Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Process Based FAA #124

Closed
mlw opened this issue Nov 13, 2024 · 0 comments
Closed

Process Based FAA #124

mlw opened this issue Nov 13, 2024 · 0 comments
Labels
enhancement New feature or request file access authorization Issues related to file access authorization
Milestone
2025.2

Comments

@mlw
Copy link
Contributor

mlw commented Nov 13, 2024 •
edited by pmarkowsky
Loading

In some scenarios what you actually want to control is what a process can and cannot open. You want to know exactly which files a specific process interacted with e.g. every file that tar or zip touched.

This issue is to extend FAA to cover those scenarios.
@pmarkowsky pmarkowsky added this to the 2025.1 milestone Dec 7, 2024
@mlw mlw modified the milestones: 2025.1, 2025.2 Jan 16, 2025
@pmarkowsky pmarkowsky added enhancement New feature or request file access authorization Issues related to file access authorization labels Jan 17, 2025
This was referenced Feb 4, 2025
Merged
Merged
Merged
mlw added a commit that referenced this issue Feb 5, 2025
@mlw
Initial infrastructure for Proc FAA client (#237)
b0ef822 
This PR lays the foundation for the new Proc FAA client and sets up some
of the required interfaces between it and the Authorizer client and the
WatchItems class. It also implements newly required ES API interfaces.
None of this new code is yet hooked up to the rest of Santa - no new
client will be created yet at runtime.

Part of: #124
This was referenced Feb 21, 2025
Merged
Merged
Merged
Merged
mlw added a commit that referenced this issue Feb 21, 2025
@mlw
PathTargets cleanup, check policy block params, test migration (#272)
d0f074b 
This change mostly moves tests from the Data FAA client to the new
FAAPolicyProcessor, along with some cleanup to work in the new class.
Other minor changes include changing the signature of
`CheckIfPolicyMatchesBlock` to prepare for allowing inverted Proc FAA
rules and removing and migrating away from the `PopulatePathTargets` to
the new, simpler, `PathTargets` interface.

Part of: #124
This was referenced Feb 28, 2025
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request file access authorization Issues related to file access authorization
Projects
None yet
Milestone
2025.2
Development

No branches or pull requests
2 participants
@mlw @pmarkowsky