Repository navigation
chore: merge main into int - #502
Merged
Merged
Conversation
feat: restrict DNS server calls to agent UID
removing ai-codewise workflow as it's not required anymore
(cherry picked from commit 378ef52)
- Added support for custom detection rules in the Armour integration. - Introduced new functions to submit process, file, and network events to the detection manager. - Updated the DNS proxy to submit DNS events when custom detection rules are enabled. - Refactored the agent's DNS handling to ensure proper execution flow when Docker is uninstalled. (cherry picked from commit 8192dfe)
- Introduced TelemetryURL in the ApiClient struct to allow separate telemetry endpoint usage. - Updated the agent to utilize TelemetryURL for sending DNS records and network connections. - Enhanced configuration handling to initialize TelemetryURL from the config file, defaulting to APIURL if not specified. (cherry picked from commit 93e00d3)
- Eliminated the call to submitDNSEvent in the handleNetworkEvent function, streamlining the event handling process. (cherry picked from commit a1eac7b)
(cherry picked from commit ee69267)
- Added a new configuration option to enable custom detection rules in the agent's run function. (cherry picked from commit 75a349e)
- Changed the assignment of OneTimeKey in the agent's run function to use apiclient.OneTimeKey. - Updated the Armour dependency version from v1.1.3 to v1.2.0 in go.mod and go.sum. (cherry picked from commit d4bfe1b)
…sys to v0.40.0 - Upgraded OpenTelemetry packages in go.mod and go.sum to version 1.40.0. - Updated golang.org/x/sys dependency to version 0.40.0. (cherry picked from commit 72f6f12)
- Moved the call to submitFileEvent to occur after unlocking the fileMutex, improving the event handling flow. (cherry picked from commit 025b442)
feat: custom detection rules
- Upgraded the Armour dependency version in go.mod and go.sum from v1.2.0 to v1.2.1. (cherry picked from commit 6d86062)
chore: update Armour dependency to v1.2.1
Add blocklist changes
cherry: add global blocklist changes
* dont send net-connection for sinkhole ip * bump armour to v1.2.4 * armour: bump to v1.4.0 * bump go version to 1.26.2
cherry: dont send net-connection for sinkhole ip, bump armour and go-version
generation of dummyNetworkEvent incase a domain was blocked. enabled setting to protect agent from getting killed
main: add sinkhole-ip net-conn bug fix and enabled setting to protect agent from getting killed
Call disableSudoAndContainers early in agent startup and revoke sudo and socket permissions before the slow container cleanup, which now runs in the background. Add tests for revocation order and socket perms. (cherry picked from commit aa706cd)
Fetch GitHub Actions endpoints from the GitHub meta API and add them to the implicit endpoint list, with retries on failure. Skip domains under githubusercontent.com because existing wildcard implicit endpoints already cover them. If the fetch fails, the hardcoded implicit endpoints remain as the baseline. (cherry picked from commit 5391cf1)
Move runCmd and path overrides onto Sudo so the background container-cleanup goroutine never reads package state restored by tests. (cherry picked from commit bae4f1c)
(cherry picked from commit 4ca65f7)
feat: sudo fix + meta API
main: changes for building arm64 binary
currenlty we do not get global block ip event from nflog
fix: send domain name to custom detction rule manager for processing ntw rule
Cherry/prateek changes
* revert github dns experiment when global feature flag is enabled * also detect and remove github dns experiment drop-in under /run * chore: bump go to 1.27.3 * revert github dns experiment in fail-safe order and replace resolv.conf symlink atomically
* revert github dns experiment when global feature flag is enabled * also detect and remove github dns experiment drop-in under /run * chore: bump go to 1.27.3 * revert github dns experiment in fail-safe order and replace resolv.conf symlink atomically
Brings main's history into int without changing any file on int, so the int to main PR compares against a recent merge base. With the old merge base, main and int had each added fileMonitorAuditRule through separate cherry-picks, and merging int into main kept both copies (fileMonitorAuditRule redeclared in procmon_linux.go). The merge also keeps int's code-review.yml, which main had removed.
step-security-bot-int
left a comment
step-security-bot-int
left a comment
There was a problem hiding this comment.
Please find StepSecurity AI-CodeWise code comments below.
Code Comments
Feedback
We appreciate your feedback in helping us improve the service! To provide feedback, please use emojis on this comment. If you find the comments helpful, give them a 👍. If they aren't useful, kindly express that with a 👎. If you have questions or detailed feedback, please create n GitHub issue in StepSecurity/AI-CodeWise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
After #501 merged, the
Testcheck on #475 (main <-- Int) fails to compile:Each branch defines
fileMonitorAuditRuleonce. The merge base ofintandmainis old (689409c), andmainandintadded the function through separate cherry-picks. #501 changed the lines just above it onintonly, so mergingintintomainkeeps both copies without a conflict.Change
Merge
mainintoint, keeping every file exactly as it is onint:procmon_linux.go:int's version (onefileMonitorAuditRule)..github/workflows/code-review.yml: kept.mainhad removed it, and a plain merge would have deleted it fromint.git diff int..venkat/sync-main-into-intis empty. Onlymain's history is added, so #475 compares against a recent merge base.Checked locally
main(what main <-- Int #475 does) is clean, has onefileMonitorAuditRule, and produces the same content asint.go vet ./...passes on that result.