Skip to content

Commit e856535

Browse files
ombellaretembleking
ombellare
and
tembleking
authored
feat(secure-policies): support new and fix existing fields in malware policy (#657)
* feat(secure-policies): support new fields in drift policy (#656) * Add support for additional secure drift policy fields * Address review comments * Fixed spacing issue --------- Co-authored-by: Fede Barcelona <fede_rico_94@hotmail.com> * Revert changes to drift test files * Revert test changes and add test for new fields support * Revert test change * Fix compile issue * Fix test issue * Update resource and data names in malware policy test Renamed resource from 'policy_1' to 'policy_3' and data source from 'policy_2' to 'policy_4' in malware policy test to improve clarity and avoid naming conflicts. * Migration document * Fix document issue * Fix docs to add new section --------- Co-authored-by: Fede Barcelona <fede_rico_94@hotmail.com>
1 parent c98830f commit e856535

9 files changed

+214
-65
lines changed

‎sysdig/data_source_sysdig_secure_malware_policy.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,11 @@ func createMalwarePolicyDataSourceSchema() map[string]*schema.Schema {
5757
"tags": TagsSchema(),
5858
"version": VersionSchema(),
5959
"use_managed_hashes": BoolComputedSchema(),
60-
"additional_hashes": HashesComputedSchema(),
61-
"ignore_hashes": HashesComputedSchema(),
60+
"use_yara_rules": BoolComputedSchema(),
61+
"additional_hashes": StringListComputedSchema(),
62+
"ignore_hashes": StringListComputedSchema(),
63+
"use_regex": BoolComputedSchema(),
64+
"ignore_paths": StringListComputedSchema(),
6265
},
6366
},
6467
},

‎sysdig/data_source_sysdig_secure_malware_policy_test.go

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ func TestAccMalwarePolicyDataSource(t *testing.T) {
3232
{
3333
Config: malwarePolicyDataSource(rText),
3434
},
35+
{
36+
Config: malwarePolicyWithAdditionalFieldsDataSource(rText),
37+
},
3538
},
3639
})
3740
}
@@ -49,13 +52,13 @@ resource "sysdig_secure_malware_policy" "policy_1" {
4952
5053
use_managed_hashes = true
5154
52-
additional_hashes {
53-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
54-
}
55+
additional_hashes = [
56+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
57+
]
5558
56-
ignore_hashes {
57-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
58-
}
59+
ignore_hashes = [
60+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
61+
]
5962
}
6063
6164
actions {
@@ -69,3 +72,38 @@ data "sysdig_secure_malware_policy" "policy_2" {
6972
}
7073
`, name, name)
7174
}
75+
76+
func malwarePolicyWithAdditionalFieldsDataSource(name string) string {
77+
return fmt.Sprintf(`
78+
resource "sysdig_secure_malware_policy" "policy_3" {
79+
name = "Test Malware Policy 2 %s"
80+
description = "Test Malware Policy Description %s"
81+
enabled = true
82+
severity = 4
83+
84+
rule {
85+
description = "Test Malware Rule Description"
86+
87+
use_managed_hashes = true
88+
use_yara_rules = true
89+
use_regex = true
90+
91+
additional_hashes = [
92+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6",
93+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae7"
94+
]
95+
96+
ignore_hashes = [
97+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e",
98+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0f"
99+
]
100+
101+
ignore_paths = ["/usr/bin/curl", "/usr/bin/sh"]
102+
}
103+
}
104+
105+
data "sysdig_secure_malware_policy" "policy_4" {
106+
name = sysdig_secure_malware_policy.policy_3.name
107+
}
108+
`, name, name)
109+
}

‎sysdig/internal/client/v2/model.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,8 +397,11 @@ func (p MLRuleDetails) GetRuleType() ElementType {
397397
type MalwareRuleDetails struct {
398398
RuleType ElementType `json:"ruleType"`
399399
UseManagedHashes bool `json:"useManagedHashes"`
400+
UseYaraRules bool `json:"usePolymorphicRules"`
400401
AdditionalHashes map[string][]string `json:"additionalHashes"`
401402
IgnoreHashes map[string][]string `json:"ignoreHashes"`
403+
UseRegex bool `json:"useRegex"`
404+
IgnorePaths map[string][]string `json:"ignorePaths"`
402405
Details `json:"-"`
403406
}
404407

