diff --git a/orbit/changes/extension-tables b/orbit/changes/extension-tables new file mode 100644 index 0000000000..6a1ec8b00c --- /dev/null +++ b/orbit/changes/extension-tables @@ -0,0 +1 @@ +* Add github.com/macadmins/osquery-extension tables. diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go index 1ad761e4ff..3cdeb78a86 100644 --- a/orbit/cmd/orbit/orbit.go +++ b/orbit/cmd/orbit/orbit.go @@ -9,7 +9,6 @@ import ( "net/url" "os" "path/filepath" - "runtime" "strings" "time" @@ -351,10 +350,8 @@ func main() { g.Add(r.Execute, r.Interrupt) // Extension tables not yet supported on Windows. - if runtime.GOOS != "windows" { - ext, _ := table.NewRunner("/var/lib/orbit/osquery.em") - g.Add(ext.Execute, ext.Interrupt) - } + ext := table.NewRunner(r.ExtensionSocketPath()) + g.Add(ext.Execute, ext.Interrupt) // Install a signal handler ctx, cancel := context.WithCancel(context.Background()) diff --git a/orbit/cmd/orbit/shell.go b/orbit/cmd/orbit/shell.go index 0ff6b58ea9..d6e7cdf783 100644 --- a/orbit/cmd/orbit/shell.go +++ b/orbit/cmd/orbit/shell.go @@ -4,7 +4,6 @@ import ( "context" "os" "path/filepath" - "runtime" "github.com/fleetdm/fleet/v4/orbit/pkg/constant" "github.com/fleetdm/fleet/v4/orbit/pkg/osquery" @@ -81,10 +80,8 @@ var shellCommand = &cli.Command{ g.Add(r.Execute, r.Interrupt) // Extension tables not yet supported on Windows. - if runtime.GOOS != "windows" { - ext, _ := table.NewRunner("/var/lib/orbit/osquery.em") - g.Add(ext.Execute, ext.Interrupt) - } + ext := table.NewRunner(r.ExtensionSocketPath()) + g.Add(ext.Execute, ext.Interrupt) // Install a signal handler ctx, cancel := context.WithCancel(context.Background()) diff --git a/orbit/pkg/osquery/osquery.go b/orbit/pkg/osquery/osquery.go index 700a5d7037..5ad88e23ca 100644 --- a/orbit/pkg/osquery/osquery.go +++ b/orbit/pkg/osquery/osquery.go @@ -6,6 +6,7 @@ import ( "os" "os/exec" "path/filepath" + "runtime" "time" "github.com/fleetdm/fleet/v4/orbit/pkg/constant" @@ -15,12 +16,18 @@ import ( "github.com/rs/zerolog/log" ) +const ( + extensionSocketName = "orbit-osquery.em" + windowsExtensionSocketPath = `\\.\pipe\orbit-osquery-extension` +) + // Runner is a specialized runner for osquery. It is designed with Execute and // Interrupt functions to be compatible with oklog/run. type Runner struct { - proc *process.Process - cmd *exec.Cmd - cancel func() + proc *process.Process + cmd *exec.Cmd + dataPath string + cancel func() } // NewRunner creates a new osquery runner given the provided functional options. @@ -72,6 +79,8 @@ func WithShell() func(*Runner) error { func WithDataPath(path string) func(*Runner) error { return func(r *Runner) error { + r.dataPath = path + if err := secure.MkdirAll(filepath.Join(path, "logs"), constant.DefaultDirMode); err != nil { return errors.Wrap(err, "initialize osquery data path") } @@ -79,7 +88,7 @@ func WithDataPath(path string) func(*Runner) error { r.cmd.Args = append(r.cmd.Args, "--pidfile="+filepath.Join(path, "osquery.pid"), "--database_path="+filepath.Join(path, "osquery.db"), - "--extensions_socket="+filepath.Join(path, "osquery.em"), + "--extensions_socket="+r.ExtensionSocketPath(), ) return nil } @@ -124,3 +133,11 @@ func (r *Runner) Interrupt(err