Wazuh: FIMv2.0: Duplicated alerts when modifying inode using whodata

[jesusjimsa]

|Wazuh version|Component|Install type|Install method|Platform|
|---|---|---|---|---|
| 3.12 | ossec-syscheckd | Manager/Agent | Sources | CentOS 7 |

Bug description

When modifying the inode of a file in 3319-fim-rework-sqlite, syscheck will insert it in the database as a new entry, but it will keep looking to the previous one to check the changes, causing the creation of as many alerts as changes the user makes to the file.

Output

** Alert 1581368557.537237: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,
2020 Feb 10 21:02:37 wazuh-master->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
File '/testdir_reports/regular' modified
Mode: whodata
Changed attributes: size,mtime,inode,md5,sha1,sha256
Size changed from '1278' to '1295'
Old modification time was: '1581369362', now it is '1581369557'
Old inode was: '17494596', now it is '18313685'
Old md5sum was: '56be1bba9be290cada64247159b2cd43'
New md5sum is : '653f6b95d7d8ea24edbe8b540b479130'
Old sha1sum was: '1cac68820742176448054d8709e247af03ff2147'
New sha1sum is : '2c6fb2365fe45cb0695ae51428e9e1974baf7649'
Old sha256sum was: '819fb39a6cf693736eb67f67d0cf6ff290f4230ea295a1466481cca03d4b666b'
New sha256sum is : '0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65'

Attributes:
 - Size: 1295
 - Permissions: rw-rw-rw-
 - Date: Mon Feb 10 21:19:17 2020
 - Inode: 18313685
 - User: bin (1)
 - Group: bin (1)
 - MD5: 653f6b95d7d8ea24edbe8b540b479130
 - SHA1: 2c6fb2365fe45cb0695ae51428e9e1974baf7649
 - SHA256: 0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65
 - (Audit) User name: root
 - (Audit) Audit name: vagrant
 - (Audit) Effective name: root
 - (Audit) Group name: bin
 - (Audit) Process id: 26755
 - (Audit) Process name: /usr/bin/python3.6

What changed:
5c5
< 1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu
\ No newline at end of file
---
> 1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu1234567890qwertyu
\ No newline at end of file


** Alert 1581368557.541238: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,
2020 Feb 10 21:02:37 wazuh-master->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
File '/testdir_reports/regular' modified
Mode: whodata
Changed attributes: size,mtime,inode,md5,sha1,sha256
Size changed from '1278' to '1295'
Old modification time was: '1581369362', now it is '1581369557'
Old inode was: '17494596', now it is '18313685'
Old md5sum was: '56be1bba9be290cada64247159b2cd43'
New md5sum is : '653f6b95d7d8ea24edbe8b540b479130'
Old sha1sum was: '1cac68820742176448054d8709e247af03ff2147'
New sha1sum is : '2c6fb2365fe45cb0695ae51428e9e1974baf7649'
Old sha256sum was: '819fb39a6cf693736eb67f67d0cf6ff290f4230ea295a1466481cca03d4b666b'
New sha256sum is : '0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65'

Attributes:
 - Size: 1295
 - Permissions: rw-rw-rw-
 - Date: Mon Feb 10 21:19:17 2020
 - Inode: 18313685
 - User: bin (1)
 - Group: bin (1)
 - MD5: 653f6b95d7d8ea24edbe8b540b479130
 - SHA1: 2c6fb2365fe45cb0695ae51428e9e1974baf7649
 - SHA256: 0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65
 - (Audit) User name: root
 - (Audit) Audit name: vagrant
 - (Audit) Effective name: root
 - (Audit) Group name: bin
 - (Audit) Process id: 26755
 - (Audit) Process name: /usr/bin/python3.6

** Alert 1581368557.542620: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,
2020 Feb 10 21:02:37 wazuh-master->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
File '/testdir_reports/regular' modified
Mode: whodata
Changed attributes: size,mtime,inode,md5,sha1,sha256
Size changed from '1278' to '1295'
Old modification time was: '1581369362', now it is '1581369557'
Old inode was: '17494596', now it is '18313685'
Old md5sum was: '56be1bba9be290cada64247159b2cd43'
New md5sum is : '653f6b95d7d8ea24edbe8b540b479130'
Old sha1sum was: '1cac68820742176448054d8709e247af03ff2147'
New sha1sum is : '2c6fb2365fe45cb0695ae51428e9e1974baf7649'
Old sha256sum was: '819fb39a6cf693736eb67f67d0cf6ff290f4230ea295a1466481cca03d4b666b'
New sha256sum is : '0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65'

