Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Auditbeat] Backport #9546 to 6.x: Add system module #9581

Merged
merged 33 commits into from
Dec 18, 2018
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
ef247ed
Add skeleton x-pack Auditbeat module (#8252)
andrewkroh Sep 18, 2018
d22fb54
Rename sysinfo module to system (#8356)
Sep 19, 2018
3fcd001
[Auditbeat] Add host, packages, and processes metricsets (#8436)
Oct 19, 2018
627d520
Fixes after merging master into feature branch.
Nov 13, 2018
879f32f
[Auditbeat] Add user metricset (#8835)
Nov 16, 2018
30f3ce4
[Auditbeat] Socket metricset (#8834)
Nov 30, 2018
1e3f4bf
[Auditbeat] Disable user metricset on non-Linux systems (#9368)
Dec 4, 2018
f51d36c
[Auditbeat] Update process metricset (#9139)
Dec 6, 2018
86ec03e
Add CI testing to x-pack/auditbeat (#9362)
andrewkroh Dec 7, 2018
8b3d5a8
[Auditbeat] Update host metricset (#9421)
Dec 11, 2018
9d68625
[Auditbeat] Make detecting password changes optional (#9461)
Dec 11, 2018
f41a560
[Auditbeat] Change event.type to event.kind (#9489)
Dec 12, 2018
381e779
[Auditbeat] Disable packages metricset (#9495)
Dec 12, 2018
ac6fbec
[Auditbeat] Namespace system module to system.audit (#9499)
Dec 12, 2018
2b0f240
[Auditbeat] Set auditbeat.max_start_delay to 0 for system tests. (#9500)
Dec 12, 2018
18af477
[Auditbeat] Add message field to system module (#9483)
Dec 12, 2018
b0e756b
[Auditbeat] System module documentation (#9512)
Dec 14, 2018
6f5f20f
[Auditbeat] Fix process metricset when not root (#9497)
Dec 14, 2018
0f84d05
Re-generate configs to include ILM.
Dec 14, 2018
71362b3
Re-add newlines to configs.
Dec 14, 2018
5f48d60
Temporarily disable docs references to x-pack/auditbeat
Dec 14, 2018
072e632
Re-generate x-pack configs
Dec 14, 2018
8f49938
Fix make beats-dashboards
Dec 15, 2018
c3f9d13
Fix make update
Dec 16, 2018
0a6f5d2
Fix make commands in x-pack/auditbeat
Dec 16, 2018
881b4f9
Fix mage integtest
Dec 16, 2018
fff5977
Fix x-pack/auditbeat make testsuite
Dec 16, 2018
a051656
Fix process test
Dec 16, 2018
bab903b
Fix auditbeat/ make testsuite
Dec 16, 2018
0a43226
Remove disabled packages metricset.
Dec 17, 2018
86fd446
Add missing dependency.
Dec 17, 2018
ce12565
Add ECS fields
Dec 18, 2018
0924fdf
Add to CHANGELOG
Dec 17, 2018
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix make update
  • Loading branch information
Christoph Wurm committed Dec 16, 2018
commit c3f9d13a407119ca185c99cd8c7f290d5dcae95e
180 changes: 180 additions & 0 deletions dev-tools/mage/check.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,180 @@
// Licensed to Elasticsearch B.V. under one or more contributor
// license agreements. See the NOTICE file distributed with
// this work for additional information regarding copyright
// ownership. Elasticsearch B.V. licenses this file to you under
// the Apache License, Version 2.0 (the "License"); you may
// not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.

package mage

import (
"bufio"
"bytes"
"fmt"
"log"
"os"
"os/exec"
"path/filepath"
"runtime"
"strings"

"github.com/magefile/mage/mg"
"github.com/magefile/mage/sh"
"github.com/pkg/errors"

"github.com/elastic/beats/libbeat/processors/dissect"
)

// Check looks for created/modified/deleted/renamed files and returns an error
// if it finds any modifications. If executed in in verbose mode it will write
// the results of 'git diff' to stdout to indicate what changes have been made.
//
// It also checks the file permissions of nosetests test cases and YAML files.
func Check() error {
fmt.Println(">> check: Checking for modified files or incorrect permissions")

mg.Deps(CheckNosetestsNotExecutable, CheckYAMLNotExecutable)

changes, err := GitDiffIndex()
if err != nil {
return errors.Wrap(err, "failed to diff the git index")
}

if len(changes) > 0 {
if mg.Verbose() {
GitDiff()
}

return errors.Errorf("some files are not up-to-date. "+
"Run 'mage fmt update' then review and commit the changes. "+
"Modified: %v", changes)
}
return nil
}

