-
Notifications
You must be signed in to change notification settings - Fork 103
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
9241dbf
commit c866ddc
Showing
17 changed files
with
192 additions
and
125 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
//go:build !darwin | ||
// +build !darwin | ||
|
||
package checkups | ||
|
||
import ( | ||
"context" | ||
"io" | ||
) | ||
|
||
type launchdCheckup struct { | ||
} | ||
|
||
func (c *launchdCheckup) Name() string { | ||
return "" | ||
} | ||
|
||
func (c *launchdCheckup) Run(_ context.Context, _ io.Writer) error { | ||
return nil | ||
} | ||
|
||
func (c *launchdCheckup) ExtraFileName() string { | ||
return "" | ||
} | ||
|
||
func (c *launchdCheckup) Status() Status { | ||
return Informational | ||
} | ||
|
||
func (c *launchdCheckup) Summary() string { | ||
return "" | ||
} | ||
|
||
func (c *launchdCheckup) Data() any { | ||
return nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,106 @@ | ||
//go:build !windows | ||
// +build !windows | ||
|
||
package log | ||
|
||
import ( | ||
"context" | ||
"path/filepath" | ||
"time" | ||
|
||
"github.com/go-kit/kit/log/level" | ||
"github.com/kolide/launcher/pkg/allowedpaths" | ||
) | ||
|
||
// runAndLogPs runs ps filtering on the given PID, and logs the output. | ||
func (l *OsqueryLogAdapter) runAndLogPs(pidStr string) { | ||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
defer cancel() | ||
|
||
cmd, err := allowedpaths.Ps(ctx, "-p", pidStr, "-o", "user,pid,ppid,pgid,stat,time,command") | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error creating command to run ps on osqueryd pidfile", | ||
"err", err, | ||
) | ||
return | ||
} | ||
out, err := cmd.CombinedOutput() | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error running ps on non-osqueryd process using pidfile", | ||
"pid", pidStr, | ||
"err", err, | ||
) | ||
return | ||
} | ||
|
||
level.Debug(l.logger).Log( | ||
"msg", "ran ps on non-osqueryd process using pidfile", | ||
"pid", pidStr, | ||
"output", string(out), | ||
) | ||
} | ||
|
||
// runAndLogLsofByPID runs lsof filtering on the given PID, and logs the output. | ||
func (l *OsqueryLogAdapter) runAndLogLsofByPID(pidStr string) { | ||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
defer cancel() | ||
|
||
cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", "-p", pidStr) | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error creating command to run lsof on osqueryd pidfile", | ||
"err", err, | ||
) | ||
return | ||
} | ||
out, err := cmd.CombinedOutput() | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error running lsof on non-osqueryd process using pidfile", | ||
"pid", pidStr, | ||
"err", err, | ||
) | ||
return | ||
} | ||
|
||
level.Debug(l.logger).Log( | ||
"msg", "ran lsof on non-osqueryd process using pidfile", | ||
"pid", pidStr, | ||
"output", string(out), | ||
) | ||
} | ||
|
||
// runAndLogLsofOnPidfile runs lsof filtering by the osquery pidfile, and logs | ||
// the output. | ||
func (l *OsqueryLogAdapter) runAndLogLsofOnPidfile() { | ||
fullPidfile := filepath.Join(l.rootDirectory, "osquery.pid") | ||
|
||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) | ||
defer cancel() | ||
|
||
cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", fullPidfile) | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error creating command to run lsof on osqueryd pidfile", | ||
"err", err, | ||
) | ||
return | ||
} | ||
out, err := cmd.CombinedOutput() | ||
if err != nil { | ||
level.Debug(l.logger).Log( | ||
"msg", "error running lsof on osqueryd pidfile", | ||
"pidfile", fullPidfile, | ||
"err", err, | ||
) | ||
return | ||
} | ||
|
||
level.Debug(l.logger).Log( | ||
"msg", "ran lsof on osqueryd pidfile", | ||
"pidfile", fullPidfile, | ||
"output", string(out), | ||
) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
//go:build windows | ||
// +build windows | ||
|
||
package log | ||
|
||
func (l *OsqueryLogAdapter) runAndLogPs(_ string) { | ||
return | ||
} | ||
|
||
func (l *OsqueryLogAdapter) runAndLogLsofByPID(_ string) { | ||
return | ||
} | ||
|
||
func (l *OsqueryLogAdapter) runAndLogLsofOnPidfile() { | ||
return | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build darwin | ||
// +build darwin | ||
|
||
package table | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build !windows | ||
// +build !windows | ||
|
||
package falconctl | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build !windows | ||
// +build !windows | ||
|
||
package falconctl | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build !windows | ||
// +build !windows | ||
|
||
package falconctl | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build !windows | ||
// +build !windows | ||
|
||
package falconctl | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build darwin | ||
// +build darwin | ||
|
||
package firmwarepasswd | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,6 @@ | ||
//go:build darwin | ||
// +build darwin | ||
|
||
package firmwarepasswd | ||
|
||
import ( | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.