chore: move signatures into their own top level directory (aquasecuri…

…ty#1231) Resolves: aquasecurity#1220 Resolves: aquasecurity#1229 Resolves: aquasecurity#1199 Signed-off-by: Simar <[email protected]> Signed-off-by: Daniel Pacak <[email protected]> Co-authored-by: Daniel Pacak <[email protected]>
r21gh · Dec 14, 2021 · 936af3f · 936af3f
1 parent 7d083d7
commit 936af3f
Show file tree

Hide file tree

Showing 50 changed files with 43 additions and 32 deletions.
diff --git a/Vagrantfile b/Vagrantfile
@@ -10,6 +10,9 @@ Vagrant.configure("2") do |config|
   end
 
   config.vm.provision "shell", inline: <<-SHELL
+    GO_VERSION="1.16"
+    OPA_VERSION="v0.35.0"
+
     apt-get update
     apt-get install --yes build-essential pkgconf libelf-dev llvm-12 clang-12
 
@@ -22,9 +25,11 @@ Vagrant.configure("2") do |config|
     apt-get install --yes docker.io
     usermod -aG docker vagrant
 
-    wget --quiet https://golang.org/dl/go1.16.linux-amd64.tar.gz
-    tar -C /usr/local -xzf go1.16.linux-amd64.tar.gz
+    wget --quiet https://golang.org/dl/go$GO_VERSION.linux-amd64.tar.gz
+    tar -C /usr/local -xzf go$GO_VERSION.linux-amd64.tar.gz
     echo 'export PATH=$PATH:/usr/local/go/bin' >> /home/vagrant/.profile
+
+    curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/$OPA_VERSION/opa_linux_amd64
+    chmod 755 /usr/bin/opa
   SHELL
 end
-
diff --git a/embedded.go b/embedded.go
@@ -0,0 +1,6 @@
+package tracee
+
+import _ "embed"
+
+//go:embed signatures/rego/helpers.rego
+var RegoHelpersCode string
diff --git a/...les/signatures/golang/examples/example.go → signatures/golang/examples/example.go b/...les/signatures/golang/examples/example.go → signatures/golang/examples/example.go
diff --git a/tracee-rules/signatures/golang/export.go → signatures/golang/export.go b/tracee-rules/signatures/golang/export.go → signatures/golang/export.go
diff --git a/...tures/golang/kubernetes_api_connection.go → ...tures/golang/kubernetes_api_connection.go b/...tures/golang/kubernetes_api_connection.go → ...tures/golang/kubernetes_api_connection.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/helpers"
+	"github.com/aquasecurity/tracee/signatures/helpers"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 )
 

diff --git a/.../golang/kubernetes_api_connection_test.go → .../golang/kubernetes_api_connection_test.go b/.../golang/kubernetes_api_connection_test.go → .../golang/kubernetes_api_connection_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/signaturestest"
+	"github.com/aquasecurity/tracee/signatures/signaturestest"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

diff --git a/...es/signatures/golang/stdio_over_socket.go → signatures/golang/stdio_over_socket.go b/...es/signatures/golang/stdio_over_socket.go → signatures/golang/stdio_over_socket.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/helpers"
+	"github.com/aquasecurity/tracee/signatures/helpers"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 )
 

diff --git a/...gnatures/golang/stdio_over_socket_test.go → signatures/golang/stdio_over_socket_test.go b/...gnatures/golang/stdio_over_socket_test.go → signatures/golang/stdio_over_socket_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/signaturestest"
+	"github.com/aquasecurity/tracee/signatures/signaturestest"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

