Skip to content

Commit 66d7f40

Browse files
feat: Add initial SSI deny list (#7568)
1 parent 85b316b commit 66d7f40

9 files changed

+894
-0
lines changed

.gitlab-ci.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,13 @@ deploy_artifacts_to_github:
203203
max: 2
204204
when: always
205205

206+
requirements_json_test:
207+
rules:
208+
- when: on_success
209+
variables:
210+
REQUIREMENTS_BLOCK_JSON_PATH: "metadata/requirements-block.json"
211+
REQUIREMENTS_ALLOW_JSON_PATH: "metadata/requirements-allow.json"
212+
206213
package-oci:
207214
needs: [ build ]
208215

.gitlab/prepare-oci-package.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ fi
1010
mkdir -p sources
1111
cp ../workspace/dd-java-agent/build/libs/*.jar sources/dd-java-agent.jar
1212
echo -n "$VERSION" > sources/version
13+
cp ../metadata/requirements.json sources/

metadata/base-requirements.json

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"version": 1,
3+
"deny": [
4+
{
5+
"id": "unsupported_jvm",
6+
"description": "Skip older JVMs",
7+
"os": null,
8+
"cmds": [
9+
"**/java-1.5*/**/java",
10+
"**/java-1.6*/**/java",
11+
"**/java-6*/**/java",
12+
"**/java-7/**/java"
13+
],
14+
"args": [],
15+
"envars": null
16+
},
17+
{
18+
"id": "java8_version",
19+
"description": "Skip java -version command",
20+
"os": null,
21+
"cmds": [
22+
"**/java"
23+
],
24+
"args": [
25+
{
26+
"args": [
27+
"-version"
28+
],
29+
"position": 1
30+
}
31+
],
32+
"envars": null
33+
},
34+
{
35+
"id": "java_version",
36+
"description": "Skip java --version command",
37+
"os": null,
38+
"cmds": [
39+
"**/java"
40+
],
41+
"args": [
42+
{
43+
"args": [
44+
"--version"
45+
],
46+
"position": 1
47+
}
48+
],
49+
"envars": null
50+
}
51+
],
52+
"native_deps": {
53+
"glibc": [
54+
{
55+
"arch": "x86",
56+
"supported": true
57+
},
58+
{
59+
"arch": "x64",
60+
"supported": true
61+
},
62+
{
63+
"arch": "arm64",
64+
"supported": true
65+
}
66+
],
67+
"musl": [
68+
{
69+
"arch": "x86",
70+
"supported": true
71+
},
72+
{
73+
"arch": "x64",
74+
"supported": true
75+
},
76+
{
77+
"arch": "arm64",
78+
"supported": true
79+
}
80+
]
81+
}
82+
}

metadata/build-requirements.sh

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
#!/bin/bash
2+
#
3+
# This script builds the requirements.json file based on
4+
# - the base-requirements.json as base file,
5+
# - the denied-arguments.tsv as rules to exclude application from their arguments (main classes, System properties, application arguments),
6+
# - the denied-environment-variables.tsv as rules to exclude applications from their exported environment variables.
7+
#
8+
9+
log-json() {
10+
local JSON=$1
11+
echo "Logging JSON"
12+
echo "$JSON" | jq
13+
}
14+
15+
#
16+
# Initialize requirements from base file
17+
#
18+
JSON=$(cat base-requirements.json)
19+
20+
#
21+
# Append deny list entries based on arguments
22+
#
23+
while read -r ENTRY; do
24+
# Skip comments or empty lines
25+
if [[ -z $ENTRY || $ENTRY == \#* ]]; then
26+
continue
27+
fi
28+
# Take first word
29+
IDENTIFIER=$(echo "$ENTRY" | awk '{print $1}')
30+
# Take second word
31+
ARGUMENT=$(echo "$ENTRY" | awk '{print $2}')
32+
# Take the rest as description
33+
DESCRIPTION=$(echo "$ENTRY" | awk '{for(i=3;i<=NF;++i) printf "%s%s", $i, (i<NF)?" ":""}')
34+
# Build deny list entry
35+
DENY_ENTRY=$(cat <<-END
36+
{
37+
"id": "$IDENTIFIER",
38+
"description": "$DESCRIPTION",
39+
"os": null,
40+
"cmds": ["**/java"],
41+
"args": [{
42+
"args": ["$ARGUMENT"],
43+
"position": null
44+
}],
45+
"envars": null
46+
}
47+
END
48+
)
49+
JSON=$(echo "$JSON" | jq ".deny += [$DENY_ENTRY]")
50+
done < denied-arguments.tsv
51+
52+
#
53+
# Append deny list entries based on environment variables
54+
#
55+
while read -r ENTRY; do
56+
# Skip comments or empty lines
57+
if [[ -z $ENTRY || $ENTRY == \#* ]]; then
58+
continue
59+
fi
60+
# Take first word
61+
IDENTIFIER=$(echo "$ENTRY" | awk '{print $1}')
62+
# Take second word
63+
ENVIRONMENT_VARIABLE=$(echo "$ENTRY" | awk '{print $2}')
64+
# Take the rest as description
65+
DESCRIPTION=$(echo "$ENTRY" | awk '{for(i=3;i<=NF;++i) printf "%s%s", $i, (i<NF)?" ":""}')
66+
# Build deny list entry
67+
DENY_ENTRY=$(cat <<-END
68+
{
69+
"id": "$IDENTIFIER",
70+
"description": "$DESCRIPTION",
71+
"os": null,
72+
"cmds": ["**/java"],
73+
"args": [],
74+
"envars": {
75+
"$ENVIRONMENT_VARIABLE": null
76+
}
77+
}
78+
END
79+
)
80+
JSON=$(echo "$JSON" | jq ".deny += [$DENY_ENTRY]")
81+
done < denied-environment-variables.tsv
82+
83+
log-json "$JSON"
84+
echo "$JSON" > requirements.json

