Port parse_module_line into (jsecmon proc-linux)
ober
c526e7f0aa076c249cf87e502f4a8a987d1c5477
--- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ then crypto orchestration, then I/O / async / FFI (monitors, server, storage). | `dtrace::scripts::is_sensitive_path` (sensitive-path classifier) | `jsecmon/sensitive-path.ss` | ✅ **untyped layer** — `is_sensitive_path(path)`: a sensitive prefix (passwd/shadow/sudoers/ssh dirs/cron/periodic/ld.so.preload/`/boot/`/…), with `/home/` special-cased to only `/.ssh/` subpaths, else `authorized_keys` anywhere, else `/cron` or `/periodic`. Pure string classification, so untyped; obfstr!-hidden literals decode to these plaintexts. Ported with secmon's loop-with-early-return so the **load-bearing corner** holds: a `/home/` path short-circuits before the `authorized_keys` check, so `/home/user/authorized_keys` (no `/.ssh/`) is **not** sensitive. `make sensitive-path-check` reproduces secmon's `test_sensitive_path_detection` + each signal + that corner. | | `dtrace::consumer::EventParser` (DTrace line parser) | `jsecmon/dtrace-parse.ss` | ✅ **untyped layer** — `parse_dtrace_line(line)`: split a `SECMON\|TYPE\|…` DTrace line on `\|` and dispatch on `parts[1]` into a per-type structured record (EXEC/EXIT/CONNECT/LISTEN/OPEN/WRITE) with each handler's exact field extraction; a <2-field / unknown-type / too-few-fields line yields no record (`#f`), matching secmon's `return Ok(())` no-ops. A text parser yielding a structured record, like the DNS/SELinux parsers, so untyped (alist, since the per-type fields are disjoint). Numeric fields use `.parse().unwrap_or(0)` (u32 rejects negatives → 0; exit code is i32), and the EXEC cmdline is `split_whitespace`. **Composes** `(jsecmon sensitive-path)` for the OPEN `sensitive?` gate. `make dtrace-parse-check` reproduces secmon's `test_parse_exec_line` / `test_parse_exit_line` + the other four formats + the no-event and `unwrap_or(0)` corners. (The stateful parts — process cache, suspicious-exec dispatch, channel send — are the deferred consumer loop.) | | `platform::{linux,freebsd}` (`is_dangerous_path` + `get_mounts` parsers) | `jsecmon/platform-mounts.ss` | ✅ **untyped layer** — the pure halves of each `IsolationProvider`, reads stripped: `is_dangerous_path` is **exact** membership in the platform's dangerous-path set (Linux 12 entries incl. `/proc/kcore`, `/dev/mem`, the docker/crio/containerd sockets; FreeBSD 6 incl. `/dev/io`, `devd.pipe`; unknown platforms empty, per the `UnsupportedProvider` default), and `parse_mounts` reproduces each `get_mounts` line loop — Linux `split_whitespace` keeping field[1], FreeBSD `split(" on ")` keeping piece[1] minus a trailing ` (opts)`. Pins that membership is exact not prefix (`/host/foo` is clean), and that the FreeBSD split takes piece[1] of a multi-`" on "` split (not everything-after-first). obfstr!-hidden lists decode to these plaintexts. Pure — the `/proc/self/mounts` read / `mount` exec is the deferred I/O — no native lib; secmon has no `#[test]` here so `make platform-mounts-check` asserts against the Rust source. (The `container.rs` test-only mock `is_dangerous_path` is `#[cfg(test)]` scaffolding, not ported.) | -| `platform::linux` (/proc parsers) | `jsecmon/proc-linux.ss` | ✅ **untyped layer** — the pure parsing helpers with the file reads stripped: `parse_stat` (comm between first `(` and **last** `)`, ppid the 2nd field after `") "`), `parse_uid` (first `Uid:` line, 2nd field), `hex_to_state` (TCP state table → `UNKNOWN`), `parse_ipv4` (little-endian hex → dotted quad), `parse_ipv6` (32-hex → 8 groups), `parse_addr` (`HEXADDR:HEXPORT`, ipv6 when protocol contains `6`). Pure text/number parsing, so untyped. `parse_stat`/`parse_uid` use `.parse::<u32>().ok()` so failure is `#f` (not 0) and negatives are rejected; `parse_ipv4` rejects >`0xFFFFFFFF`; ports are u16. Also `parse_security_environ` (from `ebpf/loader.rs`, but functionally a `/proc/[pid]/environ` parser): splits the NUL-separated blob, drops empty and non-UTF-8 entries (faithful to `std::str::from_utf8(..).ok()`, reproduced exception-free by a lossy-decode→re-encode→compare round trip), and keeps any var whose name `starts_with` one of 19 security-relevant prefixes **or** whose `to_uppercase()` does — so a lower-cased `path=`/`ld_…` still matches the upper-cased prefixes, while `http_proxy`/`https_proxy` match only literally-lower vars. `make