diff --git a/tracee-rules/signatures/helpers/helpers.go → signatures/helpers/helpers.go b/tracee-rules/signatures/helpers/helpers.go → signatures/helpers/helpers.go
diff --git a/...natures/rego/anti_debugging_ptraceme.rego → signatures/rego/anti_debugging_ptraceme.rego b/...natures/rego/anti_debugging_ptraceme.rego → signatures/rego/anti_debugging_ptraceme.rego
diff --git a/...es/rego/anti_debugging_ptraceme_test.rego → ...es/rego/anti_debugging_ptraceme_test.rego b/...es/rego/anti_debugging_ptraceme_test.rego → ...es/rego/anti_debugging_ptraceme_test.rego
diff --git a/...go/cgroup_release_agent_modification.rego → ...go/cgroup_release_agent_modification.rego b/...go/cgroup_release_agent_modification.rego → ...go/cgroup_release_agent_modification.rego
diff --git a/...roup_release_agent_modification_test.rego → ...roup_release_agent_modification_test.rego b/...roup_release_agent_modification_test.rego → ...roup_release_agent_modification_test.rego
diff --git a/...rules/signatures/rego/code_injection.rego → signatures/rego/code_injection.rego b/...rules/signatures/rego/code_injection.rego → signatures/rego/code_injection.rego
diff --git a/.../signatures/rego/code_injection_test.rego → signatures/rego/code_injection_test.rego b/.../signatures/rego/code_injection_test.rego → signatures/rego/code_injection_test.rego
diff --git a/tracee-rules/signatures/rego/disk_mount.rego → signatures/rego/disk_mount.rego b/tracee-rules/signatures/rego/disk_mount.rego → signatures/rego/disk_mount.rego
diff --git a/...ules/signatures/rego/disk_mount_test.rego → signatures/rego/disk_mount_test.rego b/...ules/signatures/rego/disk_mount_test.rego → signatures/rego/disk_mount_test.rego
diff --git a/...s/signatures/rego/dropped_executable.rego → signatures/rego/dropped_executable.rego b/...s/signatures/rego/dropped_executable.rego → signatures/rego/dropped_executable.rego
diff --git a/...natures/rego/dropped_executable_test.rego → signatures/rego/dropped_executable_test.rego b/...natures/rego/dropped_executable_test.rego → signatures/rego/dropped_executable_test.rego
diff --git a/...signatures/rego/dynamic_code_loading.rego → signatures/rego/dynamic_code_loading.rego b/...signatures/rego/dynamic_code_loading.rego → signatures/rego/dynamic_code_loading.rego
diff --git a/...tures/rego/dynamic_code_loading_test.rego → ...tures/rego/dynamic_code_loading_test.rego b/...tures/rego/dynamic_code_loading_test.rego → ...tures/rego/dynamic_code_loading_test.rego
diff --git a/...s/signatures/rego/fileless_execution.rego → signatures/rego/fileless_execution.rego b/...s/signatures/rego/fileless_execution.rego → signatures/rego/fileless_execution.rego
diff --git a/...natures/rego/fileless_execution_test.rego → signatures/rego/fileless_execution_test.rego b/...natures/rego/fileless_execution_test.rego → signatures/rego/fileless_execution_test.rego
diff --git a/tracee-rules/signatures/rego/helpers.rego → signatures/rego/helpers.rego b/tracee-rules/signatures/rego/helpers.rego → signatures/rego/helpers.rego
diff --git a/...s/signatures/rego/illegitimate_shell.rego → signatures/rego/illegitimate_shell.rego b/...s/signatures/rego/illegitimate_shell.rego → signatures/rego/illegitimate_shell.rego
diff --git a/...natures/rego/illegitimate_shell_test.rego → signatures/rego/illegitimate_shell_test.rego b/...natures/rego/illegitimate_shell_test.rego → signatures/rego/illegitimate_shell_test.rego
diff --git a/...tures/rego/k8s_service_account_token.rego → ...tures/rego/k8s_service_account_token.rego b/...tures/rego/k8s_service_account_token.rego → ...tures/rego/k8s_service_account_token.rego
diff --git a/.../rego/k8s_service_account_token_test.rego → .../rego/k8s_service_account_token_test.rego b/.../rego/k8s_service_account_token_test.rego → .../rego/k8s_service_account_token_test.rego
diff --git a/...ignatures/rego/kernel_module_loading.rego → signatures/rego/kernel_module_loading.rego b/...ignatures/rego/kernel_module_loading.rego → signatures/rego/kernel_module_loading.rego
diff --git a/...ures/rego/kernel_module_loading_test.rego → ...ures/rego/kernel_module_loading_test.rego b/...ures/rego/kernel_module_loading_test.rego → ...ures/rego/kernel_module_loading_test.rego
diff --git a/...kubernetes_certificate_theft_attempt.rego → ...kubernetes_certificate_theft_attempt.rego b/...kubernetes_certificate_theft_attempt.rego → ...kubernetes_certificate_theft_attempt.rego
diff --git a/...netes_certificate_theft_attempt_test.rego → ...netes_certificate_theft_attempt_test.rego b/...netes_certificate_theft_attempt_test.rego → ...netes_certificate_theft_attempt_test.rego
diff --git a/tracee-rules/signatures/rego/ld_preload.rego → signatures/rego/ld_preload.rego b/tracee-rules/signatures/rego/ld_preload.rego → signatures/rego/ld_preload.rego
diff --git a/...ules/signatures/rego/ld_preload_test.rego → signatures/rego/ld_preload_test.rego b/...ules/signatures/rego/ld_preload_test.rego → signatures/rego/ld_preload_test.rego
diff --git a/...gnatures/signaturestest/signaturestest.go → signatures/signaturestest/signaturestest.go b/...gnatures/signaturestest/signaturestest.go → signatures/signaturestest/signaturestest.go
diff --git a/tracee-rules/Dockerfile.builder b/tracee-rules/Dockerfile.builder
@@ -1,4 +1,4 @@
 FROM golang:1.17-buster as builder
 RUN DEBIAN_FRONTEND=noninteractive apt-get update -y && apt-get install -y --no-install-recommends curl && \
-    curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/v0.33.1/opa_linux_amd64 && chmod 755 /usr/bin/opa
+    curl -L -o /usr/bin/opa https://github.com/open-policy-agent/opa/releases/download/v0.35.0/opa_linux_amd64 && chmod 755 /usr/bin/opa
 WORKDIR /tracee
diff --git a/tracee-rules/Makefile b/tracee-rules/Makefile
@@ -8,11 +8,11 @@ OUT_DIR ?= dist
 OUT_BIN := $(OUT_DIR)/tracee-rules
 OUT_RULES := $(OUT_DIR)/rules
 GO_SRC := $(shell find . -type f -name '*.go')
-GOSIGNATURES_DIR ?= signatures/golang
+GOSIGNATURES_DIR ?= ../signatures/golang
 GOSIGNATURES_SRC := $(shell find $(GOSIGNATURES_DIR) -type f -name '*.go' ! -name '*_test.go' ! -path '$(GOSIGNATURES_DIR)/examples/*')
 OUT_GOSIGNATURES := $(OUT_RULES)/builtin.so
-REGO_SIGNATURES_DIR ?= signatures/rego
-REGO_SIGNATURES_SRC := $(shell find $(REGO_SIGNATURES_DIR) -type f -name '*.rego' ! -name '*_test.rego' ! -path '$(REGO_SIGNATURES_DIR)/examples/*')
+REGO_SIGNATURES_DIR ?= ../signatures/rego
+REGO_SIGNATURES_SRC := $(shell find $(REGO_SIGNATURES_DIR) -type f -name '*.rego' ! -name '*_test.rego' ! -path '$(REGO_SIGNATURES_DIR)/examples/*' ! -name 'aio.rego')
 DOCKER_BUILDER ?= tracee-rules-builder
 
