Rebase all SUSE changes onto upstream v0.76.6 - #147

Open

djoreilly wants to merge 142 commits into

SUSE:sensor-base-0.76.6from

djoreilly:sensor-base-0.76.6

Commits on Jun 22, 2026

build: create magefiles/ directory

jeffmahoney
authored and
djoreilly
committed
bcd1e2d
magefile.go: use current architecture for Linux builds

jeffmahoney
authored and
djoreilly
committed
387aada
Add systemd-dev as build dependency for github workflow

jeffmahoney
authored and
djoreilly
committed
26726bd
github: run testcases on Linux builds in new workflow

jeffmahoney
authored and
djoreilly
committed
2f8ae10
linux: add lsattr() function to enumerate file attributes

lorddoskias
authored and
djoreilly
committed
7dd4b7b
Linux.Detection.ImmutableFiles: Enumerate immutable files under a path

lorddoskias
authored and
djoreilly
committed
a7882f5
Add parser to read systemd journal on Linux

jeffmahoney
authored and
djoreilly
committed
d569ed2
Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal

jeffmahoney
authored and
djoreilly
committed
72d7911
Update the Linux.Events.SSHLogin artifact to scan the systemd journal

jeffmahoney
authored and
djoreilly
committed
243e4ef
SUSE: Add SSHLogin artifacts

jeffmahoney
authored and
djoreilly
committed
26990ad
SSHLogin: require _TRANSPORT != 'kernel' from watch_journal()

jeffmahoney
authored and
djoreilly
committed
272793f

Commits on Jun 23, 2026

vql/linux/bpf: add support to add bpf plugins for Linux

jeffmahoney
authored and
djoreilly
committed
a193a87
vql/linux/bpf/tcpsnoop: Add tcpsnoop plugin

authored and
djoreilly
committed
f1e010a
vql/linux/bpf/dnssnoop: Add dnssnoop() plugin

authored and
djoreilly
committed
7953700
vql/linux/bpf/chattrsnoop: Add plugin to catch changes to inode attributes

authored and
djoreilly
committed
afb7d5d
vql/linux/bpflib: add sample vmlinux.h includes for test builds

jeffmahoney
authored and
djoreilly
committed
2dcb129
Add custom artifacts for login and logout attempts recorded by auditd

guangyee
authored and
djoreilly
committed
8af1252
Linux.Events.ProcessExecutions: catch 32-bit execve calls

chajain
authored and
djoreilly
committed
a5ebe5f
Add artifact to monitor user group updates (#24)

guangyee
authored and
djoreilly
committed
efd1cb3
file_store/directory/buffer: add direct-serialized interface

jeffmahoney
authored and
djoreilly
committed
faa2e3c
utils/refcount: add simple refcount implementation

jeffmahoney
authored and
djoreilly
committed
064fc94
file_store/directory/listener_bytes: Add listener to use serialized interface

jeffmahoney
authored and
djoreilly
committed
738963f
vql/linux/audit: use go-libaudit v2 for live audit message processing

jeffmahoney
authored and
djoreilly
committed
c24562d
vql/linux/audit: rearchitect plugin for scalability

jeffmahoney
authored and
djoreilly
committed
21164d2
Extend audit artifacts to use new interface

chajain
authored and
djoreilly
committed
6d5160a
vql/linux/cronsnoop: Add cronsnoop() plugin

authored and
djoreilly
committed
e042aba
Updating the NewFiles and ProcessStatuses Artifacts

chajain
authored and
djoreilly
committed
1ddfcca
Add Linux.Sys.Bash to Server.Monitor.Shell artifact

jeffmahoney
authored and
djoreilly
committed
a44726d
rpm: introduce rpm vql plugin

jeffmahoney
authored and
djoreilly
committed
28dab6a
vql/functions/hash: cache results on Linux

jeffmahoney
authored and
djoreilly
committed
5eaa142
hash: fix nil pointer dereference panic
djoreilly
committed
3d78319
Fix shadowed variable in hash.go
djoreilly
committed
5939624
SUSE: add Docker files

jeffmahoney
authored and
djoreilly
committed
d5fb773
SUSE: Add docker-compose environment

jeffmahoney
authored and
djoreilly
committed
53f3f39
cronsnoop: fix panic when crontab has empty line
djoreilly
committed
f41a73a
vql/linux/audit: actually add test cases

jeffmahoney
authored and
djoreilly
committed
f441797
vql/linux/audit: don't overload EAGAIN

jeffmahoney
authored and
djoreilly
committed
67f3199
vql/linux/audit: gofumpt -extra

jeffmahoney
authored and
djoreilly
committed
e7310ab
vql/linux/audit: fix staticcheck checks

jeffmahoney
authored and
djoreilly
committed
fba6610
bpf: add libbpf/include/uapi to the include path for bpf.h

jeffmahoney
authored and
djoreilly
committed
bfe03a3
bpf: only build libbpf in the go generate stage

