agent/common.go at main · step-security/agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
package main

import (
	"fmt"
	"os"
	"os/exec"
	"strconv"
	"strings"
)

const (
	agentLockFile = "agent.lock"
)

func getPidsOfInterest() []uint32 {
	out := []uint32{}

	// our process
	out = append(out, uint32(os.Getpid()))

	return out
}

func getFilesOfInterest() []string {
	out := []string{}

	// sudoers file
	out = append(out, "/etc/sudoers.d/runner")

	// resolved.conf
	out = append(out, "/etc/resolv.conf")

	// /etc/systemd/resolved.conf
	out = append(out, "/etc/systemd/resolved.conf")

	// /etc/docker/daemon.json
	out = append(out, "/etc/docker/daemon.json")

	return out
}

func getProcFilesOfInterest() []string {
	out := []string{}

	// runner worker memory files
	runnerWorker, _ := pidOf("Runner.Worker")
	out = append(out, getProcMemFiles(runnerWorker)...)

	// runner listener memory files
	runnerListener, _ := pidOf("Runner.Listener")
	out = append(out, getProcMemFiles(runnerListener)...)

	return out
}

func pidOf(procName string) (uint64, error) {

	cmd := exec.Command("pidof", procName)

	out, err := cmd.Output()
	if err != nil {
		return 0, err
	}

	if len(out) == 0 {
		return 0, fmt.Errorf("no process exists")
	}

	parts := strings.Fields(string(out))

	num, err := strconv.Atoi(parts[0])
	if err != nil {
		return 0, err
	}

	return uint64(num), nil

}

func getProcMemFiles(pid uint64) []string {

	out := []string{}

	if pid == 0 {
		return out
	}

	out = []string{
		fmt.Sprintf("/proc/%d/mem", pid),
	}

	return out
}

func getRunnerWorkerPID() (uint64, error) {
	return pidOf("Runner.Worker")
}