 $(OUT_DIR):
@@ -53,7 +53,7 @@ $(tools): % : check_%
 ifndef DOCKER
 test: $(GO_SRC) $(tools)
 	go test $(GOTEST_FLAGS) -v ./...
-	opa test . --verbose --ignore="examples" --ignore="dist" --ignore="benchmark"
+	opa test ../signatures/rego --verbose --ignore="examples" --ignore="dist" --ignore="benchmark"
 else
 test: $(DOCKER_BUILDER)
 	$(call docker_builder_make,$@)

diff --git a/tracee-rules/benchmark/signature/golang/anti_debugging.go b/tracee-rules/benchmark/signature/golang/anti_debugging.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/helpers"
+	"github.com/aquasecurity/tracee/signatures/helpers"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 )
 

diff --git a/tracee-rules/benchmark/signature/golang/code_injection.go b/tracee-rules/benchmark/signature/golang/code_injection.go
@@ -5,7 +5,7 @@ import (
 	"regexp"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/helpers"
+	"github.com/aquasecurity/tracee/signatures/helpers"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 )
 

diff --git a/tracee-rules/benchmark/signature/rego/signatures.go b/tracee-rules/benchmark/signature/rego/signatures.go
@@ -3,10 +3,9 @@ package rego
 import (
 	_ "embed"
 
-	"github.com/open-policy-agent/opa/compile"
-
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/rego/regosig"
+	"github.com/aquasecurity/tracee/tracee-rules/regosig"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
+	"github.com/open-policy-agent/opa/compile"
 )
 
 var (

diff --git a/tracee-rules/signatures/rego/regosig/aio.go → tracee-rules/regosig/aio.go b/tracee-rules/signatures/rego/regosig/aio.go → tracee-rules/regosig/aio.go
diff --git a/...ee-rules/signatures/rego/regosig/aio.rego → tracee-rules/regosig/aio.rego b/...ee-rules/signatures/rego/regosig/aio.rego → tracee-rules/regosig/aio.rego
diff --git a/...rules/signatures/rego/regosig/aio_test.go → tracee-rules/regosig/aio_test.go b/...rules/signatures/rego/regosig/aio_test.go → tracee-rules/regosig/aio_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/rego/regosig"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/signaturestest"
+	"github.com/aquasecurity/tracee/signatures/signaturestest"
+	"github.com/aquasecurity/tracee/tracee-rules/regosig"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 	"github.com/open-policy-agent/opa/compile"
 	"github.com/stretchr/testify/assert"

