Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

adjust osquery_perf to respect config settings (#7418)

Browse Source 
users, software_macos and software_linux queries can be optionally disabled in the fleet server via the enable_host_users and enable_software_inventory config settings, however osquery_perf is always running them.

this adjusts the code accordingly to only execute them if the server asks.
This commit is contained in:
Roberto Dip
2022-08-29 13:34:40 -03:00
committed by GitHub
parent 3d75ddcdc2
commit f9bb0b3dc0
10 changed files with 105 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/osquery-perf/agent.go
+102 -46
View File
@@ -164,6 +164,7 @@ type agent struct {
nodeKeyManager *nodeKeyManager
nodeKey string
templates *template.Template
os string
// deviceAuthToken holds Fleet Desktop device authentication token.
//
// Non-nil means the agent is identified as orbit osquery,
@@ -219,6 +220,7 @@ func newAgent(
},
templates: templates,
deviceAuthToken: deviceAuthToken,
os: strings.TrimRight(templates.Name(), ".tmpl"),
EnrollSecret: enrollSecret,
ConfigInterval: configInterval,
@@ -388,27 +390,27 @@ func (a *agent) CachedString(key string) string {
return val
}
func (a *agent) HostUsersMacOS() []fleet.HostUser {
func (a *agent) hostUsersMacOS() []map[string]string {
groupNames := []string{"staff", "nobody", "wheel", "tty", "daemon"}
shells := []string{"/bin/zsh", "/bin/sh", "/usr/bin/false", "/bin/bash"}
commonUsers := make([]fleet.HostUser, a.userCount.common)
commonUsers := make([]map[string]string, a.userCount.common)
for i := 0; i < len(commonUsers); i++ {
commonUsers[i] = fleet.HostUser{
Uid: uint(i),
Username: fmt.Sprintf("Common_%d", i),
Type: "", // Empty for macOS.
GroupName: groupNames[i%len(groupNames)],
Shell: shells[i%len(shells)],
commonUsers[i] = map[string]string{
"uid": fmt.Sprint(i),
"username": fmt.Sprintf("Common_%d", i),
"type": "", // Empty for macOS.
"groupname": groupNames[i%len(groupNames)],
"shell": shells[i%len(shells)],
}
}
uniqueUsers := make([]fleet.HostUser, a.userCount.unique)
uniqueUsers := make([]map[string]string, a.userCount.unique)
for i := 0; i < len(uniqueUsers); i++ {
uniqueUsers[i] = fleet.HostUser{
Uid: uint(i),
Username: fmt.Sprintf("Unique_%d_%d", a.agentIndex, i),
Type: "", // Empty for macOS.
GroupName: groupNames[i%len(groupNames)],
Shell: shells[i%len(shells)],
uniqueUsers[i] = map[string]string{
"uid": fmt.Sprint(i),
"username": fmt.Sprintf("Unique_%d_%d", a.agentIndex, i),
"type": "", // Empty for macOS.
"groupname": groupNames[i%len(groupNames)],
"shell": shells[i%len(shells)],
}
}
users := append(commonUsers, uniqueUsers...)
@@ -439,7 +441,7 @@ func extract(src, dst string) {
}
}
func loadSoftware(platform string, ver string) []fleet.Software {
func loadSoftware(platform string, ver string) []map[string]string {
_, exFilename, _, ok := runtime.Caller(0)
if !ok {
panic("No caller information")
@@ -487,72 +489,89 @@ func loadSoftware(platform string, ver string) []fleet.Software {
return nil
}
var r []fleet.Software
var r []map[string]string
for _, fi := range software {
r = append(r, fleet.Software{
Name: fi.Name,
Version: fi.Version,
Source: "osquery-perf",
r = append(r, map[string]string{
"name": fi.Name,
"version": fi.Version,
"source": "osquery-perf",
})
}
return r
}
func (a *agent) SoftwareWindows11() []fleet.Software {
func (a *agent) softwareWindows11() []map[string]string {
