From 46b7a2630c631bacd8adef5b276020f7c201772c Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Thu, 16 Sep 2021 09:34:01 +0930 Subject: [PATCH] libbeat/common/seccomp: provide default policy for linux arm64 --- CHANGELOG.next.asciidoc | 1 + NOTICE.txt | 4 +-- go.mod | 2 +- go.sum | 4 +-- libbeat/common/seccomp/policy_linux_arm64.go | 35 ++++++++++++++++++++ 5 files changed, 41 insertions(+), 5 deletions(-) create mode 100644 libbeat/common/seccomp/policy_linux_arm64.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e57576aa204b..8330a6abedfd 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -532,6 +532,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Allow non-padded base64 data to be decoded by decode_base64_field {pull}27311[27311], {issue}27021[27021] - The Kafka support library Sarama has been updated to 1.29.1. {pull}27717[27717] - Kafka is now supported up to version 2.8.0. {pull}27720[27720] +- Add default seccomp policy for linux arm64. {pull}27955[27955] *Auditbeat* diff --git a/NOTICE.txt b/NOTICE.txt index 9a9ae8e35f89..c1687c20dcab 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -7351,11 +7351,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- Dependency : github.com/elastic/go-seccomp-bpf -Version: v1.1.0 +Version: v1.2.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/elastic/go-seccomp-bpf@v1.1.0/LICENSE.txt: +Contents of probable licence file $GOMODCACHE/github.com/elastic/go-seccomp-bpf@v1.2.0/LICENSE.txt: Apache License diff --git a/go.mod b/go.mod index 07baf547449f..b1e28b66940b 100644 --- a/go.mod +++ b/go.mod @@ -67,7 +67,7 @@ require ( github.com/elastic/go-lookslike v0.3.0 github.com/elastic/go-lumber v0.1.0 github.com/elastic/go-perf v0.0.0-20191212140718-9c656876f595 - github.com/elastic/go-seccomp-bpf v1.1.0 + github.com/elastic/go-seccomp-bpf v1.2.0 github.com/elastic/go-structform v0.0.9 github.com/elastic/go-sysinfo v1.7.0 github.com/elastic/go-txfile v0.0.7 diff --git a/go.sum b/go.sum index c14acc22e90a..40bdfa9b40a9 100644 --- a/go.sum +++ b/go.sum @@ -266,8 +266,8 @@ github.com/elastic/go-perf v0.0.0-20191212140718-9c656876f595 h1:q8n4QjcLa4q39Q3 github.com/elastic/go-perf v0.0.0-20191212140718-9c656876f595/go.mod h1:s09U1b4P1ZxnKx2OsqY7KlHdCesqZWIhyq0Gs/QC/Us= github.com/elastic/go-plugins-helpers v0.0.0-20200207104224-bdf17607b79f h1:FvsqAVIFZtJtK+koSvFU+/KoNQo1m14kgV5qJ8ImN+U= github.com/elastic/go-plugins-helpers v0.0.0-20200207104224-bdf17607b79f/go.mod h1:OPGqFNdTS34kMReS5hPFtBhD9J8itmSDurs1ix2wx7c= -github.com/elastic/go-seccomp-bpf v1.1.0 h1:jUzzDc6LyCtdolZdvL/26dad6rZ9vsc7xZ2eadKECAU= -github.com/elastic/go-seccomp-bpf v1.1.0/go.mod h1:l+89Vy5BzjVcaX8USZRMOwmwwDScE+vxCFzzvQwN7T8= +github.com/elastic/go-seccomp-bpf v1.2.0 h1:K5fToUAMzm0pmdlYORmw0FP0DloRa1SfqRYkum647Yk= +github.com/elastic/go-seccomp-bpf v1.2.0/go.mod h1:l+89Vy5BzjVcaX8USZRMOwmwwDScE+vxCFzzvQwN7T8= github.com/elastic/go-structform v0.0.9 h1:HpcS7xljL4kSyUfDJ8cXTJC6rU5ChL1wYb6cx3HLD+o= github.com/elastic/go-structform v0.0.9/go.mod h1:CZWf9aIRYY5SuKSmOhtXScE5uQiLZNqAFnwKR4OrIM4= github.com/elastic/go-sysinfo v1.1.1/go.mod h1:i1ZYdU10oLNfRzq4vq62BEwD2fH8KaWh6eh0ikPT9F0= diff --git a/libbeat/common/seccomp/policy_linux_arm64.go b/libbeat/common/seccomp/policy_linux_arm64.go new file mode 100644 index 000000000000..f7b914c5dd7e --- /dev/null +++ b/libbeat/common/seccomp/policy_linux_arm64.go @@ -0,0 +1,35 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package seccomp + +import "github.com/elastic/go-seccomp-bpf" + +func init() { + defaultPolicy = &seccomp.Policy{ + DefaultAction: seccomp.ActionAllow, + Syscalls: []seccomp.SyscallGroup{ + { + Action: seccomp.ActionErrno, + Names: []string{ + "execve", + "execveat", + }, + }, + }, + } +}