deepfence · noboruma · Nov 15, 2023 · Nov 15, 2023
diff --git a/.github/workflows/build-publish-binaries.yaml b/.github/workflows/build-publish-binaries.yaml
@@ -10,6 +10,7 @@ on:
 
 env:
   DF_BIN_VER: ${{ inputs.ver }}
+  VERSION: ${{ inputs.ver }}
 
 jobs:
   docker:
@@ -35,12 +36,14 @@ jobs:
           mkdir -p /tmp/binaries/$DF_BIN_VER
           cd /tmp/binaries/$DF_BIN_VER
           id=$(docker create deepfenceio/deepfence_agent_ce:latest)
-          docker cp $id:/usr/local/bin/syft - > syft
-          docker cp $id:/home/deepfence/bin/yara-hunter/YaraHunter - > YaraHunter
-          docker cp $id:/home/deepfence/bin/secret-scanner/SecretScanner - > SecretScanner
-          docker cp $id:/usr/local/discovery/deepfence-discovery - > deepfence-discovery
-          docker cp $id:/opt/td-agent-bit/bin/fluent-bit - > fluent-bit
-          docker cp $id:/usr/local/bin/compliance_check/compliance - > compliance
+          docker cp $id:/bin/deepfenced self
+          docker cp $id:/home/deepfence/bin/package-scanner package_scanner
+          docker cp $id:/home/deepfence/bin/yara-hunter/YaraHunter malware_scanner
+          docker cp $id:/home/deepfence/bin/secret-scanner/SecretScanner secret_scanner
+          docker cp $id:/usr/local/discovery/deepfence-discovery discovery
+          docker cp $id:/opt/td-agent-bit/bin/fluent-bit fluentbit
+          docker cp $id:/usr/local/bin/syft syft
+          docker cp $id:/usr/local/bin/compliance_check/compliance compliance
           tar zcvf binaries.tar.gz ./*
           docker rm -v $id
 

diff --git a/deepfence_agent/plugins/SecretScanner b/deepfence_agent/plugins/SecretScanner
diff --git a/deepfence_agent/plugins/YaraHunter b/deepfence_agent/plugins/YaraHunter
diff --git a/deepfence_agent/plugins/package-scanner b/deepfence_agent/plugins/package-scanner
diff --git a/deepfence_agent/run_discovery.sh b/deepfence_agent/run_discovery.sh
@@ -7,7 +7,7 @@ PROBE_TRACKDEPLOADS=${DF_ENABLE_TRACKDEPLOADS:-"false"}
 PROBE_LOG_LEVEL=${LOG_LEVEL:-info}
 
 if [[ "$DF_CLUSTER_AGENT" == "true" ]]; then
-    /home/deepfence/deepfence_exe \
+    exec /home/deepfence/deepfence_exe \
         --mode=probe \
         --probe.kubernetes.role=cluster \
         --probe.log.level="$PROBE_LOG_LEVEL" \
@@ -41,20 +41,20 @@ fi
 
 if [[ "$DF_KUBERNETES_ON" == "Y" ]]; then
   if [[ "$CONTAINER_RUNTIME" == "containerd" ]] || [[ "$CONTAINER_RUNTIME"  = "crio" ]]; then
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=true --probe.cri.endpoint="$CRI_ENDPOINT" --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=true --probe.cri.endpoint="$CRI_ENDPOINT" --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   elif [[ "$CONTAINER_RUNTIME" == "podman" ]]; then
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=true --probe.podman.endpoint="$CRI_ENDPOINT" --probe.cri=false --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=true --probe.podman.endpoint="$CRI_ENDPOINT" --probe.cri=false --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   else
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=true --probe.podman=false --probe.cri=false --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=true --probe.podman=false --probe.cri=false --probe.kubernetes="true" --probe.kubernetes.role=host --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   fi
 else
   if [[ "$DF_SERVERLESS" == "true" ]]; then
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   elif [[ "$CONTAINER_RUNTIME" == "podman" ]]; then
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=true --probe.podman.endpoint="$CRI_ENDPOINT" --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=true --probe.podman.endpoint="$CRI_ENDPOINT" --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   elif [[ "$CONTAINER_RUNTIME" == "unknown" ]]; then
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=false --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.conntrack=false --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   else
-    env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=true --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
+    exec env FILEBEAT_CERT_PATH="$DF_INSTALL_DIR/etc/filebeat/filebeat.crt" CONSOLE_SERVER="https://$mgmtConsoleUrl" SCOPE_HOSTNAME="$HOSTNAME" nice -n -20 $DF_INSTALL_DIR/usr/local/discovery/deepfence-discovery --mode=probe --probe.log.level="$PROBE_LOG_LEVEL" --probe.spy.interval=5s --probe.publish.interval=10s --probe.docker.interval=10s --probe.insecure=true --probe.docker=true --probe.podman=false --probe.cri=false --probe.token="$DEEPFENCE_KEY" --probe.processes="$PROBE_PROCESSES" --probe.endpoint.report="$PROBE_CONNECTIONS" --probe.track.deploads="$PROBE_TRACKDEPLOADS" "https://$mgmtConsoleUrl"
   fi
 fi
diff --git a/deepfence_bootstrapper/Makefile b/deepfence_bootstrapper/Makefile
@@ -1,11 +1,11 @@
-VERSION=`git describe --tags`
+VERSION?=`git describe --tags`
 
 all: deepfence_bootstrapper
 
 local: deepfence_bootstrapper
 
 prepare:
-	docker run --rm -i -v $(ROOT_MAKEFILE_DIR):/src:rw -v /tmp/go:/go:rw deepfenceio/deepfence_builder_ce:$(DF_IMG_TAG) bash -c 'cd /src/deepfence_bootstrapper && make deepfence_bootstrapper'
+	docker run --rm -i -e VERSION=${VERSION} -v $(ROOT_MAKEFILE_DIR):/src:rw -v /tmp/go:/go:rw deepfenceio/deepfence_builder_ce:$(DF_IMG_TAG) bash -c 'cd /src/deepfence_bootstrapper && make deepfence_bootstrapper'
 
 vendor: go.mod $(shell find ../deepfence_utils -path ../deepfence_utils/vendor -prune -o -name '*.go')
 	go mod tidy -v

diff --git a/deepfence_bootstrapper/assets/config.ini b/deepfence_bootstrapper/assets/config.ini
@@ -3,7 +3,7 @@ maxcpu = 10
 maxmem = 100000
 
 [process:fluentbit]
-command=/bin/bash -c "$DF_INSTALL_DIR/opt/td-agent-bit/bin/fluent-bit -c $DF_INSTALL_DIR/etc/td-agent-bit/fluentbit-agent.conf"
+command=/bin/bash -c "exec $DF_INSTALL_DIR/opt/td-agent-bit/bin/fluent-bit -c $DF_INSTALL_DIR/etc/td-agent-bit/fluentbit-agent.conf"
 path=$DF_INSTALL_DIR/opt/td-agent-bit/bin/fluent-bit
 autostart=true
 autorestart=true
@@ -15,19 +15,19 @@ autostart=true
 autorestart=true
 
 [process:package_scanner]
-command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/package-scanner.sock && $DF_INSTALL_DIR/home/deepfence/bin/package-scanner -socket-path $DF_INSTALL_DIR/tmp/package-scanner.sock -mode grpc-server"
+command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/package-scanner.sock && exec $DF_INSTALL_DIR/home/deepfence/bin/package-scanner -socket-path $DF_INSTALL_DIR/tmp/package-scanner.sock -mode grpc-server"
 path=$DF_INSTALL_DIR/home/deepfence/bin/package-scanner
 autostart=true
 autorestart=true
 
 [process:secret_scanner]
-command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/secret-scanner.sock && $DF_INSTALL_DIR/home/deepfence/bin/secret-scanner/SecretScanner --config-path $DF_INSTALL_DIR/home/deepfence/bin/secret-scanner --socket-path=$DF_INSTALL_DIR/tmp/secret-scanner.sock"
+command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/secret-scanner.sock && exec $DF_INSTALL_DIR/home/deepfence/bin/secret-scanner/SecretScanner --config-path $DF_INSTALL_DIR/home/deepfence/bin/secret-scanner --socket-path=$DF_INSTALL_DIR/tmp/secret-scanner.sock"
 path=$DF_INSTALL_DIR/home/deepfence/bin/secret-scanner/SecretScanner
 autostart=true
 autorestart=true
 
 [process:malware_scanner]
-command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/yara-hunter.sock && $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter/YaraHunter --config-path $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter --rules-path $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter/yara-rules --socket-path=$DF_INSTALL_DIR/tmp/yara-hunter.sock --enable-updater=false"
+command=/bin/bash -c "rm -f $DF_INSTALL_DIR/tmp/yara-hunter.sock && exec $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter/YaraHunter --config-path $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter --rules-path $DF_INSTALL_DIR/home/deepfence/bin/yara-hunter/yara-rules --socket-path=$DF_INSTALL_DIR/tmp/yara-hunter.sock --enable-updater=false"
 path=$DF_INSTALL_DIR/home/deepfence/bin/yara-hunter/YaraHunter
 autostart=true
 autorestart=true
diff --git a/deepfence_bootstrapper/controls/controls.go b/deepfence_bootstrapper/controls/controls.go
@@ -35,6 +35,7 @@ func SetClusterAgentControls(k8sClusterName string) {
 		func(req ctl.StartAgentUpgradeRequest) error {
 			log.Info().Msg("Start Cluster Agent Upgrade")
 			router.SetUpgrade()
+			defer router.UnsetUpgrade()
 			return StartClusterAgentUpgrade(req)
 		})
 	if err != nil {
@@ -110,6 +111,7 @@ func SetAgentControls() {
 		func(req ctl.StartAgentUpgradeRequest) error {
 			log.Info().Msg("Start Agent Upgrade")
 			router.SetUpgrade()
+			defer router.UnsetUpgrade()
 			return router.StartAgentUpgrade(req)
 		})
 	if err != nil {
@@ -119,6 +121,7 @@ func SetAgentControls() {
 		func(req ctl.EnableAgentPluginRequest) error {
 			log.Info().Msg("Start & download Agent Plugin")
 			router.SetUpgrade()
+			defer router.UnsetUpgrade()
 			err = supervisor.UpgradeProcessFromURL(req.PluginName, req.BinUrl)
 			if err != nil {
 				return err

