewReferenceLoaderFileSystem(path, fs) - - result, err := gojsonschema.Validate(schemaLoader, documentLoader) - if err != nil { - t.Error(err) + if !validateUrlSchema(t, msg, "file:///message.schema.json") { return false } - - if !result.Valid() { - for _, desc := range result.Errors() { - t.Errorf("%s", desc) - } - t.Error(json) - return false - } - - return true + return validateUrlSchema(t, msg, upstreamEventSchema) } //nolint:deadcode,unused @@ -96,7 +64,7 @@ func (tm *testModule) validateEventSchema(t *testing.T, event *model.Event, path //nolint:deadcode,unused func (tm *testModule) validateExecSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/exec.schema.json") + return tm.validateEventSchema(t, event, "file:///exec.schema.json") } //nolint:deadcode,unused @@ -106,7 +74,7 @@ func (tm *testModule) validateExitSchema(t *testing.T, event *model.Event) bool } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/exit.schema.json") + return tm.validateEventSchema(t, event, "file:///exit.schema.json") } //nolint:deadcode,unused @@ -116,7 +84,7 @@ func (tm *testModule) validateOpenSchema(t *testing.T, event *model.Event) bool } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/open.schema.json") + return tm.validateEventSchema(t, event, "file:///open.schema.json") } //nolint:deadcode,unused @@ -126,7 +94,7 @@ func (tm *testModule) validateRenameSchema(t *testing.T, event *model.Event) boo } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/rename.schema.json") + return tm.validateEventSchema(t, event, "file:///rename.schema.json") } //nolint:deadcode,unused @@ -136,7 +104,7 @@ func (tm *testModule) validateChmodSchema(t *testing.T, event *model.Event) bool } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/chmod.schema.json") + return tm.validateEventSchema(t, event, "file:///chmod.schema.json") } //nolint:deadcode,unused @@ -146,13 +114,13 @@ func (tm *testModule) validateChownSchema(t *testing.T, event *model.Event) bool } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/chown.schema.json") + return tm.validateEventSchema(t, event, "file:///chown.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateSELinuxSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/selinux.schema.json") + return tm.validateEventSchema(t, event, "file:///selinux.schema.json") } //nolint:deadcode,unused @@ -162,43 +130,47 @@ func (tm *testModule) validateLinkSchema(t *testing.T, event *model.Event) bool } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/link.schema.json") + return tm.validateEventSchema(t, event, "file:///link.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateSpanSchema(t *testing.T, event *model.Event) bool { + if ebpfLessEnabled { + return true + } + t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/span.schema.json") + return tm.validateEventSchema(t, event, "file:///span.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateUserSessionSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/user_session.schema.json") + return tm.validateEventSchema(t, event, "file:///user_session.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateBPFSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/bpf.schema.json") + return tm.validateEventSchema(t, event, "file:///bpf.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateMMapSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/mmap.schema.json") + return tm.validateEventSchema(t, event, "file:///mmap.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateMProtectSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/mprotect.schema.json") + return tm.validateEventSchema(t, event, "file:///mprotect.schema.json") } //nolint:deadcode,unused func (tm *testModule) validatePTraceSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/ptrace.schema.json") + return tm.validateEventSchema(t, event, "file:///ptrace.schema.json") } //nolint:deadcode,unused @@ -208,7 +180,7 @@ func (tm *testModule) validateLoadModuleSchema(t *testing.T, event *model.Event) } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/load_module.schema.json") + return tm.validateEventSchema(t, event, "file:///load_module.schema.json") } //nolint:deadcode,unused @@ -218,7 +190,7 @@ func (tm *testModule) validateLoadModuleNoFileSchema(t *testing.T, event *model. } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/load_module_no_file.schema.json") + return tm.validateEventSchema(t, event, "file:///load_module_no_file.schema.json") } //nolint:deadcode,unused @@ -228,37 +200,53 @@ func (tm *testModule) validateUnloadModuleSchema(t *testing.T, event *model.Even } t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/unload_module.schema.json") + return tm.validateEventSchema(t, event, "file:///unload_module.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateSignalSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/signal.schema.json") + return tm.validateEventSchema(t, event, "file:///signal.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateSpliceSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/splice.schema.json") + return tm.validateEventSchema(t, event, "file:///splice.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateDNSSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/dns.schema.json") + return tm.validateEventSchema(t, event, "file:///dns.schema.json") +} + +//nolint:deadcode,unused +func (tm *testModule) validateIMDSSchema(t *testing.T, event *model.Event) bool { + t.Helper() + return tm.validateEventSchema(t, event, "file:///imds.