‎sysdig/resource_sysdig_secure_malware_policy.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ func resourceSysdigSecureMalwarePolicy() *schema.Resource {
5454
"rule": {
5555
Type: schema.TypeList,
5656
Required: true,
57+
MaxItems: 1,
5758
Elem: &schema.Resource{
5859
Schema: map[string]*schema.Schema{
5960
"id": ReadOnlyIntSchema(),
@@ -64,8 +65,11 @@ func resourceSysdigSecureMalwarePolicy() *schema.Resource {
6465
"tags": TagsSchema(),
6566
"version": VersionSchema(),
6667
"use_managed_hashes": BoolSchema(),
67-
"additional_hashes": HashesSchema(),
68-
"ignore_hashes": HashesSchema(),
68+
"use_yara_rules": BoolSchema(),
69+
"additional_hashes": StringListSchema(),
70+
"ignore_hashes": StringListSchema(),
71+
"use_regex": BoolSchema(),
72+
"ignore_paths": StringListSchema(),
6973
},
7074
},
7175
},

‎sysdig/resource_sysdig_secure_malware_policy_test.go

Lines changed: 65 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ func TestAccMalwarePolicy(t *testing.T) {
4242
{
4343
Config: malwarePolicyWithoutNotificationChannel(rText()),
4444
},
45+
{
46+
Config: malwarePolicyWithAdditionalFields(rText()),
47+
},
4548
},
4649
})
4750
}
@@ -61,13 +64,13 @@ resource "sysdig_secure_malware_policy" "sample" {
6164
6265
use_managed_hashes = true
6366
64-
additional_hashes {
65-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
66-
}
67+
additional_hashes = [
68+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
69+
]
6770
68-
ignore_hashes {
69-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
70-
}
71+
ignore_hashes = [
72+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
73+
]
7174
}
7275
7376
actions {
@@ -96,9 +99,9 @@ resource "sysdig_secure_malware_policy" "sample" {
9699
97100
use_managed_hashes = true
98101
99-
ignore_hashes {
100-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
101-
}
102+
ignore_hashes = [
103+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
104+
]
102105
}
103106
104107
actions {
@@ -127,9 +130,9 @@ resource "sysdig_secure_malware_policy" "sample" {
127130
128131
use_managed_hashes = true
129132
130-
additional_hashes {
131-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
132-
}
133+
additional_hashes = [
134+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
135+
]
133136
}
134137
135138
actions {
@@ -183,13 +186,13 @@ resource "sysdig_secure_malware_policy" "sample" {
183186
184187
use_managed_hashes = true
185188
186-
additional_hashes {
187-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
188-
}
189+
additional_hashes = [
190+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
191+
]
189192
190-
ignore_hashes {
191-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
192-
}
193+
ignore_hashes = [
194+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
195+
]
193196
}
194197
195198
actions {
@@ -222,13 +225,51 @@ resource "sysdig_secure_malware_policy" "sample" {
222225
223226
use_managed_hashes = true
224227
225-
additional_hashes {
226-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
227-
}
228+
additional_hashes = [
229+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
230+
]
228231
229-
ignore_hashes {
230-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
231-
}
232+
ignore_hashes = [
233+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
234+
]
235+
}
236+
237+
actions {
238+
prevent_malware = true
239+
container = "stop"
240+
}
241+
242+
}
243+
244+
`, name)
245+
}
246+
247+
func malwarePolicyWithAdditionalFields(name string) string {
248+
return fmt.Sprintf(`
249+
resource "sysdig_secure_malware_policy" "sample" {
250+
name = "Test Malware Policy %s"
251+
description = "Test Malware Policy Description"
252+
enabled = true
253+
severity = 4
254+
255+
rule {
256+
description = "Test Malware Rule Description"
257+
258+
use_managed_hashes = true
259+
use_yara_rules = true
260+
use_regex = true
261+
262+
additional_hashes = [
263+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6",
264+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae7"
265+
]
266+
267+
ignore_hashes = [
268+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e",
269+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0f"
270+
]
271+
272+
ignore_paths = ["/usr/bin/curl", "/usr/bin/sh"]
232273
}
233274
234275
actions {

‎sysdig/schema.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,26 @@ func HashesComputedSchema() *schema.Schema {
326326
}
327327
}
328328

329+
func StringListSchema() *schema.Schema {
330+
return &schema.Schema{
331+
Type: schema.TypeList,
332+
Optional: true,
333+
Elem: &schema.Schema{
334+
Type: schema.TypeString,
335+
},
336+
}
337+
}
338+
339+
func StringListComputedSchema() *schema.Schema {
340+
return &schema.Schema{
341+
Type: schema.TypeList,
342+
Computed: true,
343+
Elem: &schema.Schema{
344+
Type: schema.TypeString,
345+
},
346+
}
347+
}
348+
329349
func TagsSchema() *schema.Schema {
330350
// Tags are always set automatically by Sysdig
331351
return &schema.Schema{

‎sysdig/tfresource.go

Lines changed: 36 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package sysdig
22

33
import (
44
"errors"
5+
"slices"
56
"strconv"
67
"strings"
78

@@ -109,29 +110,38 @@ func setTFResourcePolicyRulesMalware(d *schema.ResourceData, policy v2.PolicyRul
109110