error) { log.Debug().Msg("interrupt osquery") r.cancel() } + +func (r *Runner) ExtensionSocketPath() string { + if runtime.GOOS == "windows" { + return windowsExtensionSocketPath + } + + return filepath.Join(r.dataPath, extensionSocketName) +} diff --git a/orbit/pkg/table/extension.go b/orbit/pkg/table/extension.go index 97d738e4fb..dcd8fcaa90 100644 --- a/orbit/pkg/table/extension.go +++ b/orbit/pkg/table/extension.go @@ -5,6 +5,10 @@ import ( "time" "github.com/kolide/osquery-go" + "github.com/kolide/osquery-go/plugin/table" + "github.com/macadmins/osquery-extension/tables/chromeuserprofiles" + "github.com/macadmins/osquery-extension/tables/fileline" + "github.com/macadmins/osquery-extension/tables/puppet" "github.com/rs/zerolog/log" ) @@ -16,9 +20,9 @@ type Runner struct { } // NewRunner creates an extension runner. -func NewRunner(socket string) (*Runner, error) { +func NewRunner(socket string) *Runner { r := &Runner{socket: socket} - return r, nil + return r } // Execute creates an osquery extension manager server and registers osquery plugins. @@ -46,7 +50,13 @@ func (r *Runner) Execute() error { } } - var plugins []osquery.OsqueryPlugin + plugins := []osquery.OsqueryPlugin{ + table.NewPlugin("puppet_info", puppet.PuppetInfoColumns(), puppet.PuppetInfoGenerate), + table.NewPlugin("puppet_logs", puppet.PuppetLogsColumns(), puppet.PuppetLogsGenerate), + table.NewPlugin("puppet_state", puppet.PuppetStateColumns(), puppet.PuppetStateGenerate), + table.NewPlugin("google_chrome_profiles", chromeuserprofiles.GoogleChromeProfilesColumns(), chromeuserprofiles.GoogleChromeProfilesGenerate), + table.NewPlugin("file_lines", fileline.FileLineColumns(), fileline.FileLineGenerate), + } plugins = append(plugins, platformTables()...) r.srv.RegisterPlugin(plugins...) diff --git a/orbit/pkg/table/extension_darwin.go b/orbit/pkg/table/extension_darwin.go index 468ccf259c..5e9ca48521 100644 --- a/orbit/pkg/table/extension_darwin.go +++ b/orbit/pkg/table/extension_darwin.go @@ -6,18 +6,20 @@ import ( "github.com/kolide/osquery-go" "github.com/kolide/osquery-go/plugin/table" + "github.com/macadmins/osquery-extension/tables/filevaultusers" "github.com/macadmins/osquery-extension/tables/macos_profiles" "github.com/macadmins/osquery-extension/tables/mdm" "github.com/macadmins/osquery-extension/tables/munki" + "github.com/macadmins/osquery-extension/tables/unifiedlog" ) func platformTables() []osquery.OsqueryPlugin { - var plugins []osquery.OsqueryPlugin - plugins = append(plugins, - table.NewPlugin("mdm", mdm.MDMInfoColumns(), mdm.MDMInfoGenerate), + return []osquery.OsqueryPlugin{ + table.NewPlugin("filevault_users", filevaultusers.FileVaultUsersColumns(), filevaultusers.FileVaultUsersGenerate), table.NewPlugin("macos_profiles", macos_profiles.MacOSProfilesColumns(), macos_profiles.MacOSProfilesGenerate), + table.NewPlugin("mdm", mdm.MDMInfoColumns(), mdm.MDMInfoGenerate), table.NewPlugin("munki_info", munki.MunkiInfoColumns(), munki.MunkiInfoGenerate), table.NewPlugin("munki_installs", munki.MunkiInstallsColumns(), munki.MunkiInstallsGenerate), - ) - return plugins + table.NewPlugin("unified_log", unifiedlog.UnifiedLogColumns(), unifiedlog.UnifiedLogGenerate), + } }