return loadSoftware("windows", "11")
}
func (a *agent) SoftwareUbuntu1604() []fleet.Software {
func (a *agent) softwareUbuntu1604() []map[string]string {
return loadSoftware("ubuntu", "1604")
}
func (a *agent) SoftwareUbuntu1804() []fleet.Software {
func (a *agent) softwareUbuntu1804() []map[string]string {
return loadSoftware("ubuntu", "1804")
}
func (a *agent) SoftwareUbuntu2004() []fleet.Software {
func (a *agent) softwareUbuntu2004() []map[string]string {
return loadSoftware("ubuntu", "2004")
}
func (a *agent) SoftwareUbuntu2104() []fleet.Software {
func (a *agent) softwareUbuntu2104() []map[string]string {
return loadSoftware("ubuntu", "2104")
}
func (a *agent) SoftwareUbuntu2110() []fleet.Software {
func (a *agent) softwareUbuntu2110() []map[string]string {
return loadSoftware("ubuntu", "2110")
}
func (a *agent) SoftwareUbuntu2204() []fleet.Software {
func (a *agent) softwareUbuntu2204() []map[string]string {
return loadSoftware("ubuntu", "2204")
}
func (a *agent) SoftwareMacOS() []fleet.Software {
func (a *agent) softwareMacOS() []map[string]string {
var lastOpenedCount int
commonSoftware := make([]fleet.Software, a.softwareCount.common)
commonSoftware := make([]map[string]string, a.softwareCount.common)
for i := 0; i < len(commonSoftware); i++ {
commonSoftware[i] = fleet.Software{
Name: fmt.Sprintf("Common_%d", i),
Version: "0.0.1",
BundleIdentifier: "com.fleetdm.osquery-perf",
Source: "osquery-perf",
LastOpenedAt: a.genLastOpenedAt(&lastOpenedCount),
var lastOpenedAt string
if l := a.genLastOpenedAt(&lastOpenedCount); l != nil {
lastOpenedAt = l.Format(time.UnixDate)
}
commonSoftware[i] = map[string]string{
"name": fmt.Sprintf("Common_%d", i),
"version": "0.0.1",
"bundle_identifier": "com.fleetdm.osquery-perf",
"source": "osquery-perf",
"last_opened_at": lastOpenedAt,
}
}
uniqueSoftware := make([]fleet.Software, a.softwareCount.unique)
uniqueSoftware := make([]map[string]string, a.softwareCount.unique)
for i := 0; i < len(uniqueSoftware); i++ {
uniqueSoftware[i] = fleet.Software{
Name: fmt.Sprintf("Unique_%s_%d", a.CachedString("hostname"), i),
Version: "1.1.1",
BundleIdentifier: "com.fleetdm.osquery-perf",
Source: "osquery-perf",
LastOpenedAt: a.genLastOpenedAt(&lastOpenedCount),
var lastOpenedAt string
if l := a.genLastOpenedAt(&lastOpenedCount); l != nil {
lastOpenedAt = l.Format(time.UnixDate)
}
uniqueSoftware[i] = map[string]string{
"name": fmt.Sprintf("Unique_%s_%d", a.CachedString("hostname"), i),
"version": "1.1.1",
"bundle_identifier": "com.fleetdm.osquery-perf",
"source": "osquery-perf",
"last_opened_at": lastOpenedAt,
}
}
randomVulnerableSoftware := make([]fleet.Software, a.softwareCount.vulnerable)
randomVulnerableSoftware := make([]map[string]string, a.softwareCount.vulnerable)
for i := 0; i < len(randomVulnerableSoftware); i++ {
sw := vulnerableSoftware[rand.Intn(len(vulnerableSoftware))]
sw.LastOpenedAt = a.genLastOpenedAt(&lastOpenedCount)
randomVulnerableSoftware[i] = sw
var lastOpenedAt string
if l := a.genLastOpenedAt(&lastOpenedCount); l != nil {
lastOpenedAt = l.Format(time.UnixDate)
}
randomVulnerableSoftware[i] = map[string]string{
"name": sw.Name,
"version": sw.Version,
"bundle_identifier": sw.BundleIdentifier,
"source": sw.Source,
"last_opened_at": lastOpenedAt,
}
}
software := append(commonSoftware, uniqueSoftware...)
software = append(software, randomVulnerableSoftware...)
