secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 09:14:33 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
master
secubox-deb/packages/secubox-antirootkit
History
CyberMind-FR 19bcd10b2d perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915) 
At ~150 execs/s a dpkg -S subprocess per event can't keep up; the scanner
fell permanently behind and never reached recent execs. DpkgIndex loads all
/var/lib/dpkg/info/*.list paths into a set once at startup. +2 tests.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
2026-07-28 12:07:53 +02:00
..
api perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915) 2026-07-28 12:07:53 +02:00
conf fix(antirootkit): broad execve audit rule + alert-only enforce policy + deploy fixes (ref #915) 2026-07-28 11:38:47 +02:00
debian fix(antirootkit): broad execve audit rule + alert-only enforce policy + deploy fixes (ref #915) 2026-07-28 11:38:47 +02:00
menu.d feat(antirootkit): FastAPI app + webui panel for execlog/alerts/quarantine-prep (Task 10) 2026-07-28 09:09:44 +02:00
nft fix(antirootkit): real poll cursor, live alerts, honest v1 scope (ref #915) 2026-07-28 09:41:06 +02:00
nginx feat(antirootkit): FastAPI app + webui panel for execlog/alerts/quarantine-prep (Task 10) 2026-07-28 09:09:44 +02:00
sbin fix(antirootkit): execscan must NOT use ausearch -i (parser needs raw numeric uid) (ref #915) 2026-07-28 11:58:47 +02:00
sudoers fix(antirootkit): read audit via scoped-sudo ctl execscan (ausearch needs root for auditd.conf+rotated logs) (ref #915) 2026-07-28 11:53:21 +02:00
systemd fix(antirootkit): broad execve audit rule + alert-only enforce policy + deploy fixes (ref #915) 2026-07-28 11:38:47 +02:00
tests perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915) 2026-07-28 12:07:53 +02:00
www/antirootkit feat(antirootkit): FastAPI app + webui panel for execlog/alerts/quarantine-prep (Task 10) 2026-07-28 09:09:44 +02:00
pytest.ini
README.md fix(antirootkit): make alertstore cross-process via SQLite (ref #915) 2026-07-28 09:49:30 +02:00

README.md

secubox-antirootkit

Host-based intrusion detection module for SecuBox-Deb — anti-escape containment + exec-surveillance scanner + integrity wrap + alert-only manual quarantine.

What it does — v1 scope

LIVE

  • Anti-escape (A2): any process not resolvable to a dpkg-backed executable is moved into sbx-untrusted.slice, a top-level cgroup whose egress is dropped by the secubox_antiescape nft table except for lan_safe destinations (RFC1918 + loopback). Jailing is performed by the root-only secubox-antirootkitctl jail <pid> helper via a scoped, exact-path sudoers rule (sudoers/secubox-antirootkit) — the daemon itself never runs as root.
  • Exec scanner (A): targeted auditd watches (conf/99-sbx-procwatch.rules, key sbx_exec) on the common unbacked-exec surface — /usr/local/bin, /usr/local/sbin, /tmp, /dev/shm, /opt, /usr/lib/jvm, /home — feed api/execwatch.py, which decides allow-vs-jail using the dpkg-backing resolver (api/dpkg_backing.py) plus a TOML allowlist (api/allowlist.py, /etc/secubox/antirootkit.toml) and appends every decision to an append-only SQLite forensic log (api/execlog.py). The daemon (api/daemon.py) tracks a real polling cursor so each audit record is processed exactly once, even when two successive ausearch windows overlap. The watch list is deliberately targeted, not global, to keep audit volume low on a box running ~200 services.
  • Alert-only quarantine-prep (C): whenever the daemon jails a process it also appends an alert (api/alerts.build_alert) to the shared SQLite-backed store (api/alertstore.py, /var/lib/secubox/antirootkit/alerts.db) — the daemon (sbx-antirootkitd.service) and the API (secubox-antirootkit.service) are separate processes, so this store cannot be a plain in-memory list; GET /alerts returns it, most-recent-first. POST /quarantine-prep NEVER executes chmod/cp/nft/systemctl itself — it only returns an operator-reviewable plan (api/quarantine.py) that a human runs by hand. The web panel is served at /antirootkit/.

SCAFFOLDED — v1.1 follow-up (not yet running automatically)

  • Integrity wrap (B): api/integrity.py wraps debsums/rkhunter and the module Recommends aide, rkhunter and chkrootkit alongside a hard debsums dependency, but no .timer schedules a scan yet in this release. Do not assume integrity scanning runs automatically until that timer ships.

Runtime topology

  • secubox-antirootkit.service — FastAPI dashboard (status/execlog/alerts/ quarantine-prep) on its own /run/secubox/antirootkit.sock, no aggregator dependency, runs as the confined secubox-antirootkit system user.
  • sbx-antirootkitd.service — the exec-watcher daemon (api/daemon.py), tails ausearch -k sbx_exec and jails unknown execs via sudo into the ctl. NoNewPrivileges=no (needed for the scoped sudo call).
  • sbx-untrusted.slice — top-level (cgroup-root) slice; must stay unnested so socket cgroupv2 level 1 "sbx-untrusted.slice" in the nft rule keeps matching.

Prerequisite (out-of-package, apt/boot)

auditd must actually be running (systemctl enable --now auditd) and the kernel must support cgroup v2 unified hierarchy for the anti-escape jail to take effect; this package installs the config/rules but does not itself change the box's cgroup boot mode.