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateBindSchema(t *testing.T, event *model.Event) bool { t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/bind.schema.json") + return tm.validateEventSchema(t, event, "file:///bind.schema.json") +} + +//nolint:deadcode,unused +func (tm *testModule) validateConnectSchema(t *testing.T, event *model.Event) bool { + t.Helper() + return tm.validateEventSchema(t, event, "file:///connect.schema.json") } //nolint:deadcode,unused func (tm *testModule) validateMountSchema(t *testing.T, event *model.Event) bool { + if ebpfLessEnabled { + return true + } + t.Helper() - return tm.validateEventSchema(t, event, "file:///schemas/mount.schema.json") + return tm.validateEventSchema(t, event, "file:///mount.schema.json") } //nolint:deadcode,unused @@ -271,7 +259,7 @@ func validateRuleSetLoadedSchema(t *testing.T, event *events.CustomEvent) bool { return false } - return validateStringSchema(t, string(eventJSON), "file:///schemas/ruleset_loaded.schema.json") + return validateUrlSchema(t, string(eventJSON), "file:///ruleset_loaded.schema.json") } //nolint:deadcode,unused @@ -284,11 +272,88 @@ func validateHeartbeatSchema(t *testing.T, event *events.CustomEvent) bool { return false } - return validateStringSchema(t, string(eventJSON), "file:///schemas/heartbeat.schema.json") + return validateUrlSchema(t, string(eventJSON), "file:///heartbeat.schema.json") } +// ValidInodeFormatChecker defines the format inode checker +// //nolint:deadcode,unused -func validateActivityDumpProtoSchema(t *testing.T, ad string) bool { +type ValidInodeFormatChecker struct{} + +// IsFormat check inode format +// +//nolint:deadcode,unused +func (v ValidInodeFormatChecker) IsFormat(input interface{}) bool { + + var inode uint64 + switch t := input.(type) { + case float64: + inode = uint64(t) + case *big.Int: + inode = t.Uint64() + case *big.Float: + inode, _ = t.Uint64() + case *big.Rat: + f, _ := t.Float64() + inode = uint64(f) + default: + return false + } + return !dentry.IsFakeInode(inode) +} + +func validateSchema(t *testing.T, schemaLoader gojsonschema.JSONLoader, documentLoader gojsonschema.JSONLoader) bool { + result, err := gojsonschema.Validate(schemaLoader, documentLoader) + if err != nil { + t.Error(err) + return false + } + + success := true + + if !result.Valid() { + for _, err := range result.Errors() { + // allow addition properties + if err.Type() == "additional_property_not_allowed" { + continue + } + + t.Error(err) + success = false + } + } + return success +} + +//nolint:deadcode,unused +func validateStringSchema(t *testing.T, json string, path string) bool { + t.Helper() + + fs := http.FS(schemas.AssetFS) + gojsonschema.FormatCheckers.Add("ValidInode", ValidInodeFormatChecker{}) + + documentLoader := gojsonschema.NewStringLoader(json) + schemaLoader := gojsonschema.NewReferenceLoaderFileSystem(path, fs) + + if !validateSchema(t, schemaLoader, documentLoader) { + t.Error(json) + return false + } + + return true +} + +//nolint:deadcode,unused +func validateUrlSchema(t *testing.T, json string, url string) bool { t.Helper() - return validateStringSchema(t, ad, "file:///schemas/activity_dump_proto.schema.json") + + documentLoader := gojsonschema.NewStringLoader(json) + schemaLoader := gojsonschema.NewReferenceLoader(url) + + if !validateSchema(t, schemaLoader, documentLoader) { + t.Error(json) + return false + } + + return true } diff --git a/pkg/security/tests/schemas/container_event.json b/pkg/security/tests/schemas/container_event.json deleted file mode 100644 index 8da9674f17f6b3..00000000000000 --- a/pkg/security/tests/schemas/container_event.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "container_event.json", - "allOf": [ - { - "$ref": "/schemas/host_event.json" - }, - { - "$ref": "/schemas/container_context.json" - } - ] -} diff --git a/pkg/security/tests/schemas/container_event_no_file.json b/pkg/security/tests/schemas/container_event_no_file.json deleted file mode 100644 index 6adba61b6bd40c..00000000000000 --- a/pkg/security/tests/schemas/container_event_no_file.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "container_event_no_file.json", - "allOf": [ - { - "$ref": "/schemas/host_event_no_file.json" - }, - { - "$ref": "/schemas/container_context.json" - } - ] -} diff --git a/pkg/security/tests/schemas/host_event.json b/pkg/security/tests/schemas/host_event.json deleted file mode 100644 index 9971c36e7c6195..00000000000000 --- a/pkg/security/tests/schemas/host_event.json +++ /dev/null @@ -1,23 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "host_event.json", - "allOf": [ - { - "$ref": "/schemas/event.json" - }, - { - "file": { "$ref": "/schemas/file.json" } - }, - { - "$ref": "/schemas/usr.json" - }, - { - "$ref": "/schemas/process_context.json" - }, - { - "date": { - "$ref": "/schemas/datetime.json" - } - } - ] -} diff --git a/pkg/security/tests/schemas/host_event_no_file.json b/pkg/security/tests/schemas/host_event_no_file.json deleted file mode 100644 index eb83c82682b75a..00000000000000 --- a/pkg/security/tests/schemas/host_event_no_file.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "host_event_no_file.json", - "allOf": [ - { - "$ref": "/schemas/event.json" - }, - { - "$ref": "/schemas/usr.json" - }, - { - "$ref": "/schemas/process_context.json" - }, - { - "date": { - "$ref": "/schemas/datetime.json" - } - } - ] -}