feat: PatchMonEnhanced-agent v1.5.55 - Compliance Scanning, Security Fixes, and WebSocket Enhancements

[MacJediWizard]

PatchMonEnhanced-agent v1.5.55 - Comprehensive PR

Base: PatchMon/PatchMon-agent v1.3.7
Head: MacJediWizard/PatchMonEnhanced-agent v1.5.55

---

Summary

This PR introduces major enhancements to the PatchMon agent including:

1. Compliance Scanning - OpenSCAP and Docker Bench Security integration
2. Security Hardening - Input validation, TOCTOU fixes, shell injection prevention
3. WebSocket Enhancements - New message handlers for compliance and integrations
4. Performance Improvements - Timeout handling, resource limits

---

Related GitHub Issues

Upstream Issues (PatchMon/PatchMon) - Related

Issue	Title	Status
PatchMon/PatchMon#92	Feature Request: Modern Authentication (OIDC, SAML)	Agent supports OIDC auth
PatchMon/PatchMon#159	[Feature Request] SSO Support	Agent supports SSO

Agent Issues (PatchMonEnhanced-agent) - Resolved

Closed Issues

Issue	Severity	Title
#1	CRITICAL	TLS Certificate Verification Bypass for Binary Downloads
#17	CRITICAL	Shell injection via fmt.Sprintf in agent restart helpers
#2	HIGH	Binary Updates Downloaded Without Signature Verification
#3	HIGH	Shell Scripts Generated and Executed at Runtime
#4	HIGH	Docker Bench Container Runs with Elevated Privileges
#9	HIGH	Insecure TLS skip verify option
#18	HIGH	TOCTOU race condition in helper script execution
#5	MEDIUM	Goroutine Leak in WebSocket Connection
#6	MEDIUM	Error Messages May Leak Sensitive Information
#7	MEDIUM	Hardcoded Configuration Values Should Be Configurable
#10	MEDIUM	Resource limits missing for downloads and WebSocket
#11	MEDIUM	TOCTOU race condition in helper script execution
#12	MEDIUM	Make binary hash verification mandatory
#23	MEDIUM	WebSocket message inputs not validated - command injection risk
#24	MEDIUM	TOCTOU race condition in credentials file creation
#8	LOW	Directory and File Permissions Should Be More Restrictive
#13	LOW	Go agent stale code and minor improvements
#14	Enhancement	Add comprehensive scanner info to compliance status reports
#15	Enhancement	Add dynamic scanner info display to Compliance Settings
#16	Enhancement	Docker Image CVE Scanning with oscap-docker

Open Issues (Still in Progress)

Issue	Severity	Title
#19	CRITICAL	Invalid Go version 1.25 in go.mod
#20	MEDIUM	TLS verification bypass option should be removed or restricted
#21	CODE-QUALITY	Docker image update checking is commented out
#22	Enhancement	Docker Bench Security Integration Improvements

---

New Features

1. Compliance Scanning (OpenSCAP + Docker Bench)

Full CIS benchmark scanning integration.

OpenSCAP Features:

• CIS benchmark scanning for Ubuntu, RHEL, Debian
• SCAP Security Guide (SSG) content support
• Profile discovery and selection
• Real-time scan progress via WebSocket
• Single rule remediation
• SSG version checking and upgrade capability

Docker Bench Security Features:

• CIS Docker Benchmark scanning
• Container security assessment
• Multi-line remediation parsing
• Pass/Fail/Warn result categorization

2. Security Improvements

• WebSocket input validation to prevent command injection
• TOCTOU (Time-of-Check to Time-of-Use) race condition fixes
• Credentials file atomic writes
• Shell injection prevention
• Improved error message sanitization

3. Compliance On-Demand Only Mode

Control whether compliance scans run during scheduled reports.

Behavior:

• When enabled: Compliance scans only run when triggered from UI
• When disabled: Compliance scans run during scheduled agent reports
• Default: Enabled (on-demand only)

---

WebSocket Message Handlers

New Message Types Handled

Type	Description	Payload
compliance_scan	Trigger compliance scan	{ profile_id, profile_type, enable_remediation, fetch_remote_resources }
upgrade_ssg	Upgrade SSG content	-
remediate_rule	Remediate single rule	{ profile_id, profile_type, rule_id }
docker_image_scan	Scan Docker image	{ image_name, container_name, scan_all_images }
set_compliance_on_demand_only	Set compliance mode	{ on_demand_only }
refresh_integration_status	Refresh integration status	-
docker_inventory_refresh	Refresh Docker inventory	-
integration_toggle	Toggle integration	{ integration, enabled }

Messages Sent to Server

Type	Description
integration_status	Integration setup status update
compliance_progress	Scan progress update
compliance_result	Scan completion with results
ssg_upgrade_result	SSG upgrade completion
remediation_result	Remediation completion

---

Agent Configuration

config.yml

# PatchMon Agent Configuration
patchmon_server: "https://your-server.com"
api_version: "v1"
credentials_file: "/etc/patchmon/credentials.yml"
log_file: "/etc/patchmon/logs/patchmon-agent.log"
log_level: "info"
skip_ssl_verify: false
update_interval: 60          # Minutes between reports
report_offset: 0             # Seconds offset for report timing

# Integration settings
integrations:
  docker: false              # Enable Docker monitoring

# Compliance settings
compliance_on_demand_only: true  # Only run compliance when triggered from UI

New Config Fields

Field	Type	Default	Description
compliance_on_demand_only	Boolean	true	Skip compliance during scheduled reports

---

Files Changed Summary

• 83 commits ahead of upstream
• Key files modified:
  • cmd/patchmon-agent/commands/serve.go - WebSocket handlers
  • cmd/patchmon-agent/commands/report.go - Compliance integration
  • internal/config/config.go - Config management
  • internal/compliance/* - OpenSCAP integration
  • internal/dockerbench/* - Docker Bench integration
  • pkg/models/models.go - Data structures

---

Breaking Changes

1. New config field: compliance_on_demand_only added (defaults to true)
2. WebSocket protocol: New message types added

---

Version Information

Component	Upstream Version	Enhanced Version
PatchMon-agent	1.3.7	1.5.55

---

Testing Checklist

• Compliance scans complete successfully
• Single rule remediation works
• SSG upgrade works
• Docker Bench scanning works
• Compliance on-demand toggle persists
• WebSocket handlers work correctly
• Go lint passes (go fmt, go vet)

---

Contributors

• MacJediWizard
• Claude Opus 4.5 (AI Assistant)