STAC-3401 blacklisted processes

Vagrantfile

@@ -49,6 +49,10 @@ machines = {
         :box => 'mwrock/Windows2016',
         :ip => '192.168.56.120',
     },
+    :win12 => {
+        :box => 'mwrock/Windows2012R2',
+        :ip => '192.168.56.121',
+    },
 }
 
 Vagrant.configure("2") do |config|

pkg/config/config_template.yaml

@@ -621,7 +621,49 @@ process_config:
     process: 30
     connections: 30
 #   A list of regex patterns that will exclude a process if matched.
-#   blacklist_patterns:
+  blacklist_patterns:
+  # Linux Specific patterns
+    - "^-bash"
+    - "^/bin/bash"
+    - "^/lib/systemd/"
+    - "^pickup"
+    - "^/sbin/"
+    - "^qmgr"
+    - "^sshd:"
+    - "^/usr/bin/bash"
+    - "^/usr/bin/dbus-daemon"
+    - "^/usr/bin/vi(?:m|m.basic)?$"
+    - "^/usr/bin/tail"
+    - "^/usr/lib/systemd/"
+    - "^/usr/sbin/"
+    - "^\\(sd-pam\\)"
+  # Windows Specific patterns
+    - "cmd.exe"
+    - "conhost.exe"
+    - "DllHost.exe"
+    - "dwm.exe"
+    - "Explorer.EXE"
+    - "lsass.exe"
+    - "msdtc.exe"
+    - "SearchUI.exe"
+    - "sihost.exe"
+    - "smartscreen.exe"
+    - "svchost.exe"
+    - "taskhostw.exe"
+    - "tasklist.exe"
+    - "VBoxService.exe"
+    - "vim.exe"
+    - "wininit.exe"
+    - "winlogon.exe"
+    - "wlms.exe"
+    - "wmiprvse.exe"
+#    Should be ignored, but gets reported with an empty command line
+#    - "sppsvc.exe"
+#    - "services.exe"
+#    - "csrss.exe"
+#    - "wininit.exe"
+#    - "System"
+#    - "smss.exe"
 #   How many check results to buffer in memory when POST fails. The default is usually fine.
   queue_size: 10
 #   The maximum number of file descriptors to open when collecting net connections.

test/molecule-role/molecule/default/tests/test_receiver.py

@@ -291,4 +291,17 @@ def _component_data(type_name, external_id_prefix, command):
         assert _component_data("process", "urn:process:/agent-ubuntu", "/opt/stackstate-agent/bin/agent/agent")["hostTags"] == ["os:linux"]
         assert _component_data("process", "urn:process:/agent-win", "\"C:\\Program Files\\StackState\\StackState Agent\\embedded\\agent.exe\"")["hostTags"] == ["os:windows"]
 
+        # assert that process filtering works correctly
+        # fedora specific process filtering
+        assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/sshd") is None
+        assert _component_data("process", "urn:process:/agent-fedora", "/usr/sbin/dhclient") is None
+        assert _component_data("process", "urn:process:/agent-fedora", "/usr/lib/systemd/systemd-journald") is None
+        # ubuntu specific process filtering
+        assert _component_data("process", "urn:process:/agent-ubuntu", "/usr/sbin/sshd") is None
+        assert _component_data("process", "urn:process:/agent-ubuntu", "/lib/systemd/systemd-journald") is None
+        assert _component_data("process", "urn:process:/agent-ubuntu", "/sbin/agetty") is None
+        # windows specific process filtering
+        assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\svchost.exe") is None
+        assert _component_data("process", "urn:process:/agent-win", "winlogon.exe") is None
+        assert _component_data("process", "urn:process:/agent-win", "C:\\Windows\\system32\\wlms\\wlms.exe") is None
     util.wait_until(wait_for_components, 30, 3)