Skip to content

Commit

Permalink
Some more platform fixups
Browse files Browse the repository at this point in the history
  • Loading branch information
RebeccaMahany committed Nov 9, 2023
1 parent 9241dbf commit c866ddc
Show file tree
Hide file tree
Showing 17 changed files with 192 additions and 125 deletions.
2 changes: 1 addition & 1 deletion pkg/allowedpaths/cmd_windows.go
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,5 @@ func Taskkill(ctx context.Context, arg ...string) (*exec.Cmd, error) {

func Zerotiercli(ctx context.Context, arg ...string) (*exec.Cmd, error) {
// For windows, "-q" should be prepended before all other args
return validatedCommand(ctx, path.Join(os.Getenv("SYSTEMROOT"), "ProgramData", "ZeroTier", "One", "zerotier-one_x64.exe"), []string{"-q"}, arg...)
return validatedCommand(ctx, path.Join(os.Getenv("SYSTEMROOT"), "ProgramData", "ZeroTier", "One", "zerotier-one_x64.exe"), append([]string{"-q"}, arg...))

Check failure on line 57 in pkg/allowedpaths/cmd_windows.go

View workflow job for this annotation

GitHub Actions / launcher (windows-latest)

cannot use append([]string{…}, arg...) (value of type []string) as string value in argument to validatedCommand
}
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build darwin
// +build darwin

package checkups

import (
Expand All @@ -8,7 +11,6 @@ import (
"io"
"os"
"path/filepath"
"runtime"
"strings"

"github.com/kolide/launcher/pkg/allowedpaths"
Expand All @@ -25,10 +27,6 @@ type launchdCheckup struct {
}

func (c *launchdCheckup) Name() string {
if runtime.GOOS != "darwin" {
return ""
}

return "Launchd"
}

Expand Down
36 changes: 36 additions & 0 deletions pkg/debug/checkups/launchd_other.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
//go:build !darwin
// +build !darwin

package checkups

import (
"context"
"io"
)

type launchdCheckup struct {
}

func (c *launchdCheckup) Name() string {
return ""
}

func (c *launchdCheckup) Run(_ context.Context, _ io.Writer) error {
return nil
}

func (c *launchdCheckup) ExtraFileName() string {
return ""
}

func (c *launchdCheckup) Status() Status {
return Informational
}

func (c *launchdCheckup) Summary() string {
return ""
}

func (c *launchdCheckup) Data() any {
return nil
}
110 changes: 0 additions & 110 deletions pkg/log/log.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,14 @@ package log

import (
"bytes"
"context"
"fmt"
"os"
"path/filepath"
"regexp"
"runtime"
"strconv"
"strings"
"time"

kitlog "github.com/go-kit/kit/log"
"github.com/go-kit/kit/log/level"
"github.com/kolide/launcher/pkg/allowedpaths"
"github.com/shirou/gopsutil/v3/host"
"github.com/shirou/gopsutil/v3/process"
)
Expand Down Expand Up @@ -160,111 +155,6 @@ func (l *OsqueryLogAdapter) logInfoAboutUnrecognizedProcessLockingPidfile(p []by
level.Debug(l.logger).Log(append(processInfo, "msg", "detected non-osqueryd process using pidfile")...)
}

// runAndLogPs runs ps filtering on the given PID, and logs the output.
func (l *OsqueryLogAdapter) runAndLogPs(pidStr string) {
if runtime.GOOS == "windows" {
return
}

ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Ps(ctx, "-p", pidStr, "-o", "user,pid,ppid,pgid,stat,time,command")
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run ps on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running ps on non-osqueryd process using pidfile",
"pid", pidStr,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran ps on non-osqueryd process using pidfile",
"pid", pidStr,
"output", string(out),
)
}

// runAndLogLsofByPID runs lsof filtering on the given PID, and logs the output.
func (l *OsqueryLogAdapter) runAndLogLsofByPID(pidStr string) {
if runtime.GOOS == "windows" {
return
}

ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", "-p", pidStr)
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run lsof on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running lsof on non-osqueryd process using pidfile",
"pid", pidStr,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran lsof on non-osqueryd process using pidfile",
"pid", pidStr,
"output", string(out),
)
}

// runAndLogLsofOnPidfile runs lsof filtering by the osquery pidfile, and logs
// the output.
func (l *OsqueryLogAdapter) runAndLogLsofOnPidfile() {
if runtime.GOOS == "windows" {
return
}

fullPidfile := filepath.Join(l.rootDirectory, "osquery.pid")

ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", fullPidfile)
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run lsof on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running lsof on osqueryd pidfile",
"pidfile", fullPidfile,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran lsof on osqueryd pidfile",
"pidfile", fullPidfile,
"output", string(out),
)
}

// getStringStat is a small wrapper around gopsutil/process functions
// to return the stat if available, or an error message if not, so
// that either way the info will be captured in the log.
Expand Down
106 changes: 106 additions & 0 deletions pkg/log/log_posix.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
//go:build !windows
// +build !windows

package log

import (
"context"
"path/filepath"
"time"

"github.com/go-kit/kit/log/level"
"github.com/kolide/launcher/pkg/allowedpaths"
)

// runAndLogPs runs ps filtering on the given PID, and logs the output.
func (l *OsqueryLogAdapter) runAndLogPs(pidStr string) {
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Ps(ctx, "-p", pidStr, "-o", "user,pid,ppid,pgid,stat,time,command")
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run ps on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running ps on non-osqueryd process using pidfile",
"pid", pidStr,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran ps on non-osqueryd process using pidfile",
"pid", pidStr,
"output", string(out),
)
}

// runAndLogLsofByPID runs lsof filtering on the given PID, and logs the output.
func (l *OsqueryLogAdapter) runAndLogLsofByPID(pidStr string) {
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", "-p", pidStr)
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run lsof on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running lsof on non-osqueryd process using pidfile",
"pid", pidStr,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran lsof on non-osqueryd process using pidfile",
"pid", pidStr,
"output", string(out),
)
}

// runAndLogLsofOnPidfile runs lsof filtering by the osquery pidfile, and logs
// the output.
func (l *OsqueryLogAdapter) runAndLogLsofOnPidfile() {
fullPidfile := filepath.Join(l.rootDirectory, "osquery.pid")

ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()

cmd, err := allowedpaths.Lsof(ctx, "-R", "-n", fullPidfile)
if err != nil {
level.Debug(l.logger).Log(
"msg", "error creating command to run lsof on osqueryd pidfile",
"err", err,
)
return
}
out, err := cmd.CombinedOutput()
if err != nil {
level.Debug(l.logger).Log(
"msg", "error running lsof on osqueryd pidfile",
"pidfile", fullPidfile,
"err", err,
)
return
}

level.Debug(l.logger).Log(
"msg", "ran lsof on osqueryd pidfile",
"pidfile", fullPidfile,
"output", string(out),
)
}
16 changes: 16 additions & 0 deletions pkg/log/log_windows.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
//go:build windows
// +build windows

package log

func (l *OsqueryLogAdapter) runAndLogPs(_ string) {
return
}

func (l *OsqueryLogAdapter) runAndLogLsofByPID(_ string) {
return
}

func (l *OsqueryLogAdapter) runAndLogLsofOnPidfile() {
return
}
3 changes: 3 additions & 0 deletions pkg/osquery/table/mdm.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build darwin
// +build darwin

package table

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/crowdstrike/falconctl/parser.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !windows
// +build !windows

package falconctl

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/crowdstrike/falconctl/parser_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !windows
// +build !windows

package falconctl

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/crowdstrike/falconctl/table.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !windows
// +build !windows

package falconctl

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/crowdstrike/falconctl/table_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !windows
// +build !windows

package falconctl

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/firmwarepasswd/firmwarepasswd.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build darwin
// +build darwin

// firmwarepasswd is a simple wrapper around the
// `/usr/sbin/firmwarepasswd` tool. This should be considered beta at
// best. It serves a bit as a pattern for future exec work.
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/firmwarepasswd/firmwarepasswd_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build darwin
// +build darwin

package firmwarepasswd

import (
Expand Down
3 changes: 3 additions & 0 deletions pkg/osquery/tables/firmwarepasswd/parser.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build darwin
// +build darwin

package firmwarepasswd

import (
Expand Down
6 changes: 2 additions & 4 deletions pkg/osquery/tables/mdmclient/mdmclient.go
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
//go:build !windows
// +build !windows

// (skip building windows, since the newline replacement doesn't work there)
//go:build darwin
// +build darwin

// Package mdmclient provides a table that parses the mdmclient
// output. Empirically, this seems to be an almost gnustep
Expand Down
Loading

0 comments on commit c866ddc

Please sign in to comment.