[linux_proc_extras] Add kernel FIPS mode metric (DataDog#24869)

* [linux_proc_extras] add kernel FIPS mode metric

Signed-off-by: Jared Ledvina <jared.ledvina@datadoghq.com>

* [linux_proc_extras] add type hints and test FIPS procfs path

Signed-off-by: Jared Ledvina <jared.ledvina@datadoghq.com>

---------

Signed-off-by: Jared Ledvina <jared.ledvina@datadoghq.com>

Author: jaredledvina

linux_proc_extras/changelog.d/24869.added

@@ -0,0 +1 @@
+Add the `system.crypto.fips_enabled` metric reporting whether the kernel is running in FIPS mode, read from `/proc/sys/crypto/fips_enabled`.

linux_proc_extras/datadog_checks/linux_proc_extras/linux_proc_extras.py

@@ -37,6 +37,7 @@ def check(self, instance):
         self.get_inode_info()
         self.get_stat_info()
         self.get_entropy_info()
+        self.get_fips_info()
         self.get_process_states()
         if self.instance.get('include_interrupt_metrics', False):
             self.get_interrupts_info()
@@ -48,6 +49,7 @@ def set_paths(self):
             "inode_info": "sys/fs/inode-nr",
             "stat_info": "stat",
             "entropy_info": "sys/kernel/random/entropy_avail",
+            "fips_info": "sys/crypto/fips_enabled",
             "interrupts_info": "interrupts",
         }
 
@@ -79,6 +81,24 @@ def get_entropy_info(self):
             entropy = entropy_info.readline()
             self.gauge('system.entropy.available', float(entropy), tags=self.tags)
 
+    def get_fips_info(self) -> None:
+        fips_path = self.proc_path_map['fips_info']
+        try:
+            with open(fips_path, 'r') as fips_info:
+                fips_enabled = int(fips_info.readline().strip())
+        except FileNotFoundError:
+            self.log.debug(
+                "%s does not exist, the kernel was built without CONFIG_CRYPTO_FIPS "
+                "and cannot be in FIPS mode: reporting 0",
+                fips_path,
+            )
+            fips_enabled = 0
+        except (OSError, ValueError) as e:
+            self.log.warning("Could not determine kernel FIPS mode from %s: %s", fips_path, e)
+            return
+
+        self.gauge('system.crypto.fips_enabled', float(fips_enabled), tags=self.tags)
+
     def get_process_states(self):
         state_counts = defaultdict(int)
         prio_counts = defaultdict(int)

linux_proc_extras/metadata.csv

@@ -1,4 +1,5 @@
 metric_name,metric_type,interval,unit_name,per_unit_name,description,orientation,integration,short_name,curated_metric
+system.crypto.fips_enabled,gauge,,,,1 if the kernel is running in FIPS mode as reported by /proc/sys/crypto/fips_enabled and 0 otherwise,0,linux_proc_extras,fips enabled,
 system.entropy.available,gauge,,,,system entropy,0,linux_proc_extras,entropy,
 system.inodes.total,gauge,,,,number of inodes the system has allocated,0,linux_proc_extras,nr_inodes,
 system.inodes.used,gauge,,,,number of used inodes,0,linux_proc_extras,used_inodes,

linux_proc_extras/tests/common.py

@@ -22,6 +22,7 @@
     'system.linux.processes_created',
     'system.linux.interrupts',
     'system.entropy.available',
+    'system.crypto.fips_enabled',
     'system.processes.states',
     'system.processes.priorities',
 ]

linux_proc_extras/tests/fixtures/fips_enabled

@@ -0,0 +1 @@
+1

linux_proc_extras/tests/test_linux_proc_extras.py

@@ -6,6 +6,10 @@
 import pytest
 from mock import mock_open, patch
 
+from datadog_checks.base.stubs.aggregator import AggregatorStub
+from datadog_checks.base.stubs.datadog_agent import DatadogAgentStub
+from datadog_checks.linux_proc_extras import MoreUnixCheck
+
 from . import common
 
 pytestmark = pytest.mark.unit
@@ -31,6 +35,11 @@ def test_check(aggregator, check):
         with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', m):
             check.get_stat_info()
 
+    with open(os.path.join(common.FIXTURE_DIR, "fips_enabled")) as f:
+        m = mock_open(read_data=f.read())
+        with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', m):
+            check.get_fips_info()
+
     with open(os.path.join(common.FIXTURE_DIR, "process_stats")) as f:
         with patch(
             'datadog_checks.linux_proc_extras.linux_proc_extras.get_subprocess_output', return_value=(f.read(), "", 0)
@@ -52,3 +61,52 @@ def test_check(aggregator, check):
             aggregator.assert_metric("system.linux.irq", value=None, tags=tags)
 
     aggregator.assert_all_metrics_covered()
+
+
+@pytest.mark.parametrize('content, expected_value', [('1\n', 1.0), ('0\n', 0.0)])
+def test_fips_info(aggregator: AggregatorStub, check: MoreUnixCheck, content: str, expected_value: float) -> None:
+    m = mock_open(read_data=content)
+    with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', m):
+        check.get_fips_info()
+
+    m.assert_called_once_with('/proc/sys/crypto/fips_enabled', 'r')
+    aggregator.assert_metric('system.crypto.fips_enabled', value=expected_value, count=1, tags=[common.EXPECTED_TAG])
+    aggregator.assert_all_metrics_covered()
+
+
+def test_fips_info_honors_procfs_path(
+    aggregator: AggregatorStub, check: MoreUnixCheck, datadog_agent: DatadogAgentStub
+) -> None:
+    with patch.dict(datadog_agent._config, {'procfs_path': '/host/proc'}):
+        check.set_paths()
+
+    m = mock_open(read_data='1\n')
+    with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', m):
+        check.get_fips_info()
+
+    m.assert_called_once_with('/host/proc/sys/crypto/fips_enabled', 'r')
+    aggregator.assert_metric('system.crypto.fips_enabled', value=1.0, count=1, tags=[common.EXPECTED_TAG])
+    aggregator.assert_all_metrics_covered()
+
+
+def test_fips_info_missing_file(aggregator: AggregatorStub, check: MoreUnixCheck) -> None:
+    with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', side_effect=FileNotFoundError):
+        check.get_fips_info()
+
+    aggregator.assert_metric('system.crypto.fips_enabled', value=0.0, count=1, tags=[common.EXPECTED_TAG])
+    aggregator.assert_all_metrics_covered()
+
+
+def test_fips_info_unreadable(aggregator: AggregatorStub, check: MoreUnixCheck) -> None:
+    with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', side_effect=PermissionError):
+        check.get_fips_info()
+
+    aggregator.assert_metric('system.crypto.fips_enabled', count=0)
+
+
+def test_fips_info_unparseable(aggregator: AggregatorStub, check: MoreUnixCheck) -> None:
+    m = mock_open(read_data='not a number\n')
+    with patch('datadog_checks.linux_proc_extras.linux_proc_extras.open', m):
+        check.get_fips_info()
+
+    aggregator.assert_metric('system.crypto.fips_enabled', count=0)