[CWS] review changes

DataDog · Mar 3, 2025 · 9fee0f0 · 9fee0f0
1 parent ef84786
commit 9fee0f0
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 14 deletions.
diff --git a/pkg/config/setup/system_probe_cws.go b/pkg/config/setup/system_probe_cws.go
@@ -119,7 +119,7 @@ func initCWSSystemProbeConfig(cfg pkgconfigmodel.Config) {
 	cfg.BindEnvAndSetDefault("runtime_security_config.hash_resolver.replace", map[string]string{})
 
 	// CWS - SysCtl snapshot
-	cfg.BindEnvAndSetDefault("runtime_security_config.sysctl_snapshot.enabled", false)
+	cfg.BindEnvAndSetDefault("runtime_security_config.sysctl_snapshot.enabled", true)
 	cfg.BindEnvAndSetDefault("runtime_security_config.sysctl_snapshot.period", "1h")
 
 	// CWS - UserSessions

diff --git a/pkg/security/probe/sysctl/snapshot.go b/pkg/security/probe/sysctl/snapshot.go
@@ -11,6 +11,7 @@ package sysctl
 import (
 	"encoding/json"
 	"fmt"
+	"github.com/DataDog/datadog-agent/pkg/util/kernel"
 	"io/fs"
 	"os"
 	"path"
@@ -92,7 +93,7 @@ func (s *Snapshot) Snapshot() error {
 
 // snapshotProcSys recursively reads files in /proc/sys and builds a nested JSON structure.
 func (s *Snapshot) snapshotProcSys() error {
-	return filepath.Walk("/proc/sys", func(file string, info fs.FileInfo, err error) error {
+	return filepath.Walk(kernel.HostProc("/sys"), func(file string, info fs.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -104,11 +105,11 @@ func (s *Snapshot) snapshotProcSys() error {
 
 		// Skip if mode doesn't allow reading
 		mode := info.Mode()
-		if mode&0400 == 0 && mode&0040 == 0 && mode&0004 == 0 {
+		if mode&0444 == 0 {
 			return nil
 		}
 
-		relPath, err := filepath.Rel("/proc", file)
+		relPath, err := filepath.Rel(kernel.ProcFSRoot(), file)
 		if err != nil {
 			return err
 		}
@@ -125,13 +126,13 @@ func (s *Snapshot) snapshotProcSys() error {
 
 // snapshotSys reads security relevant files from the /sys filesystem
 func (s *Snapshot) snapshotSys() error {
-	lockdownValue, err := readFileContent("/sys/kernel/security/lockdown")
+	lockdownValue, err := readFileContent(kernel.HostSys("/kernel/security/lockdown"))
 	if err != nil {
 		return err
 	}
 	s.InsertSnapshotEntry(s.Sys, "kernel/security/lockdown", lockdownValue)
 
-	lsmValue, err := readFileContent("/sys/kernel/security/lsm")
+	lsmValue, err := readFileContent(kernel.HostSys("/kernel/security/lsm"))
 	if err != nil {
 		return err
 	}

diff --git a/pkg/security/probe/sysctl/snapshot_test.go b/pkg/security/probe/sysctl/snapshot_test.go
@@ -8,7 +8,7 @@
 package sysctl
 
 import (
-	"reflect"
+	"github.com/stretchr/testify/assert"
 	"testing"
 )
 
@@ -85,9 +85,7 @@ func TestSnapshotEvent_ToJSON(t *testing.T) {
 				t.Errorf("ToJSON() error = %v, wantErr %v", err, tt.wantErr)
 				return
 			}
-			if !reflect.DeepEqual(string(got), tt.want) {
-				t.Errorf("ToJSON() got = %v, want %v", string(got), tt.want)
-			}
+			assert.JSONEqf(t, tt.want, string(got), "ToJSON() error")
 		})
 	}
 }
@@ -247,10 +245,7 @@ func TestSnapshot_InsertSnapshotEntry(t *testing.T) {
 				t.Errorf("InsertSnapshotEntry - ToJSON error: %v", err)
 				return
 			}
-			if !reflect.DeepEqual(string(got), tt.output) {
-				t.Errorf("InsertSnapshotEntry got = %v, want %v", string(got), tt.output)
-			}
-
+			assert.JSONEqf(t, string(got), tt.output, "InsertSnapshotEntry error")
 		})
 	}
 }
diff --git a/pkg/util/kernel/fs.go b/pkg/util/kernel/fs.go
@@ -65,6 +65,12 @@ func HostProc(combineWith ...string) string {
 	return filepath.Join(ProcFSRoot(), filepath.Join(combineWith...))
 }
 
+// HostSys returns the location of a host's sysfs. This can and will be
+// overridden when running inside a container.
+func HostSys(combineWith ...string) string {
+	return filepath.Join(SysFSRoot(), filepath.Join(combineWith...))
+}
+
 // RootNSPID returns the current PID from the root namespace
 var RootNSPID = funcs.Memoize(func() (int, error) {
 	pidPath := filepath.Join(ProcFSRoot(), "self")