execsurface-model 0.1.0-alpha.2

Raw observation model for AETHER X ExecSurface
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

//! Backend-independent canonical execution-surface model.
//!
//! These types deliberately exclude PIDs, TIDs, timestamps and raw event
//! sequence numbers.

use serde::{Deserialize, Serialize};

use crate::{FileOperation, SpawnMechanism};

pub const CANONICAL_SURFACE_SCHEMA_VERSION: u32 = 2;
pub const NORMALIZATION_PROFILE_VERSION: u32 = 2;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct CanonicalSurface {
    pub schema_version: u32,
    pub normalization: NormalizationMetadata,
    pub effects: Vec<CanonicalEffect>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct NormalizationMetadata {
    pub profile_version: u32,
    pub semantic_roots: Vec<String>,
}

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
pub struct CanonicalExecutable {
    pub path: CanonicalPath,
    pub family: String,
}

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
pub struct CanonicalPath {
    pub value: String,
    pub class: PathClass,
    pub resolution: PathResolution,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PathClass {
    Workspace,
    Home,
    CredentialSensitive,
    Temp,
    RunTemp,
    Cache,
    System,
    Device,
    OutsideDeclaredRoots,
    Unknown,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PathResolution {
    Lexical,
    RelativeUnresolved,
    ContainsParentTraversal,
    KernelFdResolved,
}

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(tag = "event_type", rename_all = "snake_case")]
pub enum CanonicalEffect {
    ProcessSpawn {
        actor: Option<CanonicalExecutable>,
        mechanism: SpawnMechanism,
    },
    ProcessExec {
        from: Option<CanonicalExecutable>,
        executable: CanonicalExecutable,
    },
    FilePathAccess {
        actor: Option<CanonicalExecutable>,
        execution_chain: Vec<CanonicalExecutable>,
        operation: FileOperation,
        target: CanonicalPath,
        open_intent: Option<OpenIntent>,
    },
    FileRename {
        actor: Option<CanonicalExecutable>,
        execution_chain: Vec<CanonicalExecutable>,
        from: CanonicalPath,
        to: CanonicalPath,
    },
    NetworkConnectAttempt {
        actor: Option<CanonicalExecutable>,
        execution_chain: Vec<CanonicalExecutable>,
        endpoint: CanonicalNetworkEndpoint,
    },
}

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
pub struct OpenIntent {
    pub read: bool,
    pub write: bool,
    pub create: bool,
    pub truncate: bool,
    pub append: bool,
    pub path_only: bool,
    pub resolve_flags: u64,
    pub other_flags: u64,
}

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(tag = "address_family", rename_all = "snake_case")]
pub enum CanonicalNetworkEndpoint {
    Inet { ip: String, port: u16 },
    Inet6 { ip: String, port: u16 },
    Unix { path: Option<CanonicalPath> },
    Other { family: u16 },
}