jeffmahoney
authored and
djoreilly
committed
386650a
vql/linux/audit: fix test suite handling

jeffmahoney
authored and
djoreilly
committed
dc82507
vql/linux/audit: Clean up context handling in shutdown goroutine

jeffmahoney
authored and
djoreilly
committed
da183b8
vql/linux/audit: mainEventLoop shouldn't exit on canceled context

jeffmahoney
authored and
djoreilly
committed
ed5fc7d
vql/linux/audit: Make messageQueue lifetime more apparent

jeffmahoney
authored and
djoreilly
committed
13f28b9
vql/linux/audit: limit messageQueue scope to within runService

jeffmahoney
authored and
djoreilly
committed
ab4bca1
vql/linux/audit: Close reassembler if NewListenerBytes fails

jeffmahoney
authored and
djoreilly
committed
7f46b9c
vql/linux/audit: Fix typo causing double-lock in notifyMissingRule

jeffmahoney
authored and
djoreilly
committed
5eaa779
vql/linux/audit: Fix DeleteRule in mock client

jeffmahoney
authored and
djoreilly
committed
c90729e
vql/linux/audit: Change listener lifecycle to enable testing

jeffmahoney
authored and
djoreilly
committed
9813963
vql/linux/audit: Fix audit client lifecycle

jeffmahoney
authored and
djoreilly
committed
167e9bb
vql/linux/audit: Add more client failure test cases

jeffmahoney
authored and
djoreilly
committed
45ff56d
vql/linux/audit: tests, check various rule scenarios

jeffmahoney
authored and
djoreilly
committed
4ce4212
vql/linux/audit: simplify polling in listener

jeffmahoney
authored and
djoreilly
committed
f7ac8a4
vql/linux/audit: make stats reporting separate from debug prints

jeffmahoney
authored and
djoreilly
committed
aa49772
vql/linux/audit: make explicit that goroutines in the main errgroup don't return errors

jeffmahoney
authored and
djoreilly
committed
bbb1cce
vql/linux/audit: handle top-level cancelation properly

jeffmahoney
authored and
djoreilly
committed
a54c216
vql/linux/audit: remove unused waitgroup from main event loop

jeffmahoney
authored and
djoreilly
committed
bffc1dc
vql/linux/audit: remove unnecessary error handling for reassembler

jeffmahoney
authored and
djoreilly
committed
b085ce5
vql/linux/audit: pull parts of shutdown into shutdown watcher

jeffmahoney
authored and
djoreilly
committed
85b25ce
vql/linux/audit: add auditService.Log()

jeffmahoney
authored and
djoreilly
committed
1b1eda6
vql/linux/audit: limit messageQueue to within runService

jeffmahoney
authored and
djoreilly
committed
178ec50
vql/linux/audit: fix goroutine lifetimes

jeffmahoney
authored and
djoreilly
committed
f5a93c3
vql/linux/audit: fix shutdown races

jeffmahoney
authored and
djoreilly
committed
2ee3eb6
vql/linux/sdjournal: Fix open/close lifetimes

jeffmahoney
authored and
djoreilly
committed
a94dce3
velociraptor: add dummy main function for mage

jeffmahoney
authored and
djoreilly
committed
8b7b33b
sdjournal: Correctly seek to current tail

xTeixeira
authored and
djoreilly
committed
c4c3d52
Fix audit filter key typo in Linux.Events.NewFiles
djoreilly
committed
f1d3e9f
Move NewFiles artifact to SUSE
djoreilly
committed
d4d1fca
Fix SystemLogins artifacts file extensions
djoreilly
committed
9de58e9
Fix absolute path case in ExecutableFiles artifact
djoreilly
committed
cb12b1d
Add artifact to collect systemd service events
djoreilly
committed
1a3c9bb
Add hash fields to Linux.Events.ProcessExecutions
djoreilly
committed
07d23ad
Add SUSE.Linux.Events.NewZeroSizeLogFile artifact
djoreilly
committed
78376cc
SUSE.Linux.Events.Crontab: Add task execution artifacts

xTeixeira
authored and
djoreilly
committed
368930a
Add artifact to monitor ssh authorized_keys files
djoreilly
committed
9198b6c
Add SUSE.Linux.Events.Timers artifact

xTeixeira
authored and
djoreilly
committed
2278ab7
Fix Linux.Events.ImmutableFile not showing hash in GUI
djoreilly
committed
2690819
chattrsnoop: don't log.Fatal() on hash error
djoreilly
committed
a899717
chattrsnoop: handle os.Stat() error properly
djoreilly
committed
37768ac
chattrsnoop: include full error details in logs
djoreilly
committed
bcb9592
Make ImmutableFile artifact consistent with others
djoreilly
committed
a232c36
Move ImmutableFile artifact to SUSE
djoreilly
committed
56f1fc3
Add artifact to collect new hidden files
djoreilly
committed
7ec00e6
Add server artifact to delete old client data on server
djoreilly
committed
3048b58
Add client monitoring artifact for RPMs
djoreilly
committed
3620ed4
Add SUSE.Linux.Sys.At artifact

