Skip to content

Commit

Permalink
Merge pull request #242 from ek1ng/feat/sensitive-plugin
Browse files Browse the repository at this point in the history 
feat(sensitive): support env and docker history scan
  • Loading branch information
@DVKunion
DVKunion authored May 23, 2023
2 parents 91eda81 + 2ab15a8 commit b9848f4
Show file tree
Hide file tree
Showing 3 changed files with 150 additions and 20 deletions.
4 changes: 2 additions & 2 deletions plugins/go/veinmind-sensitive/cmd/cli.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ var (
PluginInfo = plugin.Manifest{
Name: "veinmind-sensitive",
Author: "veinmind-team",
Description: "veinmind-sensitive-file scan image sensitive data",
Version: "v1.1.4",
Description: "veinmind-sensitive scan image sensitive data",
Version: "v1.1.5",
}

reportService = &report.Service{}
Expand Down
113 changes: 96 additions & 17 deletions plugins/go/veinmind-sensitive/cmd/scan.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package main
import (
"io"
"runtime"
"strings"

api "github.com/chaitin/libveinmind/go"
"github.com/chaitin/libveinmind/go/cmd"
Expand Down Expand Up @@ -37,6 +38,22 @@ func Scan(c *cmd.Command, image api.Image) (err error) {
eg.SetLimit(defaultLimit)

count := uint64(0)

// scan env
log.Infof("%s scan env start", image.ID())
err = scanEnv(image, conf)
if err != nil {
return err
}

// scan history
log.Infof("%s scan docker history start", image.ID())
err = scanDockerHistory(image, conf)
if err != nil {
return err
}

// scan filesystem
log.Infof("%s scan file start", image.ID())
veinfs.Walk(image, "/", func(info *veinfs.FileInfo, err error) error {
if err != nil {
Expand All @@ -47,17 +64,57 @@ func Scan(c *cmd.Command, image api.Image) (err error) {
}
count += 1
eg.Go(func() error {
return scan(image, info.Path, info, conf)
return scanFS(image, info.Path, info, conf)
})

return nil
})
eg.Wait()
err = eg.Wait()
if err != nil {
return err
}
log.Infof("%s scan file count %d", image.ID(), count)
return nil
}

func scan(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config) error {
// scanEnv 扫描环境变量中的敏感信息
func scanEnv(image api.Image, conf *rule.Config) error {
ocispec, err := image.OCISpecV1()
if err != nil {
return err
}
for _, env := range ocispec.Config.Env {
for _, r := range conf.Rule {
if r.Env != "" && vregex.IsMatchString(r.Env, env) {
envArr := strings.Split(env, "=")
if len(envArr) == 2 {
reportEvent("env", image, r, envArr[0], envArr[1], "", "", nil, "", nil)
}
}
}
}
return nil
}

// scanHistory 扫描镜像历史命令中的敏感信息
func scanDockerHistory(image api.Image, conf *rule.Config) error {
ocispec, err := image.OCISpecV1()
if err != nil {
return err
}

for _, history := range ocispec.History {
for _, r := range conf.Rule {
if r.MatchPattern != "" && vregex.IsMatchString(r.MatchPattern, history.CreatedBy) {
reportEvent("history", image, r, "", "", history.CreatedBy, "", nil, "", nil)
}
}
}
return nil
}

// scanFS 扫描镜像文件系统中的敏感信息
func scanFS(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config) error {
// check white path cache
if cache.WhitePath.Contains(path) {
return nil
Expand All @@ -68,7 +125,7 @@ func scan(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config
if ok {
if len(rules) > 0 {
for _, r := range rules {
reportEvent(info.Path, r, info, image, "", nil)
reportEvent("file", image, r, "", "", "", info.Path, info, "", nil)
}
}
} else {
Expand All @@ -81,7 +138,7 @@ func scan(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config
for _, r := range conf.Rule {
if r.FilePathPattern != "" && vregex.IsMatchString(r.FilePathPattern, info.Path) {
cache.PathRule.SetOrAppend(path, r)
reportEvent(info.Path, r, info, image, "", nil)
reportEvent("file", image, r, "", "", "", info.Path, info, "", nil)
}
}
}
Expand All @@ -90,7 +147,7 @@ func scan(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config
rules, ok = cache.HashRule.Get(info.Sha256)
if ok {
for _, r := range rules {
reportEvent(info.Path, r, info, image, "", nil)
reportEvent("file", image, r, "", "", "", info.Path, info, "", nil)
}
return nil
}
Expand Down Expand Up @@ -155,22 +212,44 @@ func scan(image api.Image, path string, info *veinfs.FileInfo, conf *rule.Config
}

