diff --git a/action.yml b/action.yml index 7587fda..4d5e2e6 100644 --- a/action.yml +++ b/action.yml @@ -24,6 +24,10 @@ inputs: allowed-hosts: description: A comma-separated list of domain names required: false + file-integrity: + description: Enable file integrity module in prevent mode + required: false + default: 'false' ignored-ip-nets: description: | A comma or white space separated list of ignored IP networks in CIDR diff --git a/dist/main/index.js b/dist/main/index.js index a2add7f..63a1552 100644 --- a/dist/main/index.js +++ b/dist/main/index.js @@ -3550,6 +3550,7 @@ function getActionConfig() { preventionMode: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getBooleanInput('prevent'), allowedIPs: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getInput('allowed-ips'), allowedHosts: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getInput('allowed-hosts'), + fileIntegrity: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getBooleanInput('file-integrity'), ignoredIPNets: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getInput('ignored-ip-nets'), applyFsEvents: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getBooleanInput('apply-fs-events'), clientId: _actions_core__WEBPACK_IMPORTED_MODULE_0__.getInput('client-id'), @@ -3620,6 +3621,7 @@ async function run(config) { CIMON_PREVENT: config.cimon.preventionMode, CIMON_ALLOWED_IPS: config.cimon.allowedIPs, CIMON_ALLOWED_HOSTS: config.cimon.allowedHosts, + CIMON_FILE_INTEGRITY: config.cimon.fileIntegrity, CIMON_IGNORED_IP_NETS: config.cimon.ignoredIPNets, CIMON_REPORT_GITHUB_JOB_SUMMARY: config.github.jobSummary, CIMON_REPORT_PROCESS_TREE: config.report.processTree, @@ -3634,6 +3636,11 @@ async function run(config) { CIMON_ENABLE_GITHUB_NETWORK_POLICY: true, }; + if (config.cimon.fileIntegrity) { + // Feature flags that required for the file integrity module. + env.CIMON_FEATURE_GATES = 'FSSensor=1,DataAnalysis=1'; + } + var retval; const sudo = await sudoExists(); const options = { diff --git a/src/main/index.js b/src/main/index.js index d820c8c..e7c961b 100644 --- a/src/main/index.js +++ b/src/main/index.js @@ -28,6 +28,7 @@ function getActionConfig() { preventionMode: core.getBooleanInput('prevent'), allowedIPs: core.getInput('allowed-ips'), allowedHosts: core.getInput('allowed-hosts'), + fileIntegrity: core.getBooleanInput('file-integrity'), ignoredIPNets: core.getInput('ignored-ip-nets'), applyFsEvents: core.getBooleanInput('apply-fs-events'), clientId: core.getInput('client-id'), @@ -98,6 +99,7 @@ async function run(config) { CIMON_PREVENT: config.cimon.preventionMode, CIMON_ALLOWED_IPS: config.cimon.allowedIPs, CIMON_ALLOWED_HOSTS: config.cimon.allowedHosts, + CIMON_FILE_INTEGRITY: config.cimon.fileIntegrity, CIMON_IGNORED_IP_NETS: config.cimon.ignoredIPNets, CIMON_REPORT_GITHUB_JOB_SUMMARY: config.github.jobSummary, CIMON_REPORT_PROCESS_TREE: config.report.processTree, @@ -112,6 +114,11 @@ async function run(config) { CIMON_ENABLE_GITHUB_NETWORK_POLICY: true, }; + if (config.cimon.fileIntegrity) { + // Feature flags that required for the file integrity module. + env.CIMON_FEATURE_GATES = 'FSSensor=1,DataAnalysis=1'; + } + var retval; const sudo = await sudoExists(); const options = {