Linux support

[winson0123]

Long awaited Linux support.

Description of how behavioral information is captured by Linux Machines:

• strace is used to detonate the malware sample, and the logs are captured and uploaded to the host.
• Strace logs are processed and outputted similarly to how the current implementation of windows behaviors are.
• Strace information is stored onto the "behaviors" key in the CAPE report json (like how Windows would)
• Information is fetched and retrieved from the database and is displayed on the behavioral tab
• Behavioral tab showcases all the syscalls that are called by each process that is spawned by the sample
• Syscalls are filtered by the root of the kernel source code (mm, fs, crypto, etc)
• Small hiccup we've encountered running ransomware samples, it encrypts the strace log and prevents us from processing the logs for behavioral analysis

Database changes:

• Adds the column platform to the guests table in PostgreSQL
• Required to run alembic migrations

Future work:

• More signaturization for Linux samples is possible

[doomedraven]

hello amazing job on this, i got first quick look, i will check properly a bit later. but so far looks good, i have a question, to prevent ransom encrypt logs, maybe we should stream the strace log to the server side? it sound to me that we had something for that i will have to double check

[nbargnesi]

And well-timed with the ability to run tests against the analyzer and agent! (CC @rkoumis )

[winson0123]

hello amazing job on this, i got first quick look, i will check properly a bit later. but so far looks good, i have a question, to prevent ransom encrypt logs, maybe we should stream the strace log to the server side? it sound to me that we had something for that i will have to double check

I'll probably take a look into this next week, that suggestion does sound better to circumvent the encryption issue. Probably something along the lines of piping the output on the agent and streaming to the server side.

[kevoreilly]

Thank you ❤️

[nbargnesi]

hello amazing job on this, i got first quick look, i will check properly a bit later. but so far looks good, i have a question, to prevent ransom encrypt logs, maybe we should stream the strace log to the server side? it sound to me that we had something for that i will have to double check

I'll probably take a look into this next week, that suggestion does sound better to circumvent the encryption issue. Probably something along the lines of piping the output on the agent and streaming to the server side.

This is a great PR as-is. It'd be great to have it merge even without addressing this.

[doomedraven]

i have one question, is not related to fully related to this PR, but as we nuke stap, we need to remove it from the .conf maybe we should already nuke all not .conf.default as we touch already one we can delete directly it maybe as it will be overwritten anyway on install, any thoughts to help me decide the proper way?