[DSEC-128] Add data security rust check by aimenebelfodil · Pull Request #53605 · DataDog/datadog-agent

aimenebelfodil · 2026-07-13T19:05:47Z

What does this PR do?

Motivation

Describe how you validated your changes

Additional Notes

…hared core types, not std::core

…y checks into checks.d Declare checks in shared_checks_manifest.yaml, build via rust-shared-checks.build, and assign CODEOWNERS to agent-build.

… shared-library checks into checks.d so they ship in linux/mac packages

…hmod 0500 shared libs so rust checks ship with loader-required permissions

…so rust libs keep loader-required perms after config chmod 660

…les after config chmod -R so shared-library loader perms survive image setup

…ylib on macOS postinst

…image

…s.py

Following review, the Rust shared-library checks are now built and shipped for Linux only; macOS (darwin/.dylib) is no longer targeted. - datadog-agent.rb: gate staging on linux_target? (was "unless windows_target?"), so nothing is built on macOS. - shared_checks_manifest.yaml: drop the darwin platform entry. - rust_shared_checks.py: build only for linux and the .so extension; remove the darwin/dylib handling and refuse to run outside linux. - agent-dmg/postinst: remove the macOS .dylib chmod, no longer needed. - datadog-agent-finalize.rb: move the built libdatadog-agent-*.so libs into the package checks.d and chmod 0500 each right after the move.

…od in Dockerfiles Replace the inline "find ... -exec chmod 0500 ... 2>/dev/null || true" with a clearer, dedicated RUN loop in both the agent and agent-ddot Dockerfiles. The chmod is kept in the agent-ddot image on purpose: agent-ddot is FROM the base agent image, which already ships the built-in Rust shared-library checks (libdatadog-agent-*.so) under /etc/datadog-agent/checks.d. Those libs are inherited into the DDOT image, so they must keep the loader-required owner-only (0500) perms. Since the recursive "chmod g+r,g+w,g+X -R /etc/datadog-agent" loosens them, the 0500 is re-applied afterwards.

…hen no .so files match

…t on Linux

…shot scheduling

… in Configure

…urity scan results

Add event_platform_event_bytes / submit_event_platform_event_bytes so checks can submit arbitrary bytes (e.g. protobuf) to the event platform instead of only UTF-8 strings; the existing string API now delegates to the byte variant.

…ook stops regenerating an unused go_proto_library

datadog-prod-us1-5 · 2026-07-13T19:36:17Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 51.47% (-0.39%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 315aa01 | Docs | Datadog PR Page | Give us feedback!}

… registry can resolve it

… datadog registry can resolve them

dd-octo-sts · 2026-07-14T08:28:58Z

Files inventory check summary

File checks results against ancestor 9cf224a0:

Results for datadog-agent_7.82.0~devel.git.809.315aa01.pipeline.124473700-1_amd64.deb:

Detected file changes:

1 Added files:

etc/datadog-agent/checks.d/libdatadog-agent-datasecurity.so (4.06 MiB)

dd-octo-sts · 2026-07-14T08:33:43Z

Static quality checks

❌ Please find below the results from static quality gates
Comparison made with ancestor 9cf224a
📊 Static Quality Gates Dashboard
🔗 SQG Job

