From 13cec63bd11661ffd2d73f79bd4e8bb3cab827be Mon Sep 17 00:00:00 2001 From: Tim Lee Date: Thu, 30 Apr 2026 11:01:04 -0600 Subject: [PATCH] Add RHEL 8/9/10 simulated hosts to osquery-perf (#44453) --- cmd/osquery-perf/README.md | 6 +- cmd/osquery-perf/agent.go | 205 ++++++++++++++++++++++--- cmd/osquery-perf/rhel_10-kernels.json | 27 ++++ cmd/osquery-perf/rhel_10.tmpl | 207 ++++++++++++++++++++++++++ cmd/osquery-perf/rhel_8-kernels.json | 37 +++++ cmd/osquery-perf/rhel_8.tmpl | 207 ++++++++++++++++++++++++++ cmd/osquery-perf/rhel_9-kernels.json | 44 ++++++ cmd/osquery-perf/rhel_9.tmpl | 207 ++++++++++++++++++++++++++ 8 files changed, 915 insertions(+), 25 deletions(-) create mode 100644 cmd/osquery-perf/rhel_10-kernels.json create mode 100644 cmd/osquery-perf/rhel_10.tmpl create mode 100644 cmd/osquery-perf/rhel_8-kernels.json create mode 100644 cmd/osquery-perf/rhel_8.tmpl create mode 100644 cmd/osquery-perf/rhel_9-kernels.json create mode 100644 cmd/osquery-perf/rhel_9.tmpl diff --git a/cmd/osquery-perf/README.md b/cmd/osquery-perf/README.md index e1d3b2928f..f7d38363c9 100644 --- a/cmd/osquery-perf/README.md +++ b/cmd/osquery-perf/README.md @@ -54,7 +54,11 @@ By default, all hosts will simulate macOS hosts (specifically, macOS 10.14). To go run agent.go --enroll_secret hgh4hk3434l2jjf --os_templates ubuntu_22.04,windows_11 --host_count 6 ``` -would start 3 Ubuntu hosts and 3 Windows hosts. See the `os_templates` flag description in `go run agent.go --help` for the list of supported template names. +would start 3 Ubuntu hosts and 3 Windows hosts. + +Supported Linux templates: `ubuntu_22.04`, `rhel_8`, `rhel_9`, `rhel_10`. RHEL templates report `platform=rhel`, RPM-style kernels (e.g., `kernel-core 5.14.0-503.26.1.el9_5`), and (when `--software_db_path` points at a populated database) additional RPM packages from the software library. See the `os_templates` flag description in `go run agent.go --help` for the full list of supported template names. + +The software database (`cmd/osquery-perf/software-library/software.db`) is optional — macOS, Windows, and Ubuntu have embedded fallback fixtures, and RHEL kernels are embedded too. The DB only adds non-kernel software variety. If the DB isn't present at `--software_db_path`, osquery-perf logs a warning and falls back to the embedded fixtures. ## Controlling Agent Behavior From the Fleet UI diff --git a/cmd/osquery-perf/agent.go b/cmd/osquery-perf/agent.go index f7560e0a03..2ae2b6f17d 100644 --- a/cmd/osquery-perf/agent.go +++ b/cmd/osquery-perf/agent.go @@ -63,6 +63,12 @@ var ( ubuntuSoftwareFS embed.FS //go:embed ubuntu_2204-kernels.json ubuntuKernelsFS embed.FS + //go:embed rhel_8-kernels.json + rhel8KernelsFS embed.FS + //go:embed rhel_9-kernels.json + rhel9KernelsFS embed.FS + //go:embed rhel_10-kernels.json + rhel10KernelsFS embed.FS //go:embed windows_11-software.json.bz2 windowsSoftwareFS embed.FS @@ -70,7 +76,15 @@ var ( vsCodeExtensionsVulnerableSoftware []fleet.Software windowsSoftware []map[string]string ubuntuSoftware []map[string]string - ubuntuKernels []string + ubuntuKernels []map[string]string + rhel8Kernels []map[string]string + rhel9Kernels []map[string]string + rhel10Kernels []map[string]string + + // softwareDBRPM caches a one-time filtered slice of softwareDB.Ubuntu where + // Source == "rpm_packages", reused by RHEL agents. + softwareDBRPMOnce sync.Once + softwareDBRPM []softwaredb.UbuntuSoftware // Software library database (loaded from SQLite if --software_db_path is specified) softwareDB *softwaredb.DB @@ -153,17 +167,114 @@ func loadSoftwareItems(fs embed.FS, path string, source string) []map[string]str return softwareRows } -func loadKernelList(fs embed.FS, path string) []string { +// loadDebKernelList reads a JSON array of deb-style kernel package names +// (e.g., "linux-image-6.8.0-51-generic") and returns kernel records with +// name, version (the suffix after "linux-image-"), and source="deb_packages". +func loadDebKernelList(fs embed.FS, path string) []map[string]string { data, err := fs.ReadFile(path) if err != nil { panic(err) } - var kernels []string - if err := json.Unmarshal(data, &kernels); err != nil { + var names []string + if err := json.Unmarshal(data, &names); err != nil { panic(err) } + kernels := make([]map[string]string, 0, len(names)) + for _, name := range names { + kernels = append(kernels, map[string]string{ + "name": name, + "version": strings.TrimPrefix(name, "linux-image-"), + "source": "deb_packages", + }) + } + return kernels +} + +// loadSoftwareDBRPM returns a one-time filtered slice of softwareDB.Ubuntu +// where Source == "rpm_packages". Returns nil if no software DB is loaded. +func loadSoftwareDBRPM() []softwaredb.UbuntuSoftware { + if softwareDB == nil { + return nil + } + softwareDBRPMOnce.Do(func() { + filtered := make([]softwaredb.UbuntuSoftware, 0, len(softwareDB.Ubuntu)/4) + for _, s := range softwareDB.Ubuntu { + if s.Source == "rpm_packages" { + filtered = append(filtered, s) + } + } + softwareDBRPM = filtered + }) + return softwareDBRPM +} + +// rpmSliceToMaps converts UbuntuSoftware entries at the given indices to +// osquery result maps. Mirrors softwaredb.DB.UbuntuToMaps but operates on a +// caller-provided slice (the RPM-only filtered subset). +func rpmSliceToMaps(pool []softwaredb.UbuntuSoftware, indices []uint32) []map[string]string { + results := make([]map[string]string, 0, len(indices)) + for _, idx := range indices { + if int(idx) >= len(pool) { + continue + } + s := pool[idx] + m := map[string]string{ + "name": s.Name, + "source": s.Source, + "version": s.Version, + } + if s.Vendor != nil { + m["vendor"] = *s.Vendor + } + if s.Arch != nil { + m["arch"] = *s.Arch + } + if s.Release != nil { + m["release"] = *s.Release + } + results = append(results, m) + } + return results +} + +// loadRPMKernelList reads a JSON array of objects with name/version/release +// (and optional vendor/arch) and returns kernel records stamped with +// source="rpm_packages". +func loadRPMKernelList(fs embed.FS, path string) []map[string]string { + data, err := fs.ReadFile(path) + if err != nil { + panic(err) + } + + var entries []struct { + Name string `json:"name"` + Version string `json:"version"` + Release string `json:"release"` + Vendor string `json:"vendor"` + Arch string `json:"arch"` + } + if err := json.Unmarshal(data, &entries); err != nil { + panic(err) + } + + kernels := make([]map[string]string, 0, len(entries)) + for _, e := range entries { + entry := map[string]string{ + "name": e.Name, + "version": e.Version, + "release": e.Release, + "source": "rpm_packages", + } + if e.Vendor != "" { + entry["vendor"] = e.Vendor + } + if e.Arch != "" { + entry["arch"] = e.Arch + } + kernels = append(kernels, entry) + } return kernels } @@ -172,7 +283,10 @@ func init() { loadExtraVulnerableSoftware() windowsSoftware = loadSoftwareItems(windowsSoftwareFS, "windows_11-software.json.bz2", "programs") ubuntuSoftware = loadSoftwareItems(ubuntuSoftwareFS, "ubuntu_2204-software.json.bz2", "deb_packages") - ubuntuKernels = loadKernelList(ubuntuKernelsFS, "ubuntu_2204-kernels.json") + ubuntuKernels = loadDebKernelList(ubuntuKernelsFS, "ubuntu_2204-kernels.json") + rhel8Kernels = loadRPMKernelList(rhel8KernelsFS, "rhel_8-kernels.json") + rhel9Kernels = loadRPMKernelList(rhel9KernelsFS, "rhel_9-kernels.json") + rhel10Kernels = loadRPMKernelList(rhel10KernelsFS, "rhel_10-kernels.json") } type nodeKeyManager struct { @@ -521,9 +635,10 @@ func newAgent( // validTemplateNames below for the list of possible names, the OS is always // the part before the underscore). Note that it is the OS and not the // "normalized" platform, so "ubuntu" and not "linux", "macos" and not - // "darwin". - agentOS := strings.TrimRight(templates.Name(), ".tmpl") - agentOS, _, _ = strings.Cut(agentOS, "_") + // "darwin". osVariant is the part after the underscore, e.g., "8" / "9" / + // "10" for RHEL templates, used to pick the right kernel list. + templateBase := strings.TrimSuffix(templates.Name(), ".tmpl") + agentOS, osVariant, _ := strings.Cut(templateBase, "_") var ( macMDMClient *mdmtest.TestAppleMDMClient @@ -619,9 +734,19 @@ func newAgent( AgentIndex: agentIndex, }, useHTTPSig, httpMessageSignatureP384Prob) - // Pre-select kernels for Ubuntu agents to ensure consistency across queries - if agentOS == "ubuntu" { + // Pre-select kernels for Linux agents to ensure consistency across queries + switch agentOS { + case "ubuntu": agent.linuxKernels = selectKernels(ubuntuKernels) + case "rhel": + switch osVariant { + case "8": + agent.linuxKernels = selectKernels(rhel8Kernels) + case "9": + agent.linuxKernels = selectKernels(rhel9Kernels) + case "10": + agent.linuxKernels = selectKernels(rhel10Kernels) + } } return agent @@ -2212,7 +2337,7 @@ func (a *agent) softwareVSCodeExtensions() []map[string]string { return software } -func selectKernels(kernelList []string) []map[string]string { +func selectKernels(kernelList []map[string]string) []map[string]string { // Determine number of kernels based on probability distribution r := rand.Float64() var numKernels int @@ -2242,15 +2367,11 @@ func selectKernels(kernelList []string) []map[string]string { kernels := make([]map[string]string, 0, numKernels) for i := 0; i < numKernels && i < len(indices); i++ { - kernelName := kernelList[indices[i]] - // Extract version from name (remove "linux-image-" prefix) - version := strings.TrimPrefix(kernelName, "linux-image-") - - kernels = append(kernels, map[string]string{ - "name": kernelName, - "version": version, - "source": "deb_packages", - }) + // Copy the map so callers cannot mutate the shared package-level slice. + src := kernelList[indices[i]] + entry := make(map[string]string, len(src)) + maps.Copy(entry, src) + kernels = append(kernels, entry) } return kernels @@ -3111,7 +3232,7 @@ func (a *agent) processQuery(name, query string, cachedResults *cachedResults) ( ss = fleet.OsqueryStatus(1) } if ss == fleet.StatusOK { - switch a.os { //nolint:gocritic // ignore singleCaseSwitch + switch a.os { case "ubuntu": // Use database software 80% of the time if available, otherwise use embedded data if softwareDB != nil && len(softwareDB.Ubuntu) > 0 && rand.Float64() < 0.8 { // nolint:gosec,G404 // load testing, not security-sensitive @@ -3160,6 +3281,34 @@ func (a *agent) processQuery(name, query string, cachedResults *cachedResults) ( results = append(results, value.(map[string]string)) return true }) + + case "rhel": + // RHEL agents use the rpm_packages rows from the software DB + // (filtered once on first use). When the DB is unavailable, only + // kernels and per-host installed software are reported, which is + // sufficient for kernel-CVE load testing. + rpmPool := loadSoftwareDBRPM() + if len(rpmPool) > 0 { + if a.cachedSoftwareIndices == nil { + count := min(softwaredb.RandomSoftwareCount("ubuntu"), len(rpmPool)) + perm := rand.Perm(len(rpmPool)) + a.cachedSoftwareIndices = make([]uint32, count) + for i := range count { + a.cachedSoftwareIndices[i] = uint32(perm[i]) //nolint:gosec // perm[i] is bounded by len(rpmPool) + } + } else { + a.cachedSoftwareIndices = softwaredb.MaybeMutateSoftware(a.cachedSoftwareIndices, len(rpmPool)) + } + results = rpmSliceToMaps(rpmPool, a.cachedSoftwareIndices) + } + + // Add pre-selected kernels for this agent + results = append(results, a.linuxKernels...) + + a.installedSoftware.Range(func(key, value any) bool { + results = append(results, value.(map[string]string)) + return true + }) } } return true, results, &ss, nil, nil @@ -3505,6 +3654,9 @@ func main() { "windows_11_22H2_2861.tmpl": true, "windows_11_22H2_3007.tmpl": true, "ubuntu_22.04.tmpl": true, + "rhel_8.tmpl": true, + "rhel_9.tmpl": true, + "rhel_10.tmpl": true, "iphone_14.6.tmpl": true, "ipad_13.18.tmpl": true, } @@ -3618,13 +3770,18 @@ func main() { flag.Parse() rand.Seed(*randSeed) - // Load software from database if path provided + // Load software from database if path provided. macOS / Windows / Ubuntu + // have embedded fallback fixtures, and RHEL kernels are embedded too — the + // DB only adds non-kernel RPM/DEB variety. Treat load failure as a warning + // rather than fatal so running from the repo root (where the default + // relative path doesn't resolve) still works. if *softwareDatabasePath != "" { db, err := softwaredb.LoadFromDatabase(*softwareDatabasePath) if err != nil { - log.Fatalf("Failed to load software database: %v", err) + log.Printf("WARNING: failed to load software database (%v); falling back to embedded software data", err) + } else { + softwareDB = db } - softwareDB = db } else { log.Println("No software database specified (--software_db_path). Using embedded software data.") } diff --git a/cmd/osquery-perf/rhel_10-kernels.json b/cmd/osquery-perf/rhel_10-kernels.json new file mode 100644 index 0000000000..7db051c157 --- /dev/null +++ b/cmd/osquery-perf/rhel_10-kernels.json @@ -0,0 +1,27 @@ +[ + {"name": "kernel", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-extra", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-devel", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"} +] diff --git a/cmd/osquery-perf/rhel_10.tmpl b/cmd/osquery-perf/rhel_10.tmpl new file mode 100644 index 0000000000..b27666683f --- /dev/null +++ b/cmd/osquery-perf/rhel_10.tmpl @@ -0,0 +1,207 @@ +{{ define "enroll" -}} +{ + "enroll_secret": "{{ .EnrollSecret }}", + "host_details": { + "os_version": { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "10", + "minor": "0", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 10.0 (Coughlan)" + }, + "osquery_info": { + "build_distro": "centos7", + "build_platform": "linux", + "config_hash": "", + "config_valid": "0", + "extensions": "inactive", + "instance_id": "{{ .UUID }}", + "pid": "12947", + "platform_mask": "21", + "start_time": "1580931224", + "uuid": "{{ .UUID }}", + "version": "5.5.1", + "watcher": "-1" + }, + "platform_info": { + }, + "system_info": { + "computer_name": "{{ .CachedString "hostname" }}", + "cpu_brand": "AMD EPYC 9554 64-Core Processor", + "cpu_logical_cores": "16", + "cpu_physical_cores": "8", + "cpu_subtype": "AMD64", + "cpu_type": "x86_64", + "hardware_model": "PowerEdge R760", + "hardware_serial": "{{ .SerialNumber }}", + "hardware_vendor": "Dell Inc.", + "hardware_version": "1.0", + "hostname": "{{ .CachedString "hostname" }}", + "local_hostname": "{{ .CachedString "hostname" }}", + "physical_memory": "34359738368", + "uuid": "{{ .UUID }}" + } + }, + "host_identifier": "{{ .UUID }}", + "platform_type": "16" +} +{{- end }} + +{{ define "fleet_detail_query_network_interface_unix" -}} +[ + { + "address":"fe80::8cb:112d:ff51:1e5d%en0", + "mac":"f8:2d:88:93:56:5c" + } +] +{{- end }} +{{ define "fleet_detail_query_os_version" -}} +[ + { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "10", + "minor": "0", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 10.0 (Coughlan)" + } +] +{{- end }} +{{ define "fleet_detail_query_os_unix_like" -}} +[ + { + "name":"Red Hat Enterprise Linux", + "version":"Red Hat Enterprise Linux release 10.0 (Coughlan)", + "major":"10", + "minor":"0", + "patch":"0", + "build":"", + "extra":"", + "platform":"rhel", + "arch":"x86_64", + "kernel_version":"6.12.0-55.7.1.el10_0.x86_64" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_flags" -}} +[ + { + "name":"config_refresh", + "value":"{{ printf "%.0f" .ConfigInterval.Seconds }}" + }, + { + "name":"distributed_interval", + "value":"{{ printf "%.0f" .QueryInterval.Seconds }}" + }, + { + "name":"logger_tls_period", + "value":"99999" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_info" -}} +[ + { + "pid":"11287", + "uuid":"{{ .UUID }}", + "instance_id":"{{ .UUID }}", + "version":"5.5.1", + "config_hash":"b01efbf375ac6767f259ae98751154fef727ce35", + "config_valid":"1", + "extensions":"inactive", + "build_platform":"linux", + "build_distro":"centos7", + "start_time":"1582857555", + "watcher":"-1", + "platform_mask":"9" + } +] +{{- end }} +{{ define "fleet_detail_query_system_info" -}} +[ + { + "hostname":"{{ .CachedString "hostname" }}", + "uuid":"{{ .UUID }}", + "cpu_type":"x86_64", + "cpu_subtype":"AMD64", + "cpu_brand":"AMD EPYC 9554 64-Core Processor", + "cpu_physical_cores":"8", + "cpu_logical_cores":"16", + "cpu_microcode":"", + "physical_memory":"34359738368", + "hardware_vendor":"Dell Inc.", + "hardware_model":"PowerEdge R760", + "hardware_version":"1.0", + "hardware_serial":"{{ .SerialNumber }}", + "computer_name":"{{ .CachedString "hostname" }}", + "local_hostname":"{{ .CachedString "hostname" }}" + } +] +{{- end }} +{{ define "fleet_detail_query_uptime" -}} +[ + { + "days":"0", + "hours":"4", + "minutes":"38", + "seconds":"11", + "total_seconds":"16691" + } +] +{{- end }} + +{{/* all hosts */}} +{{ define "fleet_label_query_6" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All macOS hosts */}} +{{ define "fleet_label_query_7" -}} +[] +{{- end }} + +{{/* All Ubuntu hosts */}} +{{ define "fleet_label_query_8" -}} +[] +{{- end }} + +{{/* All CentOS hosts */}} +{{ define "fleet_label_query_9" -}} +[] +{{- end }} + +{{/* All Windows hosts */}} +{{ define "fleet_label_query_10" -}} +[] +{{- end }} + +{{/* All Red Hat hosts */}} +{{ define "fleet_label_query_11" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All Linux distributions */}} +{{ define "fleet_label_query_12" -}} +[ + { + "1": "1" + } +] +{{- end }} diff --git a/cmd/osquery-perf/rhel_8-kernels.json b/cmd/osquery-perf/rhel_8-kernels.json new file mode 100644 index 0000000000..0c0d6005af --- /dev/null +++ b/cmd/osquery-perf/rhel_8-kernels.json @@ -0,0 +1,37 @@ +[ + {"name": "kernel", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-extra", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-devel", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug-core", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug-modules", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"} +] diff --git a/cmd/osquery-perf/rhel_8.tmpl b/cmd/osquery-perf/rhel_8.tmpl new file mode 100644 index 0000000000..82475e2233 --- /dev/null +++ b/cmd/osquery-perf/rhel_8.tmpl @@ -0,0 +1,207 @@ +{{ define "enroll" -}} +{ + "enroll_secret": "{{ .EnrollSecret }}", + "host_details": { + "os_version": { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "8", + "minor": "10", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 8.10 (Ootpa)" + }, + "osquery_info": { + "build_distro": "centos7", + "build_platform": "linux", + "config_hash": "", + "config_valid": "0", + "extensions": "inactive", + "instance_id": "{{ .UUID }}", + "pid": "12947", + "platform_mask": "21", + "start_time": "1580931224", + "uuid": "{{ .UUID }}", + "version": "5.5.1", + "watcher": "-1" + }, + "platform_info": { + }, + "system_info": { + "computer_name": "{{ .CachedString "hostname" }}", + "cpu_brand": "Intel(R) Xeon(R) CPU E5-2670 v3 @ 2.30GHz", + "cpu_logical_cores": "8", + "cpu_physical_cores": "4", + "cpu_subtype": "Intel x86-64h Haswell", + "cpu_type": "x86_64h", + "hardware_model": "PowerEdge R640", + "hardware_serial": "{{ .SerialNumber }}", + "hardware_vendor": "Dell Inc.", + "hardware_version": "1.0", + "hostname": "{{ .CachedString "hostname" }}", + "local_hostname": "{{ .CachedString "hostname" }}", + "physical_memory": "17179869184", + "uuid": "{{ .UUID }}" + } + }, + "host_identifier": "{{ .UUID }}", + "platform_type": "16" +} +{{- end }} + +{{ define "fleet_detail_query_network_interface_unix" -}} +[ + { + "address":"fe80::8cb:112d:ff51:1e5d%en0", + "mac":"f8:2d:88:93:56:5c" + } +] +{{- end }} +{{ define "fleet_detail_query_os_version" -}} +[ + { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "8", + "minor": "10", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 8.10 (Ootpa)" + } +] +{{- end }} +{{ define "fleet_detail_query_os_unix_like" -}} +[ + { + "name":"Red Hat Enterprise Linux", + "version":"Red Hat Enterprise Linux release 8.10 (Ootpa)", + "major":"8", + "minor":"10", + "patch":"0", + "build":"", + "extra":"", + "platform":"rhel", + "arch":"x86_64", + "kernel_version":"4.18.0-553.30.1.el8_10.x86_64" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_flags" -}} +[ + { + "name":"config_refresh", + "value":"{{ printf "%.0f" .ConfigInterval.Seconds }}" + }, + { + "name":"distributed_interval", + "value":"{{ printf "%.0f" .QueryInterval.Seconds }}" + }, + { + "name":"logger_tls_period", + "value":"99999" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_info" -}} +[ + { + "pid":"11287", + "uuid":"{{ .UUID }}", + "instance_id":"{{ .UUID }}", + "version":"5.5.1", + "config_hash":"b01efbf375ac6767f259ae98751154fef727ce35", + "config_valid":"1", + "extensions":"inactive", + "build_platform":"linux", + "build_distro":"centos7", + "start_time":"1582857555", + "watcher":"-1", + "platform_mask":"9" + } +] +{{- end }} +{{ define "fleet_detail_query_system_info" -}} +[ + { + "hostname":"{{ .CachedString "hostname" }}", + "uuid":"{{ .UUID }}", + "cpu_type":"x86_64h", + "cpu_subtype":"Intel x86-64h Haswell", + "cpu_brand":"Intel(R) Xeon(R) CPU E5-2670 v3 @ 2.30GHz", + "cpu_physical_cores":"4", + "cpu_logical_cores":"8", + "cpu_microcode":"", + "physical_memory":"17179869184", + "hardware_vendor":"Dell Inc.", + "hardware_model":"PowerEdge R640", + "hardware_version":"1.0", + "hardware_serial":"{{ .SerialNumber }}", + "computer_name":"{{ .CachedString "hostname" }}", + "local_hostname":"{{ .CachedString "hostname" }}" + } +] +{{- end }} +{{ define "fleet_detail_query_uptime" -}} +[ + { + "days":"0", + "hours":"4", + "minutes":"38", + "seconds":"11", + "total_seconds":"16691" + } +] +{{- end }} + +{{/* all hosts */}} +{{ define "fleet_label_query_6" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All macOS hosts */}} +{{ define "fleet_label_query_7" -}} +[] +{{- end }} + +{{/* All Ubuntu hosts */}} +{{ define "fleet_label_query_8" -}} +[] +{{- end }} + +{{/* All CentOS hosts */}} +{{ define "fleet_label_query_9" -}} +[] +{{- end }} + +{{/* All Windows hosts */}} +{{ define "fleet_label_query_10" -}} +[] +{{- end }} + +{{/* All Red Hat hosts */}} +{{ define "fleet_label_query_11" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All Linux distributions */}} +{{ define "fleet_label_query_12" -}} +[ + { + "1": "1" + } +] +{{- end }} diff --git a/cmd/osquery-perf/rhel_9-kernels.json b/cmd/osquery-perf/rhel_9-kernels.json new file mode 100644 index 0000000000..7586f136a4 --- /dev/null +++ b/cmd/osquery-perf/rhel_9-kernels.json @@ -0,0 +1,44 @@ +[ + {"name": "kernel", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-extra", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-devel", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-debug-modules", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-tools-libs", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-headers", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-core", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"}, + {"name": "kernel-modules", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"} +] diff --git a/cmd/osquery-perf/rhel_9.tmpl b/cmd/osquery-perf/rhel_9.tmpl new file mode 100644 index 0000000000..0939a0e470 --- /dev/null +++ b/cmd/osquery-perf/rhel_9.tmpl @@ -0,0 +1,207 @@ +{{ define "enroll" -}} +{ + "enroll_secret": "{{ .EnrollSecret }}", + "host_details": { + "os_version": { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "9", + "minor": "4", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 9.4 (Plow)" + }, + "osquery_info": { + "build_distro": "centos7", + "build_platform": "linux", + "config_hash": "", + "config_valid": "0", + "extensions": "inactive", + "instance_id": "{{ .UUID }}", + "pid": "12947", + "platform_mask": "21", + "start_time": "1580931224", + "uuid": "{{ .UUID }}", + "version": "5.5.1", + "watcher": "-1" + }, + "platform_info": { + }, + "system_info": { + "computer_name": "{{ .CachedString "hostname" }}", + "cpu_brand": "Intel(R) Xeon(R) Gold 6248R CPU @ 3.00GHz", + "cpu_logical_cores": "8", + "cpu_physical_cores": "4", + "cpu_subtype": "Intel x86-64h Haswell", + "cpu_type": "x86_64h", + "hardware_model": "PowerEdge R750", + "hardware_serial": "{{ .SerialNumber }}", + "hardware_vendor": "Dell Inc.", + "hardware_version": "1.0", + "hostname": "{{ .CachedString "hostname" }}", + "local_hostname": "{{ .CachedString "hostname" }}", + "physical_memory": "17179869184", + "uuid": "{{ .UUID }}" + } + }, + "host_identifier": "{{ .UUID }}", + "platform_type": "16" +} +{{- end }} + +{{ define "fleet_detail_query_network_interface_unix" -}} +[ + { + "address":"fe80::8cb:112d:ff51:1e5d%en0", + "mac":"f8:2d:88:93:56:5c" + } +] +{{- end }} +{{ define "fleet_detail_query_os_version" -}} +[ + { + "arch": "x86_64", + "build": "", + "codename": "", + "major": "9", + "minor": "4", + "name": "Red Hat Enterprise Linux", + "patch": "0", + "platform": "rhel", + "platform_like": "rhel", + "version": "Red Hat Enterprise Linux release 9.4 (Plow)" + } +] +{{- end }} +{{ define "fleet_detail_query_os_unix_like" -}} +[ + { + "name":"Red Hat Enterprise Linux", + "version":"Red Hat Enterprise Linux release 9.4 (Plow)", + "major":"9", + "minor":"4", + "patch":"0", + "build":"", + "extra":"", + "platform":"rhel", + "arch":"x86_64", + "kernel_version":"5.14.0-503.26.1.el9_5.x86_64" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_flags" -}} +[ + { + "name":"config_refresh", + "value":"{{ printf "%.0f" .ConfigInterval.Seconds }}" + }, + { + "name":"distributed_interval", + "value":"{{ printf "%.0f" .QueryInterval.Seconds }}" + }, + { + "name":"logger_tls_period", + "value":"99999" + } +] +{{- end }} +{{ define "fleet_detail_query_osquery_info" -}} +[ + { + "pid":"11287", + "uuid":"{{ .UUID }}", + "instance_id":"{{ .UUID }}", + "version":"5.5.1", + "config_hash":"b01efbf375ac6767f259ae98751154fef727ce35", + "config_valid":"1", + "extensions":"inactive", + "build_platform":"linux", + "build_distro":"centos7", + "start_time":"1582857555", + "watcher":"-1", + "platform_mask":"9" + } +] +{{- end }} +{{ define "fleet_detail_query_system_info" -}} +[ + { + "hostname":"{{ .CachedString "hostname" }}", + "uuid":"{{ .UUID }}", + "cpu_type":"x86_64h", + "cpu_subtype":"Intel x86-64h Haswell", + "cpu_brand":"Intel(R) Xeon(R) Gold 6248R CPU @ 3.00GHz", + "cpu_physical_cores":"4", + "cpu_logical_cores":"8", + "cpu_microcode":"", + "physical_memory":"17179869184", + "hardware_vendor":"Dell Inc.", + "hardware_model":"PowerEdge R750", + "hardware_version":"1.0", + "hardware_serial":"{{ .SerialNumber }}", + "computer_name":"{{ .CachedString "hostname" }}", + "local_hostname":"{{ .CachedString "hostname" }}" + } +] +{{- end }} +{{ define "fleet_detail_query_uptime" -}} +[ + { + "days":"0", + "hours":"4", + "minutes":"38", + "seconds":"11", + "total_seconds":"16691" + } +] +{{- end }} + +{{/* all hosts */}} +{{ define "fleet_label_query_6" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All macOS hosts */}} +{{ define "fleet_label_query_7" -}} +[] +{{- end }} + +{{/* All Ubuntu hosts */}} +{{ define "fleet_label_query_8" -}} +[] +{{- end }} + +{{/* All CentOS hosts */}} +{{ define "fleet_label_query_9" -}} +[] +{{- end }} + +{{/* All Windows hosts */}} +{{ define "fleet_label_query_10" -}} +[] +{{- end }} + +{{/* All Red Hat hosts */}} +{{ define "fleet_label_query_11" -}} +[ + { + "1": "1" + } +] +{{- end }} + +{{/* All Linux distributions */}} +{{ define "fleet_label_query_12" -}} +[ + { + "1": "1" + } +] +{{- end }}