[Auditbeat] scanner honor include_files (#27722)

leehinman · web-flow · commit c0b3d734c8ae · 2021-09-09T10:06:19.000-05:00
* [Auditbeat] scanner honor include_files - If included_path is set and file is not an included path then it is skipped - directories are included even if they don't match included path because the contents might - change test regex to work on linux, mac and windows Closes #27273
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -217,6 +217,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887]
 - system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033] {pull}19764[19764]
 - system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
+- file_integrity: honor include_files when doing initial scan. {issue}27273[27273] {pull}27722[27722]
 
 *Filebeat*
 
diff --git a/auditbeat/module/file_integrity/metricset_test.go b/auditbeat/module/file_integrity/metricset_test.go
@@ -258,7 +258,7 @@ func TestIncludedExcludedFiles(t *testing.T) {
 	}
 
 	config := getConfig(dir)
-	config["include_files"] = []string{`\.ssh/`}
+	config["include_files"] = []string{`\.ssh`}
 	config["recursive"] = true
 	ms := mbtest.NewPushMetricSetV2(t, config)
 
diff --git a/auditbeat/module/file_integrity/scanner.go b/auditbeat/module/file_integrity/scanner.go
@@ -140,6 +140,11 @@ func (s *scanner) walkDir(dir string, action Action) error {
 			}
 			return nil
 		}
+
+		if !info.IsDir() && !s.config.IsIncludedPath(path) {
+			return nil
+		}
+
 		defer func() { startTime = time.Now() }()
 
 		event := s.newScanEvent(path, info, err, action)

Original file line number	Diff line number	Diff line change
`@@ -258,7 +258,7 @@ func TestIncludedExcludedFiles(t *testing.T) {`
`258`	`258`	`}`
`259`	`259`
`260`	`260`	`config := getConfig(dir)`
`261`		- config["include_files"] = []string{`\.ssh/`}
	`261`	+ config["include_files"] = []string{`\.ssh`}
`262`	`262`	`config["recursive"] = true`
`263`	`263`	`ms := mbtest.NewPushMetricSetV2(t, config)`
`264`	`264`
Original file line number	Diff line number	Diff line change
`@@ -140,6 +140,11 @@ func (s *scanner) walkDir(dir string, action Action) error {`
`140`	`140`	`}`
`141`	`141`	`return nil`
`142`	`142`	`}`
	`143`	`+`
	`144`	`+ if !info.IsDir() && !s.config.IsIncludedPath(path) {`
	`145`	`+ return nil`
	`146`	`+ }`
	`147`	`+`
`143`	`148`	`defer func() { startTime = time.Now() }()`
`144`	`149`
`145`	`150`	`event := s.newScanEvent(path, info, err, action)`