Error

	Quality gate	Change	Size (prev → curr → max)
❌	agent_deb_amd64 (per-PR threshold)	+4.06 MiB (0.54% increase, -50.37% of buffer)	750.143 → 754.201 → 758.200
❌	agent_deb_amd64_fips (per-PR threshold)	+4.06 MiB (0.58% increase, -87.58% of buffer)	705.206 → 709.264 → 709.840
❌	agent_heroku_amd64 (per-PR threshold)	+4.05 MiB (1.32% increase, -51.71% of buffer)	307.389 → 311.444 → 315.230
❌	agent_rpm_amd64 (per-PR threshold)	+4.06 MiB (0.54% increase, -50.45% of buffer)	750.126 → 754.185 → 758.170
❌	agent_rpm_amd64_fips (per-PR threshold)	+4.06 MiB (0.58% increase, -87.27% of buffer)	705.190 → 709.248 → 709.840
❌	agent_rpm_arm64 (on disk)	+4.43 MiB (0.61% increase, -100.20% of buffer)	725.234 → 729.669 → 729.660
❌	agent_rpm_arm64_fips (per-PR threshold)	+4.44 MiB (0.65% increase, -91.37% of buffer)	684.003 → 688.441 → 688.860
❌	agent_suse_amd64 (per-PR threshold)	+4.06 MiB (0.54% increase, -50.45% of buffer)	750.126 → 754.185 → 758.170
❌	agent_suse_amd64_fips (per-PR threshold)	+4.06 MiB (0.58% increase, -87.27% of buffer)	705.190 → 709.248 → 709.840
❌	agent_suse_arm64 (on disk)	+4.43 MiB (0.61% increase, -100.20% of buffer)	725.234 → 729.669 → 729.660
❌	agent_suse_arm64_fips (per-PR threshold)	+4.44 MiB (0.65% increase, -91.37% of buffer)	684.003 → 688.441 → 688.860
❌	docker_agent_amd64 (per-PR threshold)	+4.06 MiB (0.50% increase, -82.48% of buffer)	808.869 → 812.928 → 813.790
❌	docker_agent_arm64 (per-PR threshold)	+4.43 MiB (0.55% increase, -73.85% of buffer)	809.025 → 813.459 → 815.030
❌	docker_agent_jmx_amd64 (per-PR threshold)	+4.06 MiB (0.41% increase, -84.85% of buffer)	999.766 → 1003.825 → 1004.550
❌	docker_agent_jmx_arm64 (per-PR threshold)	+4.43 MiB (0.45% increase, -72.28% of buffer)	988.574 → 993.009 → 994.710

Gate failure full details

Quality gate	Error type	Error message
agent_deb_amd64	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_deb_amd64_fips	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_heroku_amd64	PerPRThresholdExceeded	On-disk size increase of 4.05 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_amd64	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_amd64_fips	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_arm64	AbsoluteLimitExceeded	static_quality_gate_agent_rpm_arm64 failed! Disk size 729.7 MB exceeds limit of 729.7 MB by 8.9 KB
agent_rpm_arm64_fips	PerPRThresholdExceeded	On-disk size increase of 4.44 MiB exceeds the per-PR threshold of 600.0 KiB
agent_suse_amd64	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_suse_amd64_fips	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
agent_suse_arm64	AbsoluteLimitExceeded	static_quality_gate_agent_suse_arm64 failed! Disk size 729.7 MB exceeds limit of 729.7 MB by 8.9 KB
agent_suse_arm64_fips	PerPRThresholdExceeded	On-disk size increase of 4.44 MiB exceeds the per-PR threshold of 600.0 KiB
docker_agent_amd64	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
docker_agent_arm64	PerPRThresholdExceeded	On-disk size increase of 4.43 MiB exceeds the per-PR threshold of 600.0 KiB
docker_agent_jmx_amd64	PerPRThresholdExceeded	On-disk size increase of 4.06 MiB exceeds the per-PR threshold of 600.0 KiB
docker_agent_jmx_arm64	PerPRThresholdExceeded	On-disk size increase of 4.43 MiB exceeds the per-PR threshold of 600.0 KiB

Static quality gates prevent the PR to merge!
You can check the static quality gates confluence page for guidance. We also have a toolbox page available to list tools useful to debug the size increase.
Please either fix the size violation or request an exception.

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_msi	+4.5 KiB (0.00% increase, -0.04% of buffer)	644.791 → 644.796 → 656.640
✅	docker_dogstatsd_amd64	+4.0 KiB (0.01% increase, -0.53% of buffer)	39.173 → 39.176 → 39.910
✅	dogstatsd_deb_arm64	+4.0 KiB (0.01% increase, -0.25% of buffer)	27.943 → 27.947 → 29.530

15 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	docker_cluster_agent_amd64	209.510 MiB
✅	docker_cluster_agent_arm64	222.577 MiB
✅	docker_cws_instrumentation_amd64	7.447 MiB
✅	docker_cws_instrumentation_arm64	6.877 MiB
✅	docker_dogstatsd_arm64	37.305 MiB
✅	docker_host_profiler_amd64	302.571 MiB
✅	docker_host_profiler_arm64	314.114 MiB
✅	dogstatsd_deb_amd64	29.912 MiB
✅	dogstatsd_rpm_amd64	29.912 MiB
✅	dogstatsd_suse_amd64	29.912 MiB
✅	iot_agent_deb_amd64	45.993 MiB
✅	iot_agent_deb_arm64	42.681 MiB
✅	iot_agent_deb_armhf	43.461 MiB
✅	iot_agent_rpm_amd64	45.994 MiB
✅	iot_agent_suse_amd64	45.993 MiB

aimenebelfodil added 23 commits July 10, 2026 12:18

[DSEC] fix(rustchecks): use :: in FFI macro so check crates resolve s…

e3c6950

…hared core types, not std::core

feat(rustchecks): add manifest and invoke task to build shared-librar…

c9d6145

…y checks into checks.d Declare checks in shared_checks_manifest.yaml, build via rust-shared-checks.build, and assign CODEOWNERS to agent-build.

