Add FIM option 'allow_prefilter_cmd'

[bah07]

Related issue
No issue related

Description

This PR adds an option to enable or disable the prefilter_cmd option. This option only can be set from ossec.conf on the agent side.

Configuration options

There are two values allowed, yes and no. By default is set to no.

# ossec.conf
<syscheck>
    <allow_prefilter_cmd>yes</allow_prefilter_cmd>
    <prefilter_cmd>/bin/cat</prefilter_cmd>
</syscheck>

Logs/Alerts example

If it is configured in agent.conf on the manager side, a warning message is displayed indicating that the value will not be set.

ossec-syscheckd: WARNING: 'allow_prefilter_cmd' option can't be set from the manager.

Configuration on demand from API request:

curl -u foo:bar -k -X GET "http://127.0.0.1:55000/agents/001/config/syscheck/syscheck?pretty"

{
   "error": 0,
   "data": {
      "syscheck": {
         ...
         "allow_prefilter_cmd": "yes",
         "prefilter_cmd": "/bin/cat"
      }
   }
}

Tests

Valgrind report:

==27885== LEAK SUMMARY:
==27885==    definitely lost: 0 bytes in 0 blocks
==27885==    indirectly lost: 0 bytes in 0 blocks
==27885==      possibly lost: 1,120 bytes in 2 blocks
==27885==    still reachable: 52,955 bytes in 60 blocks
==27885==         suppressed: 0 bytes in 0 blocks
==27885== Reachable blocks (those to which a pointer was found) are not shown.
==27885== To see them, rerun with: --leak-check=full --show-leak-kinds=all

scan-build results don't show any bugs in files modified:

src/config/config.c
src/config/config.h
src/config/syscheck-config.c
src/config/syscheck-config.h
src/syscheckd/config.c
src/syscheckd/syscheck.c

• Compilation without warnings in every supported platform
  • Linux
  • Windows
  • MAC OS X
• Source installation
• Package installation
• Source upgrade
• Package upgrade
• Review logs syntax and correct language
• QA templates contemplate the added capabilities

• Memory tests for Linux
  • Scan-build report
  • Coverity
  • Valgrind (memcheck and descriptor leaks check)
  • Dr. Memory
  • AddressSanitizer
• Memory tests for Windows
  • Scan-build report
  • Coverity
  • Dr. Memory
• Memory tests for macOS
  • Scan-build report
  • Leaks
  • AddressSanitizer

• Retrocompatibility with older Wazuh versions
• Working on cluster environments
• Configuration on demand reports new parameters
• The data flow works as expected (agent-manager-api-app)
• Added unit tests (for new features)
• Stress test for affected components

[sergiovp]

Testing OS	Target
CentOS 7	Manager/Agent

• Installation without warnings
• No error logs
• Agent registration
• Valgrind test:

==26129== LEAK SUMMARY:
==26129==    definitely lost: 0 bytes in 0 blocks
==26129==    indirectly lost: 0 bytes in 0 blocks
==26129==      possibly lost: 1,120 bytes in 2 blocks
==26129==    still reachable: 912,902 bytes in 14,810 blocks
==26129==         suppressed: 0 bytes in 0 blocks
==26129== Rerun with --leak-check=full to see details of leaked memory
==26129== 
==26129== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==26129== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

• Scan-build test. It does't report any bug in files modified.

Test001

• ossec.conf on the agent side:

<allow_prefilter_cmd>yes</allow_prefilter_cmd>
<prefilter_cmd>/bin/cat</prefilter_cmd>

• agent.conf on the manager side:

<allow_prefilter_cmd>no</allow_prefilter_cmd>
<prefilter_cmd>/bin/cat</prefilter_cmd>

• Losg:

root@ManagerCentOS7:/var/ossec/etc/shared/default$ /var/ossec/bin/verify-agent-conf

verify-agent-conf: Verifying [/var/ossec/etc/shared/default/agent.conf]
2019/11/05 10:24:07 verify-agent-conf: WARNING: 'allow_prefilter_cmd' option can't be changed using centralized configuration (agent.conf).
verify-agent-conf: OK

2019/11/05 10:29:07 ossec-syscheckd: WARNING: 'allow_prefilter_cmd' option can't be changed using centralized configuration (agent.conf).

It worked as expected.

Test 002

• agent.conf on the manager side:

<prefilter_cmd>/bin/cat</prefilter_cmd>

• Log:
  We don't see any Warning.

It worked as expected.

Test003

• ossec.conf on the agent side:

 <syscheck>
    <disabled>yes</disabled>
    <allow_prefilter_cmd>yes</allow_prefilter_cmd>
    <prefilter_cmd>/bin/cat</prefilter_cmd>

• agent.conf on the manager side:

  <syscheck>
        <allow_prefilter_cmd>yes</allow_prefilter_cmd>
        <prefilter_cmd>/usr/bin/</prefilter_cmd>
  </syscheck>

Even though syscheck is disabled on the agent, we still see the warning:

2019/11/05 11:06:04 ossec-syscheckd: WARNING: 'allow_prefilter_cmd' option can't be changed using centralized configuration (agent.conf).

It worked as expected.

Test004

• ossec.conf on the agent side:

<allow_prefilter_cmd>ye</allow_prefilter_cmd>

<prefilter_cmd>lkja</prefilter_cmd>

• Logs:

2019/11/05 11:10:29 ossec-syscheckd: ERROR: (1235): Invalid value for element 'allow_prefilter_cmd': ye.
2019/11/05 11:10:29 ossec-syscheckd: ERROR: (1202): Configuration error at '/var/ossec/etc/ossec.conf'.
2019/11/05 11:10:29 ossec-syscheckd: CRITICAL: (1202): Configuration error at '/var/ossec/etc/ossec.conf'.

2019/11/05 11:12:45 ossec-syscheckd: ERROR: (1235): Invalid value for element 'prefilter_cmd': lkja.
2019/11/05 11:12:45 ossec-syscheckd: ERROR: (1202): Configuration error at '/var/ossec/etc/ossec.conf'.
2019/11/05 11:12:45 ossec-syscheckd: CRITICAL: (1202): Configuration error at '/var/ossec/etc/ossec.conf'.

The path specified in prefilter_cmd must exists, even though allow_prefilter_cmd is disabled.

It worked as expected.

Test005

• ossec.conf on the ,anager side:

<allow_prefilter_cmd>no</allow_prefilter_cmd>
<prefilter_cmd>/usr/bin/</prefilter_cmd>

It worked as expected.

• Logs:

2019/11/05 11:21:09 ossec-syscheckd: WARNING: Ignoring prefilter option '/usr/bin/'. Enable <allow_prefilter_option> to use it.

It warns us that prefilter_cmd is ignored.

Test006

• ossec.conf on the agent side:

<allow_prefilter_cmd>no</allow_prefilter_cmd>
<prefilter_cmd>/home</prefilter_cmd>

• Logs:

2019/11/05 11:27:55 ossec-syscheckd: WARNING: Ignoring prefilter option '/home'. Enable <allow_prefilter_option> to use it.

If we change prefilter_cmd path in the agent.conf on the manager side:

2019/11/05 11:30:19 ossec-syscheckd: WARNING: Ignoring prefilter option '/usr/bin/'. Enable <allow_prefilter_option> to use it.

It worked as expected.