diff --git a/...es/signatures/rego/regosig/common_test.go → tracee-rules/regosig/common_test.go b/...es/signatures/rego/regosig/common_test.go → tracee-rules/regosig/common_test.go
diff --git a/...e-rules/signatures/rego/regosig/mapper.go → tracee-rules/regosig/mapper.go b/...e-rules/signatures/rego/regosig/mapper.go → tracee-rules/regosig/mapper.go
diff --git a/...es/signatures/rego/regosig/mapper_test.go → tracee-rules/regosig/mapper_test.go b/...es/signatures/rego/regosig/mapper_test.go → tracee-rules/regosig/mapper_test.go
diff --git a/...les/signatures/rego/regosig/traceerego.go → tracee-rules/regosig/traceerego.go b/...les/signatures/rego/regosig/traceerego.go → tracee-rules/regosig/traceerego.go
diff --git a/...ignatures/rego/regosig/traceerego_test.go → tracee-rules/regosig/traceerego_test.go b/...ignatures/rego/regosig/traceerego_test.go → tracee-rules/regosig/traceerego_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 
 	tracee "github.com/aquasecurity/tracee/pkg/external"
+	"github.com/aquasecurity/tracee/signatures/signaturestest"
 	"github.com/aquasecurity/tracee/tracee-rules/engine"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/rego/regosig"
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/signaturestest"
+	"github.com/aquasecurity/tracee/tracee-rules/regosig"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 	"github.com/open-policy-agent/opa/compile"
 	"github.com/stretchr/testify/assert"

diff --git a/tracee-rules/signature.go b/tracee-rules/signature.go
@@ -1,9 +1,9 @@
 package main
 
 import (
-	"bytes"
 	_ "embed"
 
+	"bytes"
 	"io/fs"
 	"io/ioutil"
 	"log"
@@ -12,13 +12,11 @@ import (
 	"plugin"
 	"strings"
 
-	"github.com/aquasecurity/tracee/tracee-rules/signatures/rego/regosig"
+	embedded "github.com/aquasecurity/tracee"
+	"github.com/aquasecurity/tracee/tracee-rules/regosig"
 	"github.com/aquasecurity/tracee/tracee-rules/types"
 )
 
-//go:embed signatures/rego/helpers.rego
-var regoHelpersCode string
-
 func getSignatures(target string, partialEval bool, rulesDir string, rules []string, aioEnabled bool) ([]types.Signature, error) {
 	if rulesDir == "" {
 		exePath, err := os.Executable()
@@ -81,9 +79,9 @@ func findGoSigs(dir string) ([]types.Signature, error) {
 
 func findRegoSigs(target string, partialEval bool, dir string, aioEnabled bool) ([]types.Signature, error) {
 	modules := make(map[string]string)
-	modules["helper.rego"] = regoHelpersCode
+	modules["helper.rego"] = embedded.RegoHelpersCode
 
-	regoHelpers := []string{regoHelpersCode}
+	regoHelpers := []string{embedded.RegoHelpersCode}
 	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err

diff --git a/tracee-rules/signature_test.go b/tracee-rules/signature_test.go
@@ -9,15 +9,18 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/open-policy-agent/opa/compile"
-
 	"github.com/aquasecurity/tracee/tracee-rules/types"
+	"github.com/open-policy-agent/opa/compile"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+const (
+	exampleRulesDir = "../signatures/rego"
+)
+
 func Test_getSignatures(t *testing.T) {
-	sigs, err := getSignatures(compile.TargetRego, false, "signatures/rego", []string{"TRC-2"}, false)
+	sigs, err := getSignatures(compile.TargetRego, false, exampleRulesDir, []string{"TRC-2"}, false)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(sigs))
 
@@ -104,7 +107,7 @@ func copyExampleSig(exampleName, destDir string) error {
 	var exampleDir string
 	extension := filepath.Ext(exampleName)
 	if extension == ".rego" {
-		exampleDir = "signatures/rego/%s"
+		exampleDir = fmt.Sprint(exampleRulesDir + "/%s")
 	} else {
 		return errors.New("unsupported signature type")
 	}