// GitDiffIndex returns a list of files that differ from what is committed.
// These could file that were created, deleted, modified, or moved.
func GitDiffIndex() ([]string, error) {
// Ensure the index is updated so that diff-index gives accurate results.
if err := sh.Run("git", "update-index", "-q", "--refresh"); err != nil {
return nil, err
}

// git diff-index provides a list of modified files.
// https://www.git-scm.com/docs/git-diff-index
out, err := sh.Output("git", "diff-index", "HEAD", "--", ".")
if err != nil {
return nil, err
}

// Example formats.
// :100644 100644 bcd1234... 0123456... M file0
// :100644 100644 abcd123... 1234567... R86 file1 file3
d, err := dissect.New(":%{src_mode} %{dst_mode} %{src_sha1} %{dst_sha1} %{status}\t%{paths}")
if err != nil {
return nil, err
}

// Parse lines.
var modified []string
s := bufio.NewScanner(bytes.NewBufferString(out))
for s.Scan() {
m, err := d.Dissect(s.Text())
if err != nil {
return nil, errors.Wrap(err, "failed to dissect git diff-index output")
}

paths := strings.Split(m["paths"], "\t")
if len(paths) > 1 {
modified = append(modified, paths[1])
} else {
modified = append(modified, paths[0])
}
}
if err = s.Err(); err != nil {
return nil, err
}

return modified, nil
}

// GitDiff runs 'git diff' and writes the output to stdout.
func GitDiff() error {
c := exec.Command("git", "--no-pager", "diff", "--minimal")
c.Stdin = nil
c.Stdout = os.Stdout
c.Stderr = os.Stderr
log.Println("exec:", strings.Join(c.Args, " "))
err := c.Run()
return err
}

// CheckNosetestsNotExecutable checks that none of the nosetests files are
// executable. Nosetests silently skips executable .py files and we don't want
// this to happen.
func CheckNosetestsNotExecutable() error {
if runtime.GOOS == "windows" {
// Skip windows because it doesn't have POSIX permissions.
return nil
}

tests, err := FindFiles(nosetestsTestFiles...)
if err != nil {
return err
}

var executableTestFiles []string
for _, file := range tests {
info, err := os.Stat(file)
if err != nil {
return err
}

if info.Mode().Perm()&0111 > 0 {
executableTestFiles = append(executableTestFiles, file)
}
}

if len(executableTestFiles) > 0 {
return errors.Errorf("nosetests files cannot be executable because "+
"they will be skipped. Fix permissions of %v", executableTestFiles)
}
return nil
}

// CheckYAMLNotExecutable checks that no .yml or .yaml files are executable.
func CheckYAMLNotExecutable() error {
if runtime.GOOS == "windows" {
// Skip windows because it doesn't have POSIX permissions.
return nil
}

executableYAMLFiles, err := FindFilesRecursive(func(path string, info os.FileInfo) bool {
switch filepath.Ext(path) {
default:
return false
case ".yml", ".yaml":
return info.Mode().Perm()&0111 > 0
}
})
if err != nil {
return errors.Wrap(err, "failed search for YAML files")
}

if len(executableYAMLFiles) > 0 {
return errors.Errorf("YAML files cannot be executable. Fix "+
"permissions of %v", executableYAMLFiles)

}
return nil
}
51 changes: 32 additions & 19 deletions dev-tools/mage/common.go
Original file line number Diff line number Diff line change
Expand Up @@ -147,12 +147,12 @@ func expandFile(src, dst string, args ...map[string]interface{}) error {
}

// CWD return the current working directory.
func CWD() string {
func CWD(elem ...string) string {
wd, err := os.Getwd()
if err != nil {
panic(errors.Wrap(err, "failed to get the CWD"))
}
return wd
return filepath.Join(append([]string{wd}, elem...)...)
}

// EnvOr returns the value of the specified environment variable if it is
Expand Down Expand Up @@ -215,6 +215,13 @@ func dockerInfo() (*DockerInfo, error) {
return &info, nil
}

// HaveDockerCompose returns an error if docker-compose is not found on the
// PATH.
func HaveDockerCompose() error {
_, err := exec.LookPath("docker-compose")
return errors.Wrap(err, "docker-compose was not found on the PATH")
}

// FindReplace reads a file, performs a find/replace operation, then writes the
// output to the same file path.
func FindReplace(file string, re *regexp.Regexp, repl string) error {
Expand Down Expand Up @@ -513,6 +520,29 @@ func FindFiles(globs ...string) ([]string, error) {
return configFiles, nil
}

// FindFilesRecursive recursively traverses from the CWD and invokes the given
// match function on each regular file to determine if the given path should be
// returned as a match.
func FindFilesRecursive(match func(path string, info os.FileInfo) bool) ([]string, error) {
var matches []string
err := filepath.Walk(".", func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}

if !info.Mode().IsRegular() {
// continue
return nil
}

if match(filepath.ToSlash(path), info) {
matches = append(matches, path)
}
return nil
})
return matches, err
}