proc-linux-check` reproduces secmon's five linux.rs tests + ipv6/parse-addr + a comm-with-paren corner + 10 environ-scan cases (invalid-UTF-8 drop, uppercase-arm, trailing NUL). (The `/proc` reads and inode→pid scan are the deferred I/O.) | +| `platform::linux` (/proc parsers) | `jsecmon/proc-linux.ss` | ✅ **untyped layer** — the pure parsing helpers with the file reads stripped: `parse_stat` (comm between first `(` and **last** `)`, ppid the 2nd field after `") "`), `parse_uid` (first `Uid:` line, 2nd field), `hex_to_state` (TCP state table → `UNKNOWN`), `parse_ipv4` (little-endian hex → dotted quad), `parse_ipv6` (32-hex → 8 groups), `parse_addr` (`HEXADDR:HEXPORT`, ipv6 when protocol contains `6`). Pure text/number parsing, so untyped. `parse_stat`/`parse_uid` use `.parse::<u32>().ok()` so failure is `#f` (not 0) and negatives are rejected; `parse_ipv4` rejects >`0xFFFFFFFF`; ports are u16. Also `parse_security_environ` (from `ebpf/loader.rs`, but functionally a `/proc/[pid]/environ` parser): splits the NUL-separated blob, drops empty and non-UTF-8 entries (faithful to `std::str::from_utf8(..).ok()`, reproduced exception-free by a lossy-decode→re-encode→compare round trip), and keeps any var whose name `starts_with` one of 19 security-relevant prefixes **or** whose `to_uppercase()` does — so a lower-cased `path=`/`ld_…` still matches the upper-cased prefixes, while `http_proxy`/`https_proxy` match only literally-lower vars. Also `parse_module_line` (a `/proc/modules` row: ≥4 ws fields → the same `KernelModuleInfo` alist as freebsd's `parse_kldstat_line`, name `parts[0]`, size `parts[1]` as DECIMAL u64 via `.parse().ok()` so a non-u64 size is `#f` but the row still parses, action always Loaded, no loader pid). `make proc-linux-check` reproduces secmon's five linux.rs tests + ipv6/parse-addr + a comm-with-paren corner + 10 environ-scan cases (invalid-UTF-8 drop, uppercase-arm, trailing NUL) + the module-line rows. (The `/proc` reads and inode→pid scan are the deferred I/O.) | | `platform::freebsd` (parsers) | `jsecmon/freebsd-parse.ss` | ✅ **untyped layer** — the pure parsing helpers with the command/file reads stripped: `parse_kldstat_line` (≥5 whitespace fields, name is `parts[4]`, size is `parts[3]` as hex with optional `0x`, size `None` on non-hex via `.ok()`, action always `Loaded`) and `parse_address` (`addr:port` split at the **last** `:`, `[ipv6]:port` split at the first `]`, `*` address → `0.0.0.0`, `*` port → `0`). Ports here are **DECIMAL** u16 (`.parse()`), unlike Linux's hex `/proc/net`. Plus `parse_ps_line` (the `ps -axo pid,ppid,uid,comm,args` fallback parser: ≥5 ws fields, `pid`/`ppid`/`uid` as u32 via `.parse().ok()?` so a non-u32 field rejects the whole line, `comm` is field[3], `args` is field[4..] re-joined with single spaces). Pure text/number parsing, so untyped. Also `parse_sockstat_line` (cols `USER COMMAND PID FD PROTO LOCAL FOREIGN`, ≥7, `pid` as u32-or-reject, protocol lower-cased, a `FOREIGN` of exactly `*:*` short-circuits to `("0.0.0.0" . 0)` **without** `parse_address`, `state` = LISTEN when remote is `0.0.0.0`/`::`/port 0 else ESTABLISHED) and `parse_netstat_line` (cols `Proto Recv-Q Send-Q LOCAL FOREIGN [state]`, ≥5, here `*:*` **does** go through `parse_address`, `state` = `parts[5]` or `UNKNOWN`, no pid/name) — both producing a connection alist mirroring `ConnectionInfo`. Plus `parse_freebsd_status` (the procfs `/proc/[pid]/status` columns: ≥13 ws fields → `(name ppid uid)`, name is `parts[0]`, ppid is `parts[2]`, uid is `parts[12]` = ruid, both u32-or-reject, trailing group columns ignored). `make freebsd-parse-check` reproduces secmon's three freebsd.rs tests + ipv6/wildcard/negatives + the ps-line cases + the sockstat/netstat rows + the status columns traced from source. (The `kldstat`/`sockstat`/`netstat`/`ps`/`status` command/file reads are the deferred I/O.) | | `event_json` + `local_store` (tables) | `jsecmon/event-meta.ss` | ✅ **untyped layer** — the pure classification tables lifted out of the payload-carrying `EventType` enum: `event_json.rs` `get_event_json_data`'s **display severity** (25 constant arms as a name→severity table, + the 7 payload-dependent arms as named helpers taking the deciding field — `auth`/`privilege_change`/`mount`/`capability`/`podman`/`selinux`/`lateral_movement`), and `local_store.rs` `event_severity_u8`'s **coarse store priority** 0..3, which is an *independent* scale (e.g. `privilege_escalation` is `critical` for display but `0` for the store). secmon has no `#[test]` here, so `make event-meta-check` asserts both full tables arm-for-arm against the Rust source. (The JSON payload bodies stay with the I/O layer that owns the event structs.) | | `config` | `jsecmon/config.ss` | ✅ **untyped layer** — `AgentConfig`'s pure parts: the defaults (`0.0.0.0:31337`, poll `100`ms, buffer `10000`), the `from_env` merge (overwrites `listen_addr` on any present value but only overwrites poll/buffer when the value parses as strict u64 — a bad value **keeps the default**, it is not zeroed), and `local_db_path`/`local_key_path` (env override, else `/opt/secmon/{events.db,local.key}` on linux+freebsd, else the `./secmon_*` cwd fallback). Parameterized over a `getenv` callback + a `platform` symbol so the env reads stay deferred I/O; the build.rs-embedded secrets (`get_public_key`/`get_psk`/`is_debug_mode`) belong to the build/FFI phase, not this layer. secmon has no tests here, so `make config-check` asserts the behaviour against the Rust source. | --- a/examples/proc_linux_check.ss +++ b/examples/proc_linux_check.ss @@ -95,6 +95,26 @@ (parse-security-environ (envblob "SSH_AUTH_SOCK=/tmp/s")) '("SSH_AUTH_SOCK=/tmp/s")) (check "empty input -> ()" (parse-security-environ (u8-list->bytevector '())) '()) +;; ── parse-module-line: /proc/modules row -> KernelModuleInfo alist ──────────── +(displayln "parse-module-line:") +(def m1 (parse-module-line "nf_tables 245760 1 nft_compat,nf_nat Live 0xffffffffc0a1b000")) +(check "module is some" (and m1 #t) #t) +(check "module name" (cdr (assq 'name m1)) "nf_tables") +(check "module size dec" (cdr (assq 'size m1)) 245760) +(check "module action" (cdr (assq 'action m1)) 'loaded) +(check "module pid #f" (cdr (assq 'loaded-by-pid m1)) #f) +;; minimal 4-field row parses +(check "4-field name" (cdr (assq 'name (parse-module-line "foo 16384 0 -"))) "foo") +(check "4-field size" (cdr (assq 'size (parse-module-line "foo 16384 0 -"))) 16384) +;; fewer than 4 whitespace fields -> #f +(check "too few -> #f" (parse-module-line "foo 16384 0") #f) +;; a non-decimal size -> size #f, row still parses (matches .ok()) +(def m2 (parse-module-line "bar notanum 0 -")) +(check "bad size -> #f" (cdr (assq 'size m2)) #f) +(check "bad size name ok" (cdr (assq 'name m2)) "bar") +;; size 0 is kept (0 is a valid u64) +(check "size 0 ok" (cdr (assq 'size (parse-module-line "baz 0 0 -"))) 0) + (newline) (if (= fails 0) (displayln "OK: proc-linux matches secmon's linux.rs behaviour.") --- a/jsecmon/proc-linux.ss +++ b/jsecmon/proc-linux.ss @@ -10,6 +10,7 @@ ;;; parse-ipv4 : little-endian hex -> dotted quad | #f ;;; parse-ipv6 : 32-hex string -> colon-grouped | #f ;;; parse-addr : "HEXADDR:HEXPORT" -> (addr . port) | #f +;;; parse-module-line : /proc/modules row -> KernelModuleInfo alist | #f ;;; parse-security-environ : /proc/[pid]/environ bytes -> security vars list ;;; ;;; Pure text/number parsing, like the DNS/SELinux/DTrace parsers, so untyped. @@ -30,7 +31,7 @@ (library (jsecmon proc-linux) (export parse-stat parse-uid hex-to-state parse-ipv4 parse-ipv6 parse-addr - parse-security-environ) + parse-module-line parse-security-environ) (import (except (chezscheme) make-hash-table hash-table? sort sort! @@ -125,6 +126,22 @@ (parse-ipv4 (list-ref parts 0))))) (and addr (cons addr port)))))))) + ;; a /proc/modules line "name size refcount deps state address" -> module alist + ;; ((name . s) (action . loaded) (size . n|#f) (loaded-by-pid . #f)) | #f — the + ;; same shape as freebsd's parse-kldstat-line (both build KernelModuleInfo). + ;; Needs >=4 ws fields; name is parts[0]; size is parts[1] as a DECIMAL u64 via + ;; `.parse().ok()` (a non-u64 size is #f but the row still parses); action is + ;; always Loaded and loaded-by-pid is #f (the loader PID isn't in /proc/modules). + (def (parse-module-line line) + (let ((parts (ws-tokens line))) + (and (>= (length parts) 4) + (let ((size (let ((n (string->number (list-ref parts 1)))) + (if (and n (integer? n) (>= n 0) (< n (expt 2 64))) n #f)))) + (list (cons 'name (list-ref parts 0)) + (cons 'action 'loaded) + (cons 'size size) + (cons 'loaded-by-pid #f)))))) + ;; ── /proc/[pid]/environ security-relevant var scan ────────────────────────── ;; From secmon src/ebpf/loader.rs's parse_security_environ; it lives in the ;; ebpf loader but is functionally a /proc/[pid]/environ parser, so it sits