metadata/denied-arguments.tsv

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Identifier Argument Description
2+
3+
# Apache ActiveMQ Artemis
4+
apache_activemq_artemis org.apache.activemq.artemis.boot.Artemis Skip Apache ActiveMQ Artemis
5+
6+
# Apache Cassandra
7+
8+
apache_cassandra org.apache.cassandra.service.CassandraDaemon Skip Apache Cassandra
9+
apache_cassandra_debugcql org.apache.cassandra.transport.Client Skip Apache Cassandra debug-cql
10+
apache_cassandra_nodetool org.apache.cassandra.tools.NodeTool Skip Apache Cassandra nodetool
11+
apache_cassandra_sstableloader org.apache.cassandra.tools.BulkLoader Skip Apache Cassandra sstableloader
12+
apache_cassandra_sstablescrub org.apache.cassandra.tools.StandaloneScrubber Skip Apache Cassandra stablescrub
13+
apache_cassandra_sstableupgrade org.apache.cassandra.tools.StandaloneUpgrader Skip Apache Cassandra sstableupgrade
14+
apache_cassandra_sstableutil org.apache.cassandra.tools.StandaloneSSTableUtil Skip Apache Cassandra sstableutil
15+
apache_cassandra_sstableverify org.apache.cassandra.tools.StandaloneVerifier Skip Apache Cassandra sstableverify
16+
17+
# Apache Lucene
18+
apache_lucene8_luke org.apache.lucene.luke.app.desktop.LukeMain Skip Lucene 8 Luke
19+
apache_lucene9_luke org.apache.lucene.luke Skip Apache Netbeans
20+
21+
# Apache Netbeans
22+
apache_netbeans org.netbeans.Main Skip Apache Netbeans
23+
24+
# Apache Solr 8
25+
apache_solr8_start -Dsolr.solr.home=* Skip Apache Solr 8 start command using System Properties
26+
apache_solr8_stop *solr/server/start.jar Skip Apache Solr 8 stop using path to jar
27+
apache_solr8_tools org.apache.solr.util.SolrCLI Skip Apache Solr 8 CLI tools
28+
29+
# Elastic Search 7+
30+
elasticsearch7 -Des.path.home=* Skip Elastic Search 7+ commands
31+
32+
# Jetbrains IntelliJ IDEA
33+
intellij_idea com.intellij.idea.Main Skip Jetbrains IntelliJ IDEA
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Identifier EnvironmentVariable Description
2+
apache_hbase HBASE_HOME Skip Apache HBase
3+
apache_hadoop3 HADOOP_HOME Skip Apache Hadoop 3
4+
apache_hive HIVE_HOME Skip Apache Hive
5+
apache_solr9 SOLR_PORT Skip Apache Solr 9

metadata/requirements-allow.json

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
[
2+
{
3+
"name": "should allow -version args if not java",
4+
"filepath": "/usr/bin/notjava",
5+
"args": [
6+
"notjava",
7+
"-version"
8+
],
9+
"envars": [],
10+
"host": {
11+
"os": "linux",
12+
"arch": "x64",
13+
"libc": "glibc:2.17"
14+
}
15+
},
16+
{
17+
"name": "should allow --version args if not java",
18+
"filepath": "/usr/bin/notjava",
19+
"args": [
20+
"notjava",
21+
"--version"
22+
],
23+
"envars": [],
24+
"host": {
25+
"os": "linux",
26+
"arch": "x64",
27+
"libc": "glibc:2.17"
28+
}
29+
},
30+
{
31+
"name": "should allow -version as application parameter",
32+
"filepath": "/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java",
33+
"args": [
34+
"java",
35+
"-jar",
36+
"app.jar",
37+
"-version"
38+
],
39+
"envars": [],
40+
"host": {
41+
"os": "linux",
42+
"arch": "x64",
43+
"libc": "glibc:2.17"
44+
}
45+
},
46+
{
47+
"name": "should allow --version as application parameter",
48+
"filepath": "/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java",
49+
"args": [
50+
"java",
51+
"-jar",
52+
"app.jar",
53+
"--version"
54+
],
55+
"envars": [],
56+
"host": {
57+
"os": "linux",
58+
"arch": "x64",
59+
"libc": "glibc:2.17"
60+
}
61+
}
62+
]

0 commit comments

Comments
 (0)