// FileConcat concatenates files and writes the output to out.
func FileConcat(out string, perm os.FileMode, files ...string) error {
f, err := os.OpenFile(createDir(out), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, perm)
Expand Down Expand Up @@ -646,23 +676,6 @@ func IsUpToDate(dst string, sources ...string) bool {
return err == nil && !execute
}

// OSSBeatDir returns the OSS beat directory. You can pass paths and they will
// be joined and appended to the OSS beat dir.
func OSSBeatDir(path ...string) string {
ossDir := CWD()

// Check if we need to correct ossDir because it's in x-pack.
if parentDir := filepath.Base(filepath.Dir(ossDir)); parentDir == "x-pack" {
// If the OSS version of the beat exists.
tmp := filepath.Join(ossDir, "../..", BeatName)
if _, err := os.Stat(tmp); !os.IsNotExist(err) {
ossDir = tmp
}
}

return filepath.Join(append([]string{ossDir}, path...)...)
}

// LibbeatDir returns the libbeat directory. You can pass paths and
// they will be joined and appended to the libbeat dir.
func LibbeatDir(path ...string) string {
Expand Down
53 changes: 53 additions & 0 deletions dev-tools/mage/dashboard.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
// Licensed to Elasticsearch B.V. under one or more contributor
// license agreements. See the NOTICE file distributed with
// this work for additional information regarding copyright
// ownership. Elasticsearch B.V. licenses this file to you under
// the Apache License, Version 2.0 (the "License"); you may
// not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.

package mage

import (
"fmt"
"path/filepath"

"github.com/magefile/mage/sh"
)

// ExportDashboard exports a dashboard from Kibana and writes it into the given module.
func ExportDashboard() error {
module := EnvOr("MODULE", "")
if module == "" {
return fmt.Errorf("MODULE must be specified")
}

id := EnvOr("ID", "")
if id == "" {
return fmt.Errorf("Dashboad ID must be specified")
}

beatsDir, err := ElasticBeatsDir()
if err != nil {
return err
}

// TODO: This is currently hardcoded for KB 6, we need to figure out what we do for KB 7
file := CWD("module", module, "_meta/kibana/6/dashboard", id+".json")

dashboardCmd := sh.RunCmd("go", "run",
filepath.Join(beatsDir, "dev-tools/cmd/dashboards/export_dashboards.go"),
"-output", file, "-dashboard", id,
)

return dashboardCmd()
}
13 changes: 13 additions & 0 deletions dev-tools/mage/gotest.go
Original file line number Diff line number Diff line change
Expand Up @@ -325,3 +325,16 @@ func (s *GoTestSummary) String() string {

return strings.TrimRight(b.String(), "\n")
}

// BuildSystemTestBinary build a binary for testing that is instrumented for
// testing and measuring code coverage. The binary is only instrumented for
// coverage when TEST_COVERAGE=true (default is false).
func BuildSystemTestBinary() error {
args := []string{
"test", "-c",
}
if TestCoverage {
args = append(args, "-coverpkg", "./...")
}
return sh.RunV("go", args...)
}
21 changes: 18 additions & 3 deletions dev-tools/mage/pkgspecs.go
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
package mage

import (
"bytes"
"io/ioutil"
"log"
"path/filepath"
Expand Down Expand Up @@ -88,10 +89,24 @@ func MustUsePackaging(specName, specFile string) {
}
}

// LoadLocalNamedSpec loads the named package spec from the packages.yml in the
// current directory.
func LoadLocalNamedSpec(name string) {
beatsDir, err := ElasticBeatsDir()
if err != nil {
panic(err)
}

err = LoadNamedSpec(name, filepath.Join(beatsDir, packageSpecFile), "packages.yml")
if err != nil {
panic(err)
}
}

// LoadNamedSpec loads a packaging specification with the given name from the
// specified YAML file. name should be a sub-key of 'specs'.
func LoadNamedSpec(name, file string) error {
specs, err := LoadSpecs(file)
func LoadNamedSpec(name string, files ...string) error {
specs, err := LoadSpecs(files...)
if err != nil {
return errors.Wrap(err, "failed to load spec file")
}
Expand Down Expand Up @@ -122,7 +137,7 @@ func LoadSpecs(files ...string) (map[string][]OSPackageArgs, error) {
}

var packages PackageYAML
if err = yaml.Unmarshal(data, &packages); err != nil {
if err := yaml.Unmarshal(bytes.Join(data, []byte{'\n'}), &packages); err != nil {
return nil, errors.Wrap(err, "failed to unmarshal spec data")
}

Expand Down
Loading