Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity
8,319 Commits 2 Branches 0 Tags
a001fbf3ec9ad4a330c2a2bfdd985aa97b6caec8
Commit Graph
294 Commits
Author SHA1 Message Date
Lucas Manuel Rodriguez 810eb58b95 macOS CIS: Use find command (exposed as fleetd table) instead of relying on the osquery core file table (#12560) 
#10292, #12554

When scanning tens of thousands of files for permissions, using the
`find` command exposed as a fleetd table is more performant than trying
to use the `file` table. This change caused the watchdog to *stop*
killing osquery because of exceeding memory or CPU limit.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
 2023-06-29 16:22:41 -03:00
Martin Angers 1db2f7646a Implement Windows MDM programmatic unenrollment (notification + orbit trigger) (#12505) 2023-06-28 09:13:37 -04:00
Kenny Botelho 31dfcc1e1a Add Puppet function for sending custom MDM commands (#12534) 2023-06-27 13:17:37 -03:00
Lucas Manuel Rodriguez feb4e65be6 Optimize macOS CIS query 5.1.5 (#12506) 
#10292

The query was processing *every* file under `/Applications/`, which
makes it super expensive both in CPU usage and Memory footprint. This
query was the main culprit of triggering worker process kills by the
watchdog.

On some runs it triggered CPU usage alerts:
```
7716:W0623 15:38:05.402959 221732864 watcher.cpp:415] osqueryd worker (72976) stopping:
Maximum sustainable CPU utilization limit 1200ms exceeded for 12 seconds
```
And on other runs it triggered memory usage alerts:
```
4431 W0626 07:28:50.868021 147312640 watcher.cpp:424] osqueryd worker (21453) stopping:
Memory limits exceeded: 214020096 bytes (limit is 200MB)
```

For the above logs I used a custom osqueryd branch to be able to print
more information: https://github.com/osquery/osquery/pull/8070

The metrics for the old query were CPU usage: ~4521 ms
```
435:level=warn ts=2023-06-26T09:58:29.665712Z query=fleet_policy_query_1233 queryTime=4521 memory=12226560 msg="distributed query performance is excessive" hostID=308 platform=darwin
```
With the new query, CPU usage: ~210 ms.
```
23893:level=debug ts=2023-06-26T18:06:08.242456Z query=fleet_policy_query_1233 queryTime=210 msg=stats memory=0 hostID=308 platform=darwin
```
Basically a ~20x improvement.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- ~[ ] Added/updated tests~
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
 2023-06-27 11:06:26 -03:00
Sharon Katz 519982990c Add disk_info table to chromeos (#12344) 2023-06-26 15:40:37 -04:00
RachelElysia 044935b02f ChromeOS support: ChromeOS tables (add chromeos to existing table: screenlock, new table: system_state) (#12358) 2023-06-26 11:18:12 -07:00
Jacob ShandlingandJacob Shandling 2855bc8f7f ChromeOS privacy_preferences table (#12441) 
## Addresses #11037 

### Implement the `privacy_preferences` table for the Fleetd Chrome
extension. Columns correspond to the available properties of
[`chrome.privacy`](https://developer.chrome.com/docs/extensions/reference/privacy/).

Chrome on mac:
<img width="816" alt="Screenshot 2023-06-23 at 11 55 21 AM"
src="https://github.com/fleetdm/fleet/assets/61553566/a4700749-6325-442e-acf2-c14b1c9adf8f">

Chromebook with enterprise access (actual use case):
![Image from
iOS](https://github.com/fleetdm/fleet/assets/61553566/93f2243d-357a-4d85-bd20-0aebd178388c)

* Chromebook w/o enterprise access: as you can see, sometimes certain
APIs are not available - this error occurs because the expected API
object that would have a `get` method is actually `undefined` TODO – How
to handle this case given that we want to let errors bubble up to the
level at which Fleet can catch them? Maybe it would be nice to catch
such errors and send them up to the Fleet layer, and still allow the
loop to continue to populate the columns whose APIs _are_ available.
_Decision: catch API errors here to preserve functionality of the
remaining columns_

![IMG_9407](https://github.com/fleetdm/fleet/assets/61553566/7fb26eb4-44e8-43f8-90c0-8b3d718c5ace)

- [x] Changes file
- [x] Manual QA

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
 2023-06-23 14:52:16 -07:00
dependabot[bot] bd5071058e Bump semver from 7.3.8 to 7.5.3 in /ee/tools/license (#12470) 
Bumps [semver](https://github.com/npm/node-semver) from 7.3.8 to 7.5.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>v7.5.3</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.2...v7.5.3">7.5.3</a>
(2023-06-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/abdd93d55496d22e3c15a454a5cf13f101e48bce"><code>abdd93d</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/571">#571</a>
set max lengths in regex for numeric and build identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/571">#571</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/bf53dd8da15a17eb6b8111115d0d8ef341fea5db"><code>bf53dd8</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/569">#569</a>
add example for <code>&gt;</code> comparator (<a
href="https://redirect.github.com/npm/node-semver/issues/569">#569</a>)
(<a href="https://github.com/mbtools"><code>@​mbtools</code></a>)</li>
</ul>
<h2>v7.5.2</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.1...v7.5.2">7.5.2</a>
(2023-06-15)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/58c791f40ba8cf4be35a5ca6644353ecd6249edc"><code>58c791f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/566">#566</a>
diff when detecting major change from prerelease (<a
href="https://redirect.github.com/npm/node-semver/issues/566">#566</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5c8efbcb3c6c125af10746d054faff13e8c33fbd"><code>5c8efbc</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/565">#565</a>
preserve build in raw after inc (<a
href="https://redirect.github.com/npm/node-semver/issues/565">#565</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441"><code>717534e</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/564">#564</a>
better handling of whitespace (<a
href="https://redirect.github.com/npm/node-semver/issues/564">#564</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
</ul>
<h2>v7.5.1</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.0...v7.5.1">7.5.1</a>
(2023-05-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/d30d25a5c1fb963c3cc9178cb1769fe45e4a3cab"><code>d30d25a</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/559">#559</a>
show type on invalid semver error (<a
href="https://redirect.github.com/npm/node-semver/issues/559">#559</a>)
(<a
href="https://github.com/tjenkinson"><code>@​tjenkinson</code></a>)</li>
</ul>
<h2>v7.5.0</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.4.0...v7.5.0">7.5.0</a>
(2023-04-17)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/503a4e52fe2b1c6ed1400d33149f7733c8361eed"><code>503a4e5</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/548">#548</a>
allow identifierBase to be false (<a
href="https://redirect.github.com/npm/node-semver/issues/548">#548</a>)
(<a href="https://github.com/lsvalina"><code>@​lsvalina</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/e219bb454036a0c23e34407591f921c8edb688e7"><code>e219bb4</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/552">#552</a>
throw on bad version with correct error message (<a
href="https://redirect.github.com/npm/node-semver/issues/552">#552</a>)
(<a
href="https://github.com/wraithgar"><code>@​wraithgar</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/fc2f3df0b5d25253b3580607e111a9a280d888ca"><code>fc2f3df</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/546">#546</a>
incorrect results from diff sometimes with prerelease versions (<a
href="https://redirect.github.com/npm/node-semver/issues/546">#546</a>)
(<a
href="https://github.com/tjenkinson"><code>@​tjenkinson</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/27817677794f592b592bf6181a80a4824ff762b2"><code>2781767</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/547">#547</a>
avoid re-instantiating SemVer during diff compare (<a
href="https://redirect.github.com/npm/node-semver/issues/547">#547</a>)
(<a href="https://github.com/macno"><code>@​macno</code></a>)</li>
</ul>
<h2>v7.4.0</h2>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.3.8...v7.4.0">7.4.0</a>
(2023-04-10)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/113f51312a1a6b6aa50d4f9486b4fde21782c1f5"><code>113f513</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/532">#532</a>
identifierBase parameter for .inc (<a
href="https://redirect.github.com/npm/node-semver/issues/532">#532</a>)
(<a href="https://github.com/wraithgar"><code>@​wraithgar</code></a>, <a
href="https://github.com/b-bly"><code>@​b-bly</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/48d8f8fa63bf6e35db70ff840b6da1a51596a5a8"><code>48d8f8f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/530">#530</a>
export new RELEASE_TYPES constant (<a
href="https://github.com/hcharley"><code>@​hcharley</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/npm/node-semver/blob/main/CHANGELOG.md">semver's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.2...v7.5.3">7.5.3</a>
(2023-06-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/abdd93d55496d22e3c15a454a5cf13f101e48bce"><code>abdd93d</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/571">#571</a>
set max lengths in regex for numeric and build identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/571">#571</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/bf53dd8da15a17eb6b8111115d0d8ef341fea5db"><code>bf53dd8</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/569">#569</a>
add example for <code>&gt;</code> comparator (<a
href="https://redirect.github.com/npm/node-semver/issues/569">#569</a>)
(<a href="https://github.com/mbtools"><code>@​mbtools</code></a>)</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.1...v7.5.2">7.5.2</a>
(2023-06-15)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/58c791f40ba8cf4be35a5ca6644353ecd6249edc"><code>58c791f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/566">#566</a>
diff when detecting major change from prerelease (<a
href="https://redirect.github.com/npm/node-semver/issues/566">#566</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5c8efbcb3c6c125af10746d054faff13e8c33fbd"><code>5c8efbc</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/565">#565</a>
preserve build in raw after inc (<a
href="https://redirect.github.com/npm/node-semver/issues/565">#565</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441"><code>717534e</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/564">#564</a>
better handling of whitespace (<a
href="https://redirect.github.com/npm/node-semver/issues/564">#564</a>)
(<a
href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>)</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.5.0...v7.5.1">7.5.1</a>
(2023-05-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/d30d25a5c1fb963c3cc9178cb1769fe45e4a3cab"><code>d30d25a</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/559">#559</a>
show type on invalid semver error (<a
href="https://redirect.github.com/npm/node-semver/issues/559">#559</a>)
(<a
href="https://github.com/tjenkinson"><code>@​tjenkinson</code></a>)</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.4.0...v7.5.0">7.5.0</a>
(2023-04-17)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/503a4e52fe2b1c6ed1400d33149f7733c8361eed"><code>503a4e5</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/548">#548</a>
allow identifierBase to be false (<a
href="https://redirect.github.com/npm/node-semver/issues/548">#548</a>)
(<a href="https://github.com/lsvalina"><code>@​lsvalina</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/e219bb454036a0c23e34407591f921c8edb688e7"><code>e219bb4</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/552">#552</a>
throw on bad version with correct error message (<a
href="https://redirect.github.com/npm/node-semver/issues/552">#552</a>)
(<a
href="https://github.com/wraithgar"><code>@​wraithgar</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/fc2f3df0b5d25253b3580607e111a9a280d888ca"><code>fc2f3df</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/546">#546</a>
incorrect results from diff sometimes with prerelease versions (<a
href="https://redirect.github.com/npm/node-semver/issues/546">#546</a>)
(<a
href="https://github.com/tjenkinson"><code>@​tjenkinson</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/27817677794f592b592bf6181a80a4824ff762b2"><code>2781767</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/547">#547</a>
avoid re-instantiating SemVer during diff compare (<a
href="https://redirect.github.com/npm/node-semver/issues/547">#547</a>)
(<a href="https://github.com/macno"><code>@​macno</code></a>)</li>
</ul>
<h2><a
href="https://github.com/npm/node-semver/compare/v7.3.8...v7.4.0">7.4.0</a>
(2023-04-10)</h2>
<h3>Features</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/113f51312a1a6b6aa50d4f9486b4fde21782c1f5"><code>113f513</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/532">#532</a>
identifierBase parameter for .inc (<a
href="https://redirect.github.com/npm/node-semver/issues/532">#532</a>)
(<a href="https://github.com/wraithgar"><code>@​wraithgar</code></a>, <a
href="https://github.com/b-bly"><code>@​b-bly</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/48d8f8fa63bf6e35db70ff840b6da1a51596a5a8"><code>48d8f8f</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/530">#530</a>
export new RELEASE_TYPES constant (<a
href="https://github.com/hcharley"><code>@​hcharley</code></a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/940723d22bca824993627c45ac30dd3d2854b8cd"><code>940723d</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/538">#538</a>
intersects with v0.0.0 and v0.0.0-0 (<a
href="https://redirect.github.com/npm/node-semver/issues/538">#538</a>)
(<a
href="https://github.com/wraithgar"><code>@​wraithgar</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/aa516b50b32f5a144017d8fc1b9efe0540963c91"><code>aa516b5</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/535">#535</a>
faster parse options (<a
href="https://redirect.github.com/npm/node-semver/issues/535">#535</a>)
(<a href="https://github.com/H4ad"><code>@​H4ad</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/61e6ea1e9b7af01baf19ab0c0a63c8e3ebfac97c"><code>61e6ea1</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/536">#536</a>
faster cache key factory for range (<a
href="https://redirect.github.com/npm/node-semver/issues/536">#536</a>)
(<a href="https://github.com/H4ad"><code>@​H4ad</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/f8b8b619e71746a47852a9d301f3087ab311444f"><code>f8b8b61</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/541">#541</a>
optimistic parse (<a
href="https://redirect.github.com/npm/node-semver/issues/541">#541</a>)
(<a href="https://github.com/H4ad"><code>@​H4ad</code></a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/796cbe29b06d102e1b16f3ed78eaba210ece951e"><code>796cbe2</code></a>
<a href="https://redirect.github.com/npm/node-semver/pull/533">#533</a>
semver.diff prerelease to release recognition (<a
href="https://redirect.github.com/npm/node-semver/issues/533">#533</a>)
(<a href="https://github.com/wraithgar"><code>@​wraithgar</code></a>, <a
href="https://github.com/dominique-blockchain"><code>@​dominique-blockchain</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/npm/node-semver/commit/7fdf1ef223826b428d7f8aaf906e9eeefa9469f9"><code>7fdf1ef</code></a>
chore: release 7.5.3</li>
<li><a
href="https://github.com/npm/node-semver/commit/bf53dd8da15a17eb6b8111115d0d8ef341fea5db"><code>bf53dd8</code></a>
docs: add example for <code>&gt;</code> comparator (<a
href="https://redirect.github.com/npm/node-semver/issues/569">#569</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/abdd93d55496d22e3c15a454a5cf13f101e48bce"><code>abdd93d</code></a>
fix: set max lengths in regex for numeric and build identifiers (<a
href="https://redirect.github.com/npm/node-semver/issues/571">#571</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/e7b78de06eb14a7fa2075cedf9f167040d8d31af"><code>e7b78de</code></a>
chore: release 7.5.2</li>
<li><a
href="https://github.com/npm/node-semver/commit/58c791f40ba8cf4be35a5ca6644353ecd6249edc"><code>58c791f</code></a>
fix: diff when detecting major change from prerelease (<a
href="https://redirect.github.com/npm/node-semver/issues/566">#566</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/5c8efbcb3c6c125af10746d054faff13e8c33fbd"><code>5c8efbc</code></a>
fix: preserve build in raw after inc (<a
href="https://redirect.github.com/npm/node-semver/issues/565">#565</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441"><code>717534e</code></a>
fix: better handling of whitespace (<a
href="https://redirect.github.com/npm/node-semver/issues/564">#564</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/2f738e9a70d9b9468b7b69e9ed3e12418725c650"><code>2f738e9</code></a>
chore: bump <code>@​npmcli/template-oss</code> from 4.14.1 to 4.15.1 (<a
href="https://redirect.github.com/npm/node-semver/issues/558">#558</a>)</li>
<li><a
href="https://github.com/npm/node-semver/commit/aa016a67162c195938f7873ea29a73dac47ff9ba"><code>aa016a6</code></a>
chore: release 7.5.1</li>
<li><a
href="https://github.com/npm/node-semver/commit/d30d25a5c1fb963c3cc9178cb1769fe45e4a3cab"><code>d30d25a</code></a>
fix: show type on invalid semver error (<a
href="https://redirect.github.com/npm/node-semver/issues/559">#559</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/npm/node-semver/compare/v7.3.8...v7.5.3">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~npm-cli-ops">npm-cli-ops</a>, a new
releaser for semver since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=semver&package-manager=npm_and_yarn&previous-version=7.3.8&new-version=7.5.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-06-23 12:27:36 -07:00
Sharon Katz b754cb096c Add "username=''" to managed_policies queries (#10710) 
https://github.com/fleetdm/fleet/issues/10602