110111
rules := []map[string]any{}
111112
for _, rule := range policy.Rules {
112-
additionalHashes := []map[string]any{}
113-
for k := range rule.Details.(*v2.MalwareRuleDetails).AdditionalHashes {
114-
additionalHashes = append(additionalHashes, map[string]any{
115-
"hash": k,
116-
})
113+
malwareRuleDetails := rule.Details.(*v2.MalwareRuleDetails)
114+
115+
additionalHashes := []string{}
116+
for k := range malwareRuleDetails.AdditionalHashes {
117+
additionalHashes = append(additionalHashes, k)
118+
}
119+
slices.Sort(additionalHashes)
120+
121+
ignoreHashes := []string{}
122+
for k := range malwareRuleDetails.IgnoreHashes {
123+
ignoreHashes = append(ignoreHashes, k)
117124
}
125+
slices.Sort(ignoreHashes)
118126

119-
ignoreHashes := []map[string]any{}
120-
for k := range rule.Details.(*v2.MalwareRuleDetails).IgnoreHashes {
121-
ignoreHashes = append(ignoreHashes, map[string]any{
122-
"hash": k,
123-
})
127+
ignorePaths := []string{}
128+
for k := range malwareRuleDetails.IgnorePaths {
129+
ignorePaths = append(ignorePaths, k)
124130
}
131+
slices.Sort(ignorePaths)
125132

126133
rules = append(rules, map[string]any{
127134
"id": rule.ID,
128135
"name": rule.Name,
129136
"description": rule.Description,
130137
"version": rule.Version,
131138
"tags": rule.Tags,
132-
"use_managed_hashes": rule.Details.(*v2.MalwareRuleDetails).UseManagedHashes,
139+
"use_managed_hashes": malwareRuleDetails.UseManagedHashes,
140+
"use_yara_rules": malwareRuleDetails.UseYaraRules,
133141
"additional_hashes": additionalHashes,
134142
"ignore_hashes": ignoreHashes,
143+
"use_regex": malwareRuleDetails.UseRegex,
144+
"ignore_paths": ignorePaths,
135145
})
136146
}
137147

@@ -420,19 +430,17 @@ func setPolicyRulesMalware(policy *v2.PolicyRulesComposite, d *schema.ResourceDa
420430
additionalHashes := map[string][]string{}
421431
if items, ok := d.GetOk("rule.0.additional_hashes"); ok { // TODO: Do not hardcode the indexes
422432
for _, item := range items.([]any) {
423-
item := item.(map[string]any)
424-
k := item["hash"].(string)
425-
additionalHashes[k] = []string{}
433+
hash := item.(string)
434+
additionalHashes[hash] = []string{}
426435
}
427436
}
428437

429438
// TODO: Extract into a function
430439
ignoreHashes := map[string][]string{}
431440
if items, ok := d.GetOk("rule.0.ignore_hashes"); ok { // TODO: Do not hardcode the indexes
432441
for _, item := range items.([]any) {
433-
item := item.(map[string]any)
434-
k := item["hash"].(string)
435-
ignoreHashes[k] = []string{}
442+
hash := item.(string)
443+
ignoreHashes[hash] = []string{}
436444
}
437445
}
438446

@@ -442,6 +450,14 @@ func setPolicyRulesMalware(policy *v2.PolicyRulesComposite, d *schema.ResourceDa
442450
tags = []string{defaultMalwareTag}
443451
}
444452

453+
ignorePaths := map[string][]string{}
454+
if items, ok := d.GetOk("rule.0.ignore_paths"); ok { // TODO: Do not hardcode the indexes
455+
for _, item := range items.([]any) {
456+
path := item.(string)
457+
ignorePaths[path] = []string{}
458+
}
459+
}
460+
445461
rule := &v2.RuntimePolicyRule{
446462
// TODO: Do not hardcode the indexes
447463
Name: d.Get("rule.0.name").(string),
@@ -450,8 +466,11 @@ func setPolicyRulesMalware(policy *v2.PolicyRulesComposite, d *schema.ResourceDa
450466
Details: v2.MalwareRuleDetails{
451467
RuleType: v2.ElementType("MALWARE"), // TODO: Use const
452468
UseManagedHashes: d.Get("rule.0.use_managed_hashes").(bool),
469+
UseYaraRules: d.Get("rule.0.use_yara_rules").(bool),
453470
AdditionalHashes: additionalHashes,
454471
IgnoreHashes: ignoreHashes,
472+
UseRegex: d.Get("rule.0.use_regex").(bool),
473+
IgnorePaths: ignorePaths,
455474
},
456475
}
457476

0 commit comments

Comments
 (0)