@@ -776,6 +795,43 @@ func (a *agent) processQuery(name, query string) (handled bool, results []map[st
results = a.osUnixLike()
}
return true, results, &ss
case name == hostDetailQueryPrefix+"users":
ss := fleet.OsqueryStatus(rand.Intn(2))
if ss == fleet.StatusOK {
results = a.hostUsersMacOS()
}
return true, results, &ss
case name == hostDetailQueryPrefix+"software_macos":
ss := fleet.OsqueryStatus(rand.Intn(2))
if ss == fleet.StatusOK {
results = a.softwareMacOS()
}
return true, results, &ss
case name == hostDetailQueryPrefix+"software_windows":
ss := fleet.OsqueryStatus(rand.Intn(2))
if ss == fleet.StatusOK {
results = a.softwareWindows11()
}
return true, results, &ss
case name == hostDetailQueryPrefix+"software_linux":
ss := fleet.OsqueryStatus(rand.Intn(2))
if ss == fleet.StatusOK {
switch a.os {
case "ubuntu_16.04":
results = a.softwareUbuntu1604()
case "ubuntu_18.04":
results = a.softwareUbuntu1804()
case "ubuntu_20.04":
results = a.softwareUbuntu2004()
case "ubuntu_21.04":
results = a.softwareUbuntu2104()
case "ubuntu_21.10":
results = a.softwareUbuntu2110()
case "ubuntu_22.04":
results = a.softwareUbuntu2204()
}
}
return true, results, &ss
default:
// Look for results in the template file.
cmd/osquery-perf/mac10.14.6.tmpl
-35
View File
@@ -284,21 +284,6 @@
]
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{/* all hosts */}}
{{ define "fleet_label_query_6" -}}
[
@@ -342,23 +327,3 @@
[]
{{- end }}
{{ define "fleet_detail_query_software_macos" -}}
[
{{ range $index, $item := .SoftwareMacOS }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application (macOS)",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/partial_ubuntu.tmpl
+1 -16
View File
@@ -194,21 +194,6 @@
]
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{/* all hosts */}}
{{ define "fleet_label_query_6" -}}
[
@@ -250,4 +235,4 @@
{{/* All Linux distributions */}}
{{ define "fleet_label_query_12" -}}
[]
{{- end }}
{{- end }}
cmd/osquery-perf/ubuntu_16.04.tmpl
+1 -22
View File
@@ -96,27 +96,6 @@
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu1604 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
{{template "fleet_detail_query_network_interface" .}}
{{template "fleet_detail_query_osquery_flags" .}}
{{template "fleet_detail_query_system_info" .}}
@@ -127,4 +106,4 @@
{{template "fleet_label_query_9" .}}
{{template "fleet_label_query_10" .}}
{{template "fleet_label_query_11" .}}
{{template "fleet_label_query_12" .}}
{{template "fleet_label_query_12" .}}
cmd/osquery-perf/ubuntu_18.04.tmpl
-20
View File
@@ -94,23 +94,3 @@
{{- end }}
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu1804 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/ubuntu_20.04.tmpl
-35
View File
@@ -94,38 +94,3 @@
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu2004 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/ubuntu_21.04.tmpl
-35
View File
@@ -93,38 +93,3 @@
]
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu2104 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/ubuntu_21.10.tmpl
-35
View File
@@ -93,38 +93,3 @@
]
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu2110 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/ubuntu_22.04.tmpl
-35
View File
@@ -94,38 +94,3 @@
]
{{- end }}
{{ define "fleet_detail_query_users" -}}
[
{{ range $index, $item := .HostUsersMacOS }}
{{if $index}},{{end}}
{
"uid": "{{ .Uid }}",
"username": "{{ .Username }}",
"type": "{{ .Type }}",
"groupname": "{{ .GroupName }}",
"shell": "{{ .Shell }}"
}
{{- end }}
]
{{- end }}
{{ define "fleet_detail_query_software_linux" -}}
[
{{ range $index, $item := .SoftwareUbuntu2204 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Application (macOS)",
"bundle_identifier": "{{ .BundleIdentifier }}",
"source": "apps",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
cmd/osquery-perf/windows_11.tmpl
+1 -21
View File
@@ -346,26 +346,6 @@
[]
{{- end }}
{{ define "fleet_detail_query_software_macos" -}}
[
{{ range $index, $item := .SoftwareWindows11 }}
{{if $index}},{{end}}
{
"name": "{{ .Name }}",
"version": "{{ .Version }}",
"type": "Program (Windows)",
"source": "programs",
{{/* Note that in Go < 1.18, `{{ or (and .LastOpendedAt .LastOpenedAt.Unix) "" }}` won't work as expected because "and" and "or" don't short circuit. This was changed in Go 1.18 */}}
{{if .LastOpenedAt}}
"last_opened_at": "{{ .LastOpenedAt.Unix }}"
{{else}}
"last_opened_at": "-1"
{{end}}
}
{{- end }}
]
{{- end }}
{{ define "fleet_detail_query_windows_update_history" -}}
[
{
@@ -1055,4 +1035,4 @@
"update_revision": "200"
}
]
{{- end }}
{{- end }}