feat(rustchecks): wire omnibus agent build to stage manifest-selected…

5d2667c

… shared-library checks into checks.d so they ship in linux/mac packages

feat(rustchecks): move built checks.d into linux package config and c…

19c4ea2

…hmod 0500 shared libs so rust checks ship with loader-required permissions

feat(rustchecks): chmod 0500 shared-library checks in macOS postinst …

1637820

…so rust libs keep loader-required perms after config chmod 660

feat(rustchecks): chmod 0500 checks.d libs in agent and ddot Dockerfi…

bd0747c

…les after config chmod -R so shared-library loader perms survive image setup

fix(rustchecks): scope chmod patterns to .so on linux finalize and .d…

49e7bae

…ylib on macOS postinst

feat(rustchecks): build and stage shared-library checks in hacky dev …

439eac8

…image

[DSEC] Remove schema_version from manifest.yaml

77a8f66

[DSEC] Add agent runtimes as code owners for /tasks/rust_shared_check…

4dc63cb

…s.py

[DSEC] Do not ship example check

a98dcea

fix(docker): use find so Rust shared-check chmod doesn't fail build w…

d261ff2

…hen no .so files match

docs(releasenotes): add note for built-in Rust check packaging suppor…

aaf4982

…t on Linux

feat(shared-library-checks): honor min_collection_interval: 0 as one-…

b2f589a

…shot scheduling

test(shared-library-checks): cover min_collection_interval scheduling…

89f2d19

… in Configure

chore(bazel): add check/defaults dep to sharedlibraryimpl test target

93f51db

feat(proto): add datadog.sds SdsResultPayload proto

7afe20d

feat(eventplatform): add sds-result passthrough pipeline for data-sec…

ea99df1

…urity scan results

feat(rustchecks): add datasecurity shared-library check

45b28cb

build(bazel): disable gazelle proto rules for sds so the pre-commit h…

5babf27

…ook stops regenerating an unused go_proto_library

aimenebelfodil changed the base branch from main to aimene.belfodil/dsec-124/support-run-once-for-shared-library-checks July 13, 2026 19:06

aimenebelfodil added 3 commits July 14, 2026 00:15

build(rustchecks): bump dd-sensitive-data-scanner (dd-sds only)

88af261

build(rustchecks): pin base58-monero to 2.0.0 so the internal datadog…

a0471ed

… registry can resolve it

build(rustchecks): pin mio and uuid to older versions so the internal…

315aa01

… datadog registry can resolve them

aimenebelfodil force-pushed the aimene.belfodil/dsec-124/support-run-once-for-shared-library-checks branch from 93f51db to d73ddb8 Compare July 15, 2026 19:21

Base automatically changed from aimene.belfodil/dsec-124/support-run-once-for-shared-library-checks to main July 16, 2026 08:03

aimenebelfodil closed this Aug 1, 2026

Navigation Menu

Uh oh!

[DSEC-128] Add data security rust check - #53605

[DSEC-128] Add data security rust check#53605
aimenebelfodil wants to merge 26 commits into
mainfrom
aimene.belfodil/dsec-128/add-data-security-rust-check

aimenebelfodil commented Jul 13, 2026

Uh oh!

datadog-prod-us1-5 Bot commented Jul 13, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading

Uh oh!

dd-octo-sts Bot commented Jul 14, 2026

1 Added files:

Uh oh!

dd-octo-sts Bot commented Jul 14, 2026

Info

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

aimenebelfodil commented Jul 13, 2026

What does this PR do?

Motivation

Describe how you validated your changes

Additional Notes

Uh oh!

datadog-prod-us1-5 Bot commented Jul 13, 2026 • edited by datadog-datadog-prod-us1-2 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 14, 2026

Files inventory check summary

Results for datadog-agent_7.82.0~devel.git.809.315aa01.pipeline.124473700-1_amd64.deb:

Detected file changes:

1 Added files:

Uh oh!

dd-octo-sts Bot commented Jul 14, 2026

Static quality checks

Error

Info

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

datadog-prod-us1-5 Bot commented Jul 13, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading