From 142e298631fb36db0fb40e23bde6f19b30a5cd19 Mon Sep 17 00:00:00 2001 From: Martin Angers Date: Tue, 27 Sep 2022 08:35:57 -0400 Subject: [PATCH] Update osquery validations from 5.4.0 to 5.5.1 (#7960) --- changes/issue-7871-update-osquery-validations-to-5.5.1 | 1 + server/fleet/agent_options.go | 5 +++-- server/fleet/agent_options_test.go | 10 ++++++++++ tools/osquery-agent-options/README.md | 4 ++-- 4 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 changes/issue-7871-update-osquery-validations-to-5.5.1 diff --git a/changes/issue-7871-update-osquery-validations-to-5.5.1 b/changes/issue-7871-update-osquery-validations-to-5.5.1 new file mode 100644 index 0000000000..bb729bcf0c --- /dev/null +++ b/changes/issue-7871-update-osquery-validations-to-5.5.1 @@ -0,0 +1 @@ +* Updated team and organization settings' "agent options" validations from osquery 5.4.0 to osquery 5.5.1. diff --git a/server/fleet/agent_options.go b/server/fleet/agent_options.go index e801cf9ed6..5345db5c35 100644 --- a/server/fleet/agent_options.go +++ b/server/fleet/agent_options.go @@ -62,7 +62,7 @@ func ValidateJSONAgentOptions(rawJSON json.RawMessage) error { // See https://osquery.readthedocs.io/en/stable/deployment/configuration/#configuration-specification // // NOTE: Update the following line with the version used for validation. -// Current version: 5.4.0 +// Current version: 5.5.1 type osqueryAgentOptions struct { Options osqueryOptions `json:"options"` @@ -196,6 +196,7 @@ type osqueryOptions struct { DisableHashCache bool `json:"disable_hash_cache"` DisableLogging bool `json:"disable_logging"` DisableMemory bool `json:"disable_memory"` + DistributedDenylistDuration uint64 `json:"distributed_denylist_duration"` DistributedInterval uint64 `json:"distributed_interval"` DistributedLoginfo bool `json:"distributed_loginfo"` DistributedPlugin string `json:"distributed_plugin"` @@ -237,6 +238,7 @@ type osqueryOptions struct { LoggerTlsMaxLinesize uint64 `json:"logger_tls_max_linesize"` LoggerTlsPeriod uint64 `json:"logger_tls_period"` LxdSocket string `json:"lxd_socket"` + MallocTrimThreshold uint64 `json:"malloc_trim_threshold"` Nullvalue string `json:"nullvalue"` NumericMonitoringFilesystemPath string `json:"numeric_monitoring_filesystem_path"` NumericMonitoringPlugins string `json:"numeric_monitoring_plugins"` @@ -265,7 +267,6 @@ type osqueryOptions struct { Verbose bool `json:"verbose"` WorkerThreads int32 `json:"worker_threads"` YaraDelay uint32 `json:"yara_delay"` - YaraMallocTrim bool `json:"yara_malloc_trim"` } // while ValidateJSONAgentOptions validates an entire Agent Options payload, diff --git a/server/fleet/agent_options_test.go b/server/fleet/agent_options_test.go index 49829b96c6..0b485e804c 100644 --- a/server/fleet/agent_options_test.go +++ b/server/fleet/agent_options_test.go @@ -96,6 +96,16 @@ func TestValidateAgentOptions(t *testing.T) { "pack1": 1 } }}`, `invalid number value`}, + {"option added in osquery 5.5.1", `{"config":{ + "options": { + "malloc_trim_threshold": 100 + } + }}`, ``}, + {"option removed in osquery 5.5.1", `{"config":{ + "options": { + "yara_malloc_trim": true + } + }}`, `unknown field "yara_malloc_trim"`}, } for _, c := range cases { diff --git a/tools/osquery-agent-options/README.md b/tools/osquery-agent-options/README.md index b47126a43a..c7bab07205 100644 --- a/tools/osquery-agent-options/README.md +++ b/tools/osquery-agent-options/README.md @@ -1,7 +1,7 @@ # osquery-agent-options -This directory contains a script (a Go command) that generates the struct needed to unmarshal the Agent Options' `options` values that the current version of osquery supports. It extracts this information from `osqueryd --help` to identify which osquery command-line flags can be set via the options, and running a query in `osqueryi` to get the data type of those options. +This directory contains a script (a Go command) that generates the struct needed to unmarshal the Agent Options' `options` values that the current version of osquery supports. It extracts this information from `osqueryd --help` to identify which osquery command-line flags can be set via the options and which are only for the command-line (i.e. require a restart), and running a query in `osqueryi` to get the data type of those options. -It prints the resulting Go code to stdout, you can just copy it and insert it in the proper location in the source code. +It prints the resulting Go code to stdout (the `osqueryOptions` and the `osqueryCommandLineFlags` structs), you can just copy it and insert it in the proper location in the source code to replace the existing struct (in `server/fleet/agent_options.go`). Note that the latest version of osquery should be installed for this tool to work properly (`osqueryd` and `osqueryi` must be in your $PATH).