Attributes:
 - Size: 1295
 - Permissions: rw-rw-rw-
 - Date: Mon Feb 10 21:19:17 2020
 - Inode: 18313685
 - User: bin (1)
 - Group: bin (1)
 - MD5: 653f6b95d7d8ea24edbe8b540b479130
 - SHA1: 2c6fb2365fe45cb0695ae51428e9e1974baf7649
 - SHA256: 0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65
 - (Audit) User name: root
 - (Audit) Audit name: vagrant
 - (Audit) Effective name: root
 - (Audit) Group name: bin
 - (Audit) Process id: 26755
 - (Audit) Process name: /usr/bin/python3.6

** Alert 1581368557.544002: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,
2020 Feb 10 21:02:37 wazuh-master->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
File '/testdir_reports/regular' modified
Mode: whodata
Changed attributes: size,mtime,inode,md5,sha1,sha256
Size changed from '1278' to '1295'
Old modification time was: '1581369362', now it is '1581369557'
Old inode was: '17494596', now it is '18313685'
Old md5sum was: '56be1bba9be290cada64247159b2cd43'
New md5sum is : '653f6b95d7d8ea24edbe8b540b479130'
Old sha1sum was: '1cac68820742176448054d8709e247af03ff2147'
New sha1sum is : '2c6fb2365fe45cb0695ae51428e9e1974baf7649'
Old sha256sum was: '819fb39a6cf693736eb67f67d0cf6ff290f4230ea295a1466481cca03d4b666b'
New sha256sum is : '0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65'

Attributes:
 - Size: 1295
 - Permissions: rw-rw-rw-
 - Date: Mon Feb 10 21:19:17 2020
 - Inode: 18313685
 - User: bin (1)
 - Group: bin (1)
 - MD5: 653f6b95d7d8ea24edbe8b540b479130
 - SHA1: 2c6fb2365fe45cb0695ae51428e9e1974baf7649
 - SHA256: 0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65
 - (Audit) User name: root
 - (Audit) Audit name: vagrant
 - (Audit) Effective name: root
 - (Audit) Group name: bin
 - (Audit) Process id: 26755
 - (Audit) Process name: /usr/bin/python3.6

** Alert 1581368558.545384: - ossec,syscheck,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c.1,hipaa_164.312.c.2,nist_800_53_SI.7,
2020 Feb 10 21:02:38 wazuh-master->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
File '/testdir_reports/regular' modified
Mode: whodata
Changed attributes: size,mtime,inode,md5,sha1,sha256
Size changed from '1278' to '1295'
Old modification time was: '1581369362', now it is '1581369557'
Old inode was: '17494596', now it is '18313685'
Old md5sum was: '56be1bba9be290cada64247159b2cd43'
New md5sum is : '653f6b95d7d8ea24edbe8b540b479130'
Old sha1sum was: '1cac68820742176448054d8709e247af03ff2147'
New sha1sum is : '2c6fb2365fe45cb0695ae51428e9e1974baf7649'
Old sha256sum was: '819fb39a6cf693736eb67f67d0cf6ff290f4230ea295a1466481cca03d4b666b'
New sha256sum is : '0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65'

Attributes:
 - Size: 1295
 - Permissions: rw-rw-rw-
 - Date: Mon Feb 10 21:19:17 2020
 - Inode: 18313685
 - User: bin (1)
 - Group: bin (1)
 - MD5: 653f6b95d7d8ea24edbe8b540b479130
 - SHA1: 2c6fb2365fe45cb0695ae51428e9e1974baf7649
 - SHA256: 0d201488d97dba9217b3b9ee5b93eec9ef40c2324e38f5fc518a0e7ec9edde65
 - (Audit) User name: root
 - (Audit) Audit name: vagrant
 - (Audit) Effective name: root
 - (Audit) Group name: bin
 - (Audit) Process id: 26755
 - (Audit) Process name: /usr/bin/python3.6

Remediation

Check if the path being modified is already pointing to an existing inode. If it is not pointing to an existing inode_id, continue with the insertion as usual. If it is pointing to an existing inode_id:

1. Delete the row
2. Insert the new row
3. Update the inode_idof the path

[jesusjimsa]

I have added a new SQL statement to get the inode_id given a file path.
I have also modified the insert function to check the inode_id and delete the corresponding entry_data entry. At the moment, it isn't checking the inode_id correctly.

[jesusjimsa]

It is working now, it needed inode_id to be 0 to insert instead of update in the fim_db_insert_data function. The pull request is ready for review now.

[jesusjimsa]

Tested in Windows 7 and working correctly

[bah07]

Thanks @jesusjimsa