xTeixeira
authored and
djoreilly
committed
f0fea63
Raise client connection log level to ERROR
djoreilly
committed
1941d4a
Rename SUSE specific artifacts to have SUSE prefix
djoreilly
committed
1ab772a
tcpsnoop: fix garbled results on s390
djoreilly
committed
2f98d00
Add artifact to collect new files without owner
djoreilly
committed
23a4269
bpf plugins: set a logger callback
djoreilly
committed
632c924
tcpsnoop: remove unused filtering code
djoreilly
committed
0fc22b2
chattrsnoop: fix bpf_probe_read for s390
djoreilly
committed
73fbdba
chattrsnoop: fix immutable attribute set on s390
djoreilly
committed
0bc592f
dnssnoop: fix htons() so it works on s390 too
djoreilly
committed
03ac165
dnssnoop: fix loading protocol from ip header on s390
djoreilly
committed
7c404ba
chattrsnoop: replace global variables with locals
djoreilly
committed
88dfea5
Fix systemd Services artifact missing events
djoreilly
committed
d7078bf
Fix undefined binary.NativeEndian build errors
djoreilly
committed
caabc4f
Fix services artifact symbol pid not found error
djoreilly
committed
f379490
chattrsnoop: fix do_vfs_ioctl kprobe failure
djoreilly
committed
9858284
chattrsnoop: fix wrong FS_IOC_SETFLAGS value for ppc
djoreilly
committed
4d35cf3
chattrsnoop: correct read size for flags
djoreilly
committed
2a88c61
github: run linux unit tests
djoreilly
committed
101bcb0
sdjournal: fix package causing test failures
djoreilly
committed
a8c9061
audit: prevent Windows loading audit package
djoreilly
committed
a40c32c
audit: fix race in subscriber
djoreilly
committed
536881d
audit: fix audit client data races
djoreilly
committed
5b3a298
github: fix deprecated upload artifact
djoreilly
committed
d2c5121
audit s390x: fix arch filter rules errors
djoreilly
committed
dcb21b5
rpm plugin: fix ndb magic error
djoreilly
committed
8887079
RPM artifact: start checks immediately on artifact load
djoreilly
committed
2b2cba3
audit: fix auditBuf allocation and go vet warnings
djoreilly
committed
b0c30db
audit: reduce FileBufferLeaseSize to ease GC overhead
djoreilly
committed
be7dd4a
Linux.Events.ProcessExecutions: remove parent cmdline
djoreilly
committed
79e4b7e
tcpsnoop: fix missing ipv6 outbound connections
djoreilly
committed
2148b67
tcpsnoop: fix ipv6 local and remote addresses order
djoreilly
committed
9669d12
chattrsnoop: move hashing from plugin to artifact
djoreilly
committed
121ef0f
chattrsnoop: fix files not getting closed
djoreilly
committed
e67db8b
bpf plugins: add context to error logs
djoreilly
committed
7885be0
bpf plugins: remove depreciated libbpfgo calls
djoreilly
committed
2c5f986
tcpsnoop: move parsing to its own function
djoreilly
committed
5eba54a
bpf: fix plugins not stopping when context cancelled
djoreilly
committed
c227b64
audit: update go-libaudit dependency for pcc64le arch filter fix
djoreilly
committed
eb1e003
Add execsnoop plugin to capture execve system calls
djoreilly
committed
6e653a3
Use execsnoop plugin in artifacts when possible
djoreilly
committed
4f300c1
audit: fix watch rules in artifacts
djoreilly
committed
f0e3eee
Update go-rpmdb to fix panic
djoreilly
committed
9850b2e
Add plugin and artifact for sending client events to rsyslog
djoreilly
committed
d4bfd7b
Remove SHA1 file signatures
djoreilly
committed
30439c0
Add machine-id to event artifacts
djoreilly
committed
ac50e82
Fix symbol not found errors from SUSE.Linux.Events.Services
djoreilly
committed
1d481ec
Exclude velociraptor tracee ebpf from build
djoreilly
committed
e5835f8
Fix artifacts for different VQL array() behaviour in v0.74+
djoreilly
committed
9c31c75
Fix services artifact systemctl show parse errors
djoreilly
committed
0b9cb9f
Fix SshAuthorizedKeys artifact to work with v0.76
djoreilly
committed
79e36dd

Commits on Jun 24, 2026

Upgrade github.com/ProtonMail/gopenpgp to V3
djoreilly
committed
9c6aff1
Update github.com/cloudflare/circl
djoreilly
committed
3882725
Update golang.org/x/crypto
djoreilly
committed
7697f57

Commits on Jun 25, 2026

Don't create offline yaml tool dependencies
djoreilly
committed
5da807d

Commits on Jul 2, 2026

github: remove windows and update linux
djoreilly
committed
7be3879