-
Notifications
You must be signed in to change notification settings - Fork 598
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add kernel_rootkit field to finding's list of attributes (#3699)
docs: miscellaneous style improvements PiperOrigin-RevId: 493119809 Source-Link: googleapis/googleapis@6aff678 Source-Link: googleapis/googleapis-gen@ee52194 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLXNlY3VyaXR5Y2VudGVyLy5Pd2xCb3QueWFtbCIsImgiOiJlZTUyMTk0MGEwMTdmMzkzZmNlNzczMWU0YzIyYTQzYWZmNmIwMDBlIn0= See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Benjamin E. Coe <bencoe@google.com>
- Loading branch information
3 people
authored
Dec 6, 2022
1 parent
35b703f
commit 693d417
Showing
24 changed files
with
806 additions
and
100 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
62 changes: 62 additions & 0 deletions
62
...es/google-cloud-securitycenter/protos/google/cloud/securitycenter/v1/kernel_rootkit.proto
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| // Copyright 2022 Google LLC | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| syntax = "proto3"; | ||
|
|
||
| package google.cloud.securitycenter.v1; | ||
|
|
||
| option csharp_namespace = "Google.Cloud.SecurityCenter.V1"; | ||
| option go_package = "google.golang.org/genproto/googleapis/cloud/securitycenter/v1;securitycenter"; | ||
| option java_multiple_files = true; | ||
| option java_outer_classname = "KernelRootkitProto"; | ||
| option java_package = "com.google.cloud.securitycenter.v1"; | ||
| option php_namespace = "Google\\Cloud\\SecurityCenter\\V1"; | ||
| option ruby_package = "Google::Cloud::SecurityCenter::V1"; | ||
|
|
||
| // Kernel mode rootkit signatures. | ||
| message KernelRootkit { | ||
| // Rootkit name when available. | ||
| string name = 1; | ||
|
|
||
| // True if unexpected modifications of kernel code memory are present. | ||
| bool unexpected_code_modification = 2; | ||
|
|
||
| // True if unexpected modifications of kernel read-only data memory are | ||
| // present. | ||
| bool unexpected_read_only_data_modification = 3; | ||
|
|
||
| // True if `ftrace` points are present with callbacks pointing to regions | ||
| // that are not in the expected kernel or module code range. | ||
| bool unexpected_ftrace_handler = 4; | ||
|
|
||
| // True if `kprobe` points are present with callbacks pointing to regions | ||
| // that are not in the expected kernel or module code range. | ||
| bool unexpected_kprobe_handler = 5; | ||
|
|
||
| // True if kernel code pages that are not in the expected kernel or module | ||
| // code regions are present. | ||
| bool unexpected_kernel_code_pages = 6; | ||
|
|
||
| // True if system call handlers that are are not in the expected kernel or | ||
| // module code regions are present. | ||
| bool unexpected_system_call_handler = 7; | ||
|
|
||
| // True if interrupt handlers that are are not in the expected kernel or | ||
| // module code regions are present. | ||
| bool unexpected_interrupt_handler = 8; | ||
|
|
||
| // True if unexpected processes in the scheduler run queue are present. Such | ||
| // processes are in the run queue, but not in the process task list. | ||
| bool unexpected_processes_in_runqueue = 9; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.