diff --git a/deepfence_bootstrapper/router/openapi_client_controls.go b/deepfence_bootstrapper/router/openapi_client_controls.go
@@ -134,6 +134,10 @@ func SetUpgrade() {
 	upgrade.Store(true)
 }
 
+func UnsetUpgrade() {
+	upgrade.Store(false)
+}
+
 func getUpgradeWorkload() int32 {
 	if upgrade.Load() {
 		return MAX_AGENT_WORKLOAD

diff --git a/deepfence_bootstrapper/router/upgrade.go b/deepfence_bootstrapper/router/upgrade.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"syscall"
 
 	"github.com/deepfence/ThreatMapper/deepfence_bootstrapper/supervisor"
 	ctl "github.com/deepfence/ThreatMapper/deepfence_utils/controls"
@@ -49,6 +50,9 @@ func StartAgentUpgrade(req ctl.StartAgentUpgradeRequest) error {
 		if err != nil {
 			return err
 		}
+		if info.IsDir() {
+			return nil
+		}
 		plugins = append(plugins, NamePath{name: filepath.Base(path), path: path})
 		return nil
 	})
@@ -57,16 +61,36 @@ func StartAgentUpgrade(req ctl.StartAgentUpgradeRequest) error {
 		return err
 	}
 
+	restart := false
 	for _, plugin := range plugins {
 		err = supervisor.UpgradeProcessFromFile(plugin.name, plugin.path)
 		if err != nil {
-			log.Error().Msg(err.Error())
+			log.Error().Msgf("plugin: %v, path: %v, err: %v", plugin.name, plugin.path, err)
+		} else if plugin.name == supervisor.Self_id {
+			restart = true
 		}
 	}
 
+	if restart {
+		log.Info().Msgf("Restart self")
+		restartSelf()
+	}
+
 	return nil
 }
 
+func restartSelf() error {
+	errs := supervisor.StopAllProcesses()
+	for i := range errs {
+		log.Error().Msg(errs[i].Error())
+	}
+	argv0, err := exec.LookPath(os.Args[0])
+	if err != nil {
+		return err
+	}
+	return syscall.Exec(argv0, os.Args, os.Environ())
+}
+
 func downloadFile(filepath string, url string) (err error) {
 
 	// Create the file

diff --git a/deepfence_bootstrapper/supervisor/process.go b/deepfence_bootstrapper/supervisor/process.go
@@ -17,7 +17,7 @@ import (
 )
 
 const (
-	self_id                  = "self"
+	Self_id                  = "self"
 	log_root_env             = "${DF_INSTALL_DIR}/var/log/deepfenced/"
 	EXIT_CODE_BASH_NOT_FOUND = 127
 )
@@ -288,7 +288,7 @@ func WriteTo(dst, org string) error {
 }
 
 func UpgradeProcessFromFile(name, path string) error {
-	if name == self_id {
+	if name == Self_id {
 		return selfUpgradeFromFile(path)
 	}
 
@@ -325,7 +325,7 @@ func UpgradeProcessFromFile(name, path string) error {
 }
 
 func UpgradeProcessFromURL(name, url string) error {
-	if name == self_id {
+	if name == Self_id {
 		return selfUpgradeFromUrl(url)
 	}
 
@@ -393,6 +393,21 @@ func StopProcess(name string) error {
 	return process.stop()
 }
 
+func StopAllProcesses() []error {
+
+	access.RLock()
+	defer access.RUnlock()
+
+	errs := []error{}
+	for _, process := range processes {
+		err := process.stop()
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return errs
+}
+
 func LoadProcess(name, path, command, env string, autorestart bool, cgroup string) {
 	access.Lock()
 	defer access.Unlock()

diff --git a/deepfence_ctl/cmd/graph.go b/deepfence_ctl/cmd/graph.go
@@ -89,7 +89,7 @@ var graphTopologySubCmd = &cobra.Command{
 
 		root, _ := cmd.Flags().GetString("root")
 
-		var res *deepfence_server_client.ApiDocsGraphResult
+		var res *deepfence_server_client.ModelGraphResult
 		var rh *stdhttp.Response
 		switch root {
 		case "":
+1 −1		tools/grype-bin/get_grype.sh
+1 −1		tools/syft-bin/get_syft.sh