@xpkoala this PR will require testing of all modified items.
Preferably, we should perform the tests before merging to master. Can we
use the dev branch for that? -- Items were tested locally.
 2023-06-21 13:00:25 -05:00
Roberto Dip 835491d029 update puppet metadata.json file for publishing (#12418) 2023-06-20 19:08:46 -03:00
Roberto Dip 32acf4230c improve matching resiliency of puppet endpoints (#12402) 
this PR modifies the `external_host_identifier` parameter that's used to
match hosts to Puppet runs to use an identifier that's *unique per run*
(instead of an identifier that's *unique per host*)

this has the adventage to:

1. allow for concurrent Puppet runs that don't interfere with each
other.
2. allow for failed/orphaned Puppet runs to not interfere with new runs
(the keys will eventually get expired)

all the existent behavior should be preserved.

> Note: I have verified that the value that the reporter gets is the one
  associated with the right puppet run, even if multiple runs happen
  simultaneously.
 2023-06-20 18:24:54 -03:00
Martin Angers 1c249b60da Add support to configure and enable Windows MDM, notify elegible hosts (#12340) 2023-06-20 14:06:45 -04:00
Martin Angers 96aec85a0a Add mechanism to force read from primary DB, use it for puppet matching (#12396) 2023-06-19 13:55:15 -04:00
Roberto Dip 6d789d6e19 improve logging and error reporting in the puppet module (#12369) 
For #12355
 2023-06-16 12:40:50 -03:00
Roberto Dip 5f30add863 remove puppet PoC (#12317) 
The puppet module lives in
https://github.com/fleetdm/fleet/tree/main/ee/tools/puppet/fleetdm, I'm
removing this PoC to avoid any confusion
 2023-06-15 10:28:35 -03:00
Lucas Manuel Rodriguez 23eed2c872 Add the extra step to install extension manually (#12299) 2023-06-14 09:36:18 -03:00
Roberto Dip 82be92add9 properly encode release device command (#12275) 
for #12272
 2023-06-09 18:17:49 -03:00
Mo Zhu 50746c6b48 Chrome docs (#11747) 2023-06-09 10:03:01 -07:00
Juan Fernandez 98d9f1b068 If user is a global/team observer/observer+, 'teams' endpoints should not include secrets (#12216) 
Fixed auth. issue with Obs/Obs+
 2023-06-08 17:30:34 -04:00
Roberto Dip 1ad80fa251 bugfixes + adjustments for the puppet module (#12221) 
A few minor things going on:

1. Adjusted the Puppet module to send the profiles base64 encoded
2. Enabled FileVault by default on teams created using the `/match`
endpoint.
3. Remove profiles when a team is removed. We can't do a foreign key
because the global team.id is NULL. I also included a migration to
cleanup orphaned profiles.
 2023-06-08 18:05:44 -03:00
Marcos Oviedo 05c24caa95 Addressing system test findings (#12210) 
This relates to #11245
 2023-06-08 10:47:04 -03:00
Marcos Oviedo ebac8705ac Addressing issues found during system test (#12205) 
This relates to #11312 

`18.9.17.6`: Fixing the issue with policy pointing to a different GPO
and Registry value
`18.9.47.4.2`: Adding COLLATE NOCASE to avoid case sensitive issue with
SpynetReporting value
 2023-06-08 10:45:43 -03:00
Lucas Manuel Rodriguez 2a532ede94 Do not return empty SSO and SMTP settings for non-global-admins (#12180) 
#11266

PS: I first attempted a serialization trick by introducing a new
`appConfigResponse` and implementing `json.Marshal` to exclude these
fields but it was too hacky and hard to maintain moving forward, so I'm
bitting the bullet now. Happy to hear other ideas.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
 2023-06-07 16:06:36 -03:00
Martin Angers 68ddaafac0 Fix bug preventing gitops role from fleetctl applying macos setup assistant (and bootstrap package) (#12193) 2023-06-07 13:29:36 -04:00
Martin Angers f27fcddd55 Prevent clearing macos updates settings when applying/modifying a team without those settings (#12160) 2023-06-06 14:31:33 -04:00
Sharon Katz dc46116d44 Address not installed issue (#12165) 2023-06-06 13:37:43 -04:00
Marcos Oviedo c6338af0a3 Adding cast to 18.9.108.4.2 (#12131) 
This relates to #11668 

This change fixes a CAST issue on 18.9.108.4.2. More details
[here](https://fleetdm.slack.com/archives/C019WG4GH0A/p1685565728281039).
 2023-06-06 10:37:21 -03:00
Martin Angers 9f064acd2e Match pre-assigned profiles to a team (or create one) and assign host to team (#12127) 2023-06-05 15:08:21 -04:00
Roberto DipandMartin Angers c7488663f2 add a puppet module to manage MDM features (#12032) 
Related to #11185 this adds a Puppet module that provides:

1. A custom type named `fleetdm::profile` that can be used to define
profiles to a device
2. A function named `fleetdm::release_device` that can be used to
release a device from await device configuration.

Instructions/usage can be found in the `README.md` file.