cache.HashRule.SetOrAppend(info.Sha256, r)
reportEvent(path, r, info, image, string(content), []int64{int64(loc[0]), int64(loc[1])})
reportEvent("file", image, r, "", "", "", path, info, string(content), []int64{int64(loc[0]), int64(loc[1])})
}

cache.HashRule.Set(info.Sha256, make(map[int64]rule.Rule))
return nil
}

func reportEvent(path string, r rule.Rule, info *veinfs.FileInfo, image api.Image, contextContent string, contextContentHighlightLocation []int64) {
evt, err := report.GenerateSensitiveFileEvent(path, r, info, image, contextContent, contextContentHighlightLocation)
if err != nil {
log.Error(image.ID(), path, err)
return
}

err = reportService.Client.Report(evt)
if err != nil {
log.Error(image.ID(), path, err)
func reportEvent(eventType string, image api.Image, r rule.Rule, envKey string, envValue string, history string, path string, info *veinfs.FileInfo, contextContent string, contextContentHighlightLocation []int64) {
switch eventType {
case "env":
evt, err := report.GenerateSensitiveEnvEvent(image, r, envKey, envValue)
if err != nil {
log.Error(image.ID(), path, err)
return
}
err = reportService.Client.Report(evt)
if err != nil {
log.Error(image.ID(), path, err)
}
case "history":
evt, err := report.GenerateSensitiveDockerHistoryEvent(image, r, history)
if err != nil {
log.Error(image.ID(), path, err)
return
}
err = reportService.Client.Report(evt)
if err != nil {
log.Error(image.ID(), path, err)
}
case "file":
evt, err := report.GenerateSensitiveFileEvent(image, r, path, info, contextContent, contextContentHighlightLocation)
if err != nil {
log.Error(image.ID(), path, err)
return
}
err = reportService.Client.Report(evt)
if err != nil {
log.Error(image.ID(), path, err)
}
}
}
53 changes: 52 additions & 1 deletion plugins/go/veinmind-sensitive/report/report.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,58 @@ func file2FileDetail(info *veinfs.FileInfo, path string) (event.FileDetail, erro
}, nil
}

func GenerateSensitiveFileEvent(path string, rule rule.Rule, info *veinfs.FileInfo, image api.Image, contextContent string, contextContentHighlightLocation []int64) (*event.Event, error) {
func GenerateSensitiveEnvEvent(image api.Image, rule rule.Rule, envKey string, envValue string) (*event.Event, error) {
r := &event.Event{
BasicInfo: &event.BasicInfo{
ID: image.ID(),
Object: event.NewObject(image),
Source: "veinmind-sensitive",
Time: time.Now(),
Level: localRuleLevel2EventLevel(rule.Level),
DetectType: event.Image,
EventType: event.Risk,
AlertType: event.SensitiveFile,
},
DetailInfo: &event.DetailInfo{
AlertDetail: &event.SensitiveEnvDetail{
SensitiveDetail: event.SensitiveDetail{},
Key: envKey,
Value: envValue,
RuleID: rule.Id,
RuleName: rule.Name,
RuleDescription: rule.Description,
},
},
}
return r, nil
}

func GenerateSensitiveDockerHistoryEvent(image api.Image, rule rule.Rule, history string) (*event.Event, error) {
r := &event.Event{
BasicInfo: &event.BasicInfo{
ID: image.ID(),
Object: event.NewObject(image),
Source: "veinmind-sensitive",
Time: time.Now(),
Level: localRuleLevel2EventLevel(rule.Level),
DetectType: event.Image,
EventType: event.Risk,
AlertType: event.SensitiveFile,
},
DetailInfo: &event.DetailInfo{
AlertDetail: &event.SensitiveDockerHistoryDetail{
SensitiveDetail: event.SensitiveDetail{},
Value: history,
RuleID: rule.Id,
RuleName: rule.Name,
RuleDescription: rule.Description,
},
},
}
return r, nil
}

func GenerateSensitiveFileEvent(image api.Image, rule rule.Rule, path string, info *veinfs.FileInfo, contextContent string, contextContentHighlightLocation []int64) (*event.Event, error) {
fDetail, err := file2FileDetail(info, path)
if err != nil {
return nil, err
Expand Down

0 comments on commit b9848f4

Please sign in to comment.