Skip to content

Commit 6787bc6

Browse files
IgorEulalioIgorEulalio
authored
Kill Process Runtime Policies Support (#531)
* add support for kill_process * add docs for kill_process * fix lint
1 parent a0d6eed commit 6787bc6

File tree

6 files changed

+69
-13
lines changed

6 files changed

+69
-13
lines changed

‎sysdig/data_source_sysdig_secure_policy.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,11 @@ func createPolicyDataSourceSchema() map[string]*schema.Schema {
8080
Optional: true,
8181
Computed: true,
8282
},
83+
"kill_process": {
84+
Type: schema.TypeString,
85+
Optional: true,
86+
Computed: true,
87+
},
8388
"capture": {
8489
Type: schema.TypeList,
8590
Optional: true,
@@ -137,11 +142,9 @@ func policyDataSourceToResourceData(policy v2.Policy, d *schema.ResourceData) {
137142
_ = d.Set("runbook", policy.Runbook)
138143

139144
actions := []map[string]interface{}{{}}
145+
140146
for _, action := range policy.Actions {
141-
if action.Type != "POLICY_ACTION_CAPTURE" {
142-
action := strings.Replace(action.Type, "POLICY_ACTION_", "", 1)
143-
actions[0]["container"] = strings.ToLower(action)
144-
} else {
147+
if action.Type == "POLICY_ACTION_CAPTURE" {
145148
actions[0]["capture"] = []map[string]interface{}{{
146149
"seconds_after_event": action.AfterEventNs / 1000000000,
147150
"seconds_before_event": action.BeforeEventNs / 1000000000,
@@ -150,6 +153,12 @@ func policyDataSourceToResourceData(policy v2.Policy, d *schema.ResourceData) {
150153
"bucket_name": action.BucketName,
151154
"folder": action.Folder,
152155
}}
156+
157+
} else if action.Type == "POLICY_ACTION_KILL_PROCESS" {
158+
actions[0]["kill_process"] = "true"
159+
} else {
160+
action := strings.Replace(action.Type, "POLICY_ACTION_", "", 1)
161+
actions[0]["container"] = strings.ToLower(action)
153162
}
154163
}
155164

‎sysdig/resource_sysdig_secure_custom_policy_test.go

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ func TestAccCustomPolicy(t *testing.T) {
4848
{
4949
Config: customPoliciesWithDisabledRules(rText()),
5050
},
51+
{
52+
Config: customPoliciesWithKillProcessAction(rText()),
53+
},
5154
}
5255

5356
if !buildinfo.OnpremSecure {
@@ -222,8 +225,8 @@ resource "sysdig_secure_custom_policy" "sample_%d" {
222225

223226
func customPoliciesWithKillAction(name string) (res string) {
224227
return fmt.Sprintf(`
225-
resource "sysdig_secure_custom_policy" "sample" {
226-
name = "TERRAFORM TEST 1 %s"
228+
resource "sysdig_secure_custom_policy" "sample10" {
229+
name = "TERRAFORM TEST 10 %s"
227230
description = "TERRAFORM TEST %s"
228231
enabled = true
229232
severity = 4
@@ -241,6 +244,27 @@ resource "sysdig_secure_custom_policy" "sample" {
241244
`, name, name)
242245
}
243246

247+
func customPoliciesWithKillProcessAction(name string) (res string) {
248+
return fmt.Sprintf(`
249+
resource "sysdig_secure_custom_policy" "sample10" {
250+
name = "TERRAFORM TEST 1 %s"
251+
description = "TERRAFORM TEST %s"
252+
enabled = true
253+
severity = 4
254+
scope = "container.id != \"\""
255+
256+
rules {
257+
name = "Terminal shell in container"
258+
enabled = true
259+
}
260+
261+
actions {
262+
kill_process = "true"
263+
}
264+
}
265+
`, name, name)
266+
}
267+
244268
func customPoliciesForAWSCloudtrail(name string) string {
245269
return fmt.Sprintf(`
246270
resource "sysdig_secure_custom_policy" "sample4" {

‎sysdig/resource_sysdig_secure_policy.go

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -121,11 +121,7 @@ func commonPolicyToResourceData(policy *v2.Policy, d *schema.ResourceData) {
121121

122122
actions := []map[string]interface{}{{}}
123123
for _, action := range policy.Actions {
124-
if action.Type != "POLICY_ACTION_CAPTURE" {
125-
action := strings.Replace(action.Type, "POLICY_ACTION_", "", 1)
126-
actions[0]["container"] = strings.ToLower(action)
127-
// d.Set("actions.0.container", strings.ToLower(action))
128-
} else {
124+
if action.Type == "POLICY_ACTION_CAPTURE" {
129125
actions[0]["capture"] = []map[string]interface{}{{
130126
"seconds_after_event": action.AfterEventNs / 1000000000,
131127
"seconds_before_event": action.BeforeEventNs / 1000000000,
@@ -134,6 +130,12 @@ func commonPolicyToResourceData(policy *v2.Policy, d *schema.ResourceData) {
134130
"bucket_name": action.BucketName,
135131
"folder": action.Folder,
136132
}}
133+
134+
} else if action.Type == "POLICY_ACTION_KILL_PROCESS" {
135+
actions[0]["kill_process"] = true
136+
} else {
137+
action := strings.Replace(action.Type, "POLICY_ACTION_", "", 1)
138+
actions[0]["container"] = strings.ToLower(action)
137139
}
138140
}
139141

@@ -214,6 +216,11 @@ func addActionsToPolicy(d *schema.ResourceData, policy *v2.Policy) {
214216
policy.Actions = append(policy.Actions, v2.Action{Type: "POLICY_ACTION_PREVENT_MALWARE"})
215217
}
216218

219+
killProcessAction, ok := d.GetOk("actions.0.kill_process")
220+
if ok && killProcessAction.(bool) {
221+
policy.Actions = append(policy.Actions, v2.Action{Type: "POLICY_ACTION_KILL_PROCESS"})
222+
}
223+
217224
containerAction := d.Get("actions.0.container").(string)
218225
if containerAction != "" {
219226
containerAction = strings.ToUpper("POLICY_ACTION_" + containerAction)

‎sysdig/schema.go

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,14 @@ func ContainerActionSchema() *schema.Schema {
205205
}
206206
}
207207

208+
func ContainerKillProcessActionSchema() *schema.Schema {
209+
return &schema.Schema{
210+
Type: schema.TypeBool,
211+
Optional: true,
212+
Default: false,
213+
}
214+
}
215+
208216
func ContainerActionComputedSchema() *schema.Schema {
209217
return &schema.Schema{
210218
Type: schema.TypeString,
@@ -448,8 +456,9 @@ func createPolicySchema(original map[string]*schema.Schema) map[string]*schema.S
448456
Optional: true,
449457
Elem: &schema.Resource{
450458
Schema: map[string]*schema.Schema{
451-
"container": ContainerActionSchema(),
452-
"capture": CaptureActionSchema(),
459+
"container": ContainerActionSchema(),
460+
"kill_process": ContainerKillProcessActionSchema(),
461+
"capture": CaptureActionSchema(),
453462
},
454463
},
455464
},

‎website/docs/d/secure_custom_policy.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ The actions block is optional and supports:
5858
triggered. Can be *stop*, *pause* or *kill*. If this is not specified,
5959
no action will be applied at the container level.
6060

61+
* `kill_process` - (Optional) Whether to kill the process that triggered the rule.
62+
If this is not specified,
63+
no action will be applied at the process level.
64+
6165
* `capture` - (Optional) Captures with Sysdig the stream of system calls:
6266
* `seconds_before_event` - (Required) Captures the system calls during the
6367
amount of seconds before the policy was triggered.

‎website/docs/r/secure_custom_policy.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ The actions block is optional and supports:
8181
triggered. Can be *stop*, *pause* or *kill*. If this is not specified,
8282
no action will be applied at the container level.
8383

84+
* `kill_process` - (Optional) Whether to kill the process that triggered the rule.
85+
If this is not specified,
86+
no action will be applied at the process level.
8487
* `capture` - (Optional) Captures with Sysdig the stream of system calls:
8588
* `seconds_before_event` - (Required) Captures the system calls during the
8689
amount of seconds before the policy was triggered.

0 commit comments

Comments
 (0)