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
 2023-05-31 17:26:12 -03:00
Martin Angers 4322a28f5a Implement preassign endpoint as first step to match profiles and hosts to teams (#12046) 2023-05-31 09:24:22 -04:00
Juan Fernandez 43ab81ee11 Feature 11829: Tailor host table response to ChromeOS (#12002) 
Updated ingestion logic and fixed ChromeOS virtual tables to accommodate the requested UI changes.
 2023-05-30 22:13:42 -04:00
Lucas Manuel Rodriguez 33d61044b5 Change role of existing users only if SSO attributes are present in the SAMLResponse (#11966) 
#10784

The removal of the now deprecated `sso_settings.enable_jit_role_sync`
config will be tackled in: #10688.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
 2023-05-30 17:49:59 -03:00
Martin Angers 4a077793f5 Return 400 instead of 500 on Apple BM auth error (#11899) 2023-05-29 11:52:42 -04:00
Mo ZhuandZach Wasserman e1a0021e7a remove address column from network_interfaces chromeos table (#11787) 
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
 2023-05-26 16:47:19 -05:00
Juan Fernandez de7377e54f ChromeOS support for Fleet dashboard (#11953) 
- Added built-in label for ChromeOS
- Ingest os_version info from ChromeOS hosts.
 2023-05-26 14:32:01 -04:00
gillespi314 259d4fa1ac Track host DEP assignments in new table (#11875) 2023-05-23 13:01:04 -05:00
Roberto Dip dcc22f436b allow to set await_device_configured in DEP profile (#11789) 
#10744
 2023-05-19 07:08:35 -03:00
Roberto Dip 8829b84a63 add migration support to FD and orbit (#11741) 
https://github.com/fleetdm/fleet/issues/11534
 2023-05-18 14:21:54 -03:00
Roberto Dip 8e532a5e76 pre-populate username/fullname during account creation (#11557) 
Related to #10744, this pre-populates and disables the username/fullname
fields.

https://user-images.githubusercontent.com/4419992/236854781-ac67ee28-c19c-4130-a5e6-2872220501b5.mov


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
 2023-05-18 12:50:00 -03:00
Juan Fernandez 009a87d33e Feature 10196: Add filepath to end-points and third party integrations (#11285) 
Adds the software installed path property to the proper end-points and third party integrations (webhook, Zendesk and Jira).
 2023-05-17 16:53:15 -04:00
Martin Angers 3f9eccc7f8 Refetch host mdm enrollment status until unenrolled (#11740) 2023-05-17 15:52:45 -04:00
Lucas Manuel Rodriguez 47de991ea6 Use hostIDs in team deletion when setting status to pending (#11734) 
Found this while working on #11531.

Team deletion for an empty team is taking ~30 seconds with 2632 hosts
that belong to no team.
This change attempts to fix that issue.

- ~[ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.~
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [x] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - ~For Orbit and Fleet Desktop changes:~
- ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.~
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
 2023-05-17 16:49:02 -03:00
gillespi314 a7f02355fd Add device-authenticated endpoint to trigger MDM migration webhook request (#11724) 2023-05-17 09:16:26 -05:00
Martin Angers e3a4e5fa0c Add support for profile UUIDs per team/no-team for the default profile (#11717) 2023-05-17 09:06:14 -04:00
Roberto Dip 4dd127d577 base logic to show/hide the new Migrate to Fleet FD menu (#11679) 
Related to #11670
 2023-05-15 17:00:52 -03:00
Martin Angers 7b1b392627 Implement worker jobs that update/re-assign setup assistants on changes (#11630) 2023-05-15 14:06:09 -04:00
RachelElysia 9e8698c779 CIS - WIN10 - Fix 3 policies with false positive bugs (#11668) 2023-05-12 10:57:09 -04:00
Marcos Oviedo e46d748bd2 Adding CIS non completed items that requires cis_audit table (#11380) 
This relates to #11245
 2023-05-12 11:55:46 -03:00
Marcos Oviedo 424baf431b Pusing pending CIS items (#11511) 
This relates to #11312 

This completes the last 20 pending CIS policies [here
](https://docs.google.com/spreadsheets/d/1HZn7e4zpd5nfxY0MhSdX8MkGpdpxyLdSZjk0Auo1WaQ/edit#gid=1819959040)
 2023-05-12 11:38:17 -03:00
RachelElysia 2523ae39aa CIS - Windows - Fix CIS_bullet_18.9.85.1.1 (#11650) 2023-05-12 09:41:40 -04:00