Add NAP paths to allowed directories (#1163)

* update go verion and golangci-lint

* add paths for NAP upon instance discovery

* use variable for NAP directory path

* add paths when creating NAP instance

* add nap paths by default, update agent config during upgrade

* add nap by default

* nap paths to default agent configuration

* add back log message

* only add config directory /etc/app_protect

* update preinstall.sh

* update default config

* remove blank line

---------

Co-authored-by: Aphral Griffin <a.griffin@f5.com>

Author: 2 people

internal/config/config_test.go

@@ -796,7 +796,7 @@ func agentConfig() *Config {
 		},
 		AllowedDirectories: []string{
 			"/etc/nginx/", "/etc/nginx-agent/", "/usr/local/etc/nginx/", "/var/run/nginx/", "/var/log/nginx/",
-			"/usr/share/nginx/modules/",
+			"/usr/share/nginx/modules/", "/etc/app_protect/",
 		},
 		Collector: &Collector{
 			ConfigPath: "/etc/nginx-agent/nginx-agent-otelcol.yaml",

internal/config/defaults.go

@@ -107,6 +107,7 @@ func DefaultAllowedDirectories() []string {
 		"/usr/share/nginx/modules",
 		"/var/run/nginx",
 		"/var/log/nginx",
+		"/etc/app_protect",
 	}
 }
 

internal/watcher/instance/nginx-app-protect-instance-watcher_test.go

@@ -112,7 +112,6 @@ func TestNginxAppProtectInstanceWatcher_Watch(t *testing.T) {
 			t.Fatalf("Timed out waiting for instance updates")
 		}
 	})
-
 	t.Run("Test 2: Update instance", func(t *testing.T) {
 		_, err = enforcerEngineVersionFile.WriteAt([]byte("6.113.0"), 0)
 		require.NoError(t, err)

nginx-agent.conf

@@ -12,6 +12,7 @@ log:
 
 allowed_directories: 
     - /etc/nginx
+    - /etc/app_protect
     - /usr/local/etc/nginx
     - /usr/share/nginx/modules
     - /var/run/nginx

scripts/packages/preinstall.sh

@@ -109,6 +109,7 @@ labels:
             allowed_directories="${allowed_directories}\n  - ${config_dir}"
         done
         allowed_directories="${allowed_directories}\n  - /var/log/nginx"
+        allowed_directories="${allowed_directories}\n  - /etc/app_protect"
 
         echo "Writing new v3 configuration to $v3_config_file"
         v3_config_contents="

scripts/packages/upgrade-agent-config.sh

@@ -52,7 +52,8 @@ for config_dir in $config_dirs; do
 done
 
 allowed_directories="${allowed_directories}\n  - /var/log/nginx"
-       
+allowed_directories="${allowed_directories}\n  - /etc/app_protect"
+
 v3_config_contents="
 #
 # /etc/nginx-agent/nginx-agent.conf