Sensor base 0.76.6

.gitattributes

@@ -15,7 +15,9 @@ logs text eol=lf
 
 *.db binary
 *.json -text
+*.json.db -text
 *.csv binary
 *.zip binary
 *.index binary
-*.log binary
+*.log binary
+*.idx binary

.github/workflows/go.yml

@@ -1,65 +1,47 @@
-# Only trigger when a PR is committed.
+# Only trigger when a PR is committed or manually.
 name: Linux Build All Arches
+#on: [pull_request]
 on:
   pull_request:
     types: [closed]
-#    branches:
-#      - master
+    branches:
+      - master
+  workflow_dispatch:
 
 jobs:
   build:
-    if: github.event.pull_request.merged
+    if: github.event.pull_request.merged || github.event_name == 'workflow_dispatch'
     name: Build
-    runs-on: ubuntu-18.04
+    # We used to build on ubuntu-18.04 but that is now deprecated by
+    # GitHub. Earlier distributions will have to use the musl build.
+    runs-on: ubuntu-22.04
     steps:
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        submodules: recursive
 
-    - uses: actions/setup-go@v2
+    - name: Set up Go 1.25
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
-        go-version: '^1.17'
+        go-version: '^1.25'
 
-    - run: go version
+        # Caching seems to really slow down the build due to the time
+        # taken to save the cache.
+        cache: false
 
-#    - uses: actions/cache@v2
-#      with:
-#        # In order:
-#        # * Module download cache
-#        # * Build cache (Linux)
-#        # * Build cache (Mac)
-#        # * Build cache (Windows)
-#        path: |
-#          ~/go/pkg/mod
-#          ~/.cache/go-build
-#          ~/Library/Caches/go-build
-#          %LocalAppData%\go-build
-#        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-#        restore-keys: |
-#          ${{ runner.os }}-go-
+    - run: go version
 
     - name: Get dependencies
       run: |
         go get -v -t -d ./...
-        sudo apt-get install mingw-w64-x86-64-dev gcc-mingw-w64-x86-64 gcc-mingw-w64
-
-    - name: Use Node.js v12
-      uses: actions/setup-node@v1
-      with:
-        node-version: 12
+        sudo apt-get update
+        sudo apt-get upgrade
+        sudo apt-get install mingw-w64-x86-64-dev gcc-mingw-w64-x86-64 gcc-mingw-w64 gcc-aarch64-linux-gnu libsystemd-dev clang-12 llvm libelf-dev git make libzstd-dev
 
-    - name: Cache node-modules
-      uses: actions/cache@v2
-      env:
-        cache-name: cache-node-modules
-      with:
-        path: |
-          **/node_modules/
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
-        restore-keys: |
-          ${{ runner.os }}-build-${{ env.cache-name }}-
-          ${{ runner.os }}-build-
-          ${{ runner.os }}-
+    - name: Use Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
 
     - name: npm install gui
       run: |
@@ -72,15 +54,21 @@ jobs:
       # Uncomment the architectures you want here. NOTE: DarwinBase
       # does not include yara or modules with C compilers needed.
       run: |
-        mkdir ./output/
+        mkdir -p ./output/ ./third_party/libbpfgo/output
         export PATH=$PATH:~/go/bin/
+        go run make.go -v UpdateDependentTools
+        go run make.go -v Linux
+        BUILD_BPF_PLUGINS=0 go run make.go -v Linux
+        go run make.go -v Linux
+        cp vql/linux/bpf/vmlinux_h/x86_64-vmlinux.h third_party/libbpfgo/output/vmlinux.h
+        BUILD_BPF_PLUGINS=1 go run make.go -v Linux
         go run make.go -v Linux
+        go run make.go -v LinuxArm64
         go run make.go -v Windows
         go run make.go -v Windowsx86
-        go run make.go -v DarwinBase
 
     - name: StoreBinaries
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
       with:
-        name: Binaries.zip
+        name: Binaries
         path: output

.github/workflows/linux.yml

@@ -0,0 +1,59 @@
+# Only trigger when a PR is committed.
+name: Linux
+on: [pull_request]
+
+jobs:
+  build:
+    name: Test
+    # We used to build on ubuntu-18.04 but that is now deprecated by
+    # GitHub. Earlier distributions will have to use the musl build.
+    runs-on: ubuntu-20.04
+    steps:
+
+    - name: Check out code and submodules into the Go module directory
+      uses: actions/checkout@v2
+      with:
+        submodules: recursive
+
+    - uses: actions/setup-go@v2
+      with:
+        go-version: '^1.19'
+
+    - run: go version
+
+    - name: Get dependencies
+      run: |
+        go get -v -t -d ./...
+        sudo apt-get update
+        sudo apt-get install libsystemd-dev clang-12 llvm libelf-dev git make libzstd-dev
+
+    - name: Build GUI-less binary
+      run: |
+        mkdir ./output/
+        export PATH=$PATH:~/go/bin/
+        make linux_bare
+
+    - name: Run built-in testcases
+      run: |
+        echo "Running built-in tests."
+        go test -race -v --tags server_vql $(go list ./... | grep -v vql/linux/bpf)
+
+    - name: Test Golden Generic
+      if: always()
+      run: |
+        echo "Running OS generic tests."
+
+        output/velociraptor* -v golden artifacts/testdata/server/testcases/ --env srcDir=`pwd` --config artifacts/testdata/windows/test.config.yaml
+
+    - name: Test Golden Linux
+      if: always()
+      run: |
+        echo "Running Linux tests."
+
+        output/velociraptor* -v golden artifacts/testdata/linux/ --env srcDir=`pwd` --config artifacts/testdata/windows/test.config.yaml
+
+    - name: StoreBinaries
+      uses: actions/upload-artifact@v4
+      with:
+        name: Binaries.zip
+        path: output

.github/workflows/musl.yaml

@@ -0,0 +1,78 @@
+name: Linux Build Musl Static
+#on: [ pull_request ]
+on:
+  pull_request:
+    types: [closed]
+  workflow_dispatch:
+
+jobs:
+  build:
+    permissions:
+      packages: write
+      contents: read
+
+    # Only trigger when a PR is committed or manually triggered.
+    if: github.event.pull_request.merged || github.event_name == 'workflow_dispatch'
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+    - name: Set up Go 1.25
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+      with:
+        go-version: '^1.25'
+
+    - run: go version
+
+    - name: Get dependencies
+      run: |
+        go get -v -t -d ./...
+        sudo apt-get update
+        sudo apt-get install -y zip build-essential pkg-config libssl-dev gcc-aarch64-linux-gnu
+
+    - name: Install Musl
+      run: |
+        wget https://musl.libc.org/releases/musl-1.2.5.tar.gz
+        tar -xvzf musl-1.2.5.tar.gz
+        cd musl-1.2.5
+        ./configure
+        sudo make install
+        cd ..
+
+    - name: Use Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+
+    - name: npm install gui
+      run: |
+            cd gui/velociraptor/
+            npm install
+            npm run build
+            cd ../../
+
+    - name: Build Musl Binary
+      run: |
+        mkdir ./output/
+        export PATH=$PATH:~/go/bin/:/usr/local/musl/bin
+        go run make.go -v UpdateDependentTools
+        go run make.go -v LinuxMusl
+        go run make.go -v LinuxSumo
+        go run make.go -v Linux
+        go run make.go -v LinuxArm64
+
+    - name: Build and push container image
+      if: env.GIT_DOCKER_PAT
+      env:
+        GIT_DOCKER_PAT: ${{ secrets.GIT_DOCKER_PAT }}
+      run: |
+        echo $GIT_DOCKER_PAT | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+        export PATH=$PATH:~/go/bin/:/usr/local/musl/bin
+        go run make.go -v Container
+
+    - name: StoreBinaries
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1
+      with:
+        name: Binaries
+        path: output