[CWS] Embed multiple default policies on windows#35343
[CWS] Embed multiple default policies on windows#35343dd-mergequeue[bot] merged 5 commits intomainfrom
Conversation
mftoure
added
changelog/no-changelog
team/agent-security
qa/done
| if ENV['WINDOWS_DDPROCMON_DRIVER'] and not ENV['WINDOWS_DDPROCMON_DRIVER'].empty? and not windows_arch_i386? | ||
| move "#{install_dir}/etc/datadog-agent/security-agent.yaml.example", conf_dir_root, :force=>true | ||
| move "#{install_dir}/etc/datadog-agent/runtime-security.d", conf_dir_root, :force=>true | ||
| move "#{conf_dir_root}/runtime-security.d/default.policy", "#{conf_dir_root}/runtime-security.d/default.policy.example", :force=>true |
There was a problem hiding this comment.
Don't we risk overriding customers' default.policy file if they contain modifications?
I'm not familiar at all with these files, so please forgive the question if it's silly
There was a problem hiding this comment.
Customers are expected to create additional policy files if they want to create their rules.
This behaviour (risk to override the default.policy ) was the same before this PR.
There was a problem hiding this comment.
Previously the MSI custom action would only copy default.policy.example to default.policy if it does not already exist.
There was a problem hiding this comment.
If it copied only if default.policy did not exist, It would not be possible to update the policy. So I think it was a mistake
| if ENV['WINDOWS_DDPROCMON_DRIVER'] and not ENV['WINDOWS_DDPROCMON_DRIVER'].empty? and not windows_arch_i386? | ||
| move "#{install_dir}/etc/datadog-agent/security-agent.yaml.example", conf_dir_root, :force=>true | ||
| move "#{install_dir}/etc/datadog-agent/runtime-security.d", conf_dir_root, :force=>true | ||
| move "#{conf_dir_root}/runtime-security.d/default.policy", "#{conf_dir_root}/runtime-security.d/default.policy.example", :force=>true |
There was a problem hiding this comment.
Previously the MSI custom action would only copy default.policy.example to default.policy if it does not already exist.
tools/windows/DatadogAgentInstaller/WixSetup/Datadog Agent/AgentInstaller.cs
Show resolved
Hide resolved
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
dd-mergequeue
bot
deleted the
momar/support-embedded-multi-policies-windows
branch
4 participants
What does this PR do?
This PR enables embedding multiple default policies on windows, not just the default.policy file.
Motivation
Describe how you validated your changes
Possible Drawbacks / Trade-offs
Additional Notes