Skip to content

Commit b732d7c

Browse files
grahamgilbertgrahamgilbert
authored
Merge pull request #58 from korylprince/alt_system_info
Add alt_system_info table
2 parents 732090b + 0f4bfbf commit b732d7c

19 files changed

+696
-45
lines changed

‎BUILD.bazel

+1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ go_library(
3737
importpath = "github.com/macadmins/osquery-extension",
3838
visibility = ["//visibility:private"],
3939
deps = [
40+
"//tables/alt_system_info",
4041
"//tables/authdb",
4142
"//tables/chromeuserprofiles",
4243
"//tables/fileline",

‎MODULE.bazel.lock

+4-4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ For production deployment, you should refer to the [osquery documentation](https
1616

1717
| Table | Description | Platforms | Notes |
1818
| ------------------------ | --------------------------------------------------------------------------------------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
19+
| `alt_system_info` | Alternative system_info table | macOS | This table is an alternative to the built-in system_info table in osquery, which triggers an `Allow "osquery" to find devices on local networks?` prompt on macOS 15.0. On versions other than 15.0, this table falls back to the built-in system_info table. Note: this table returns an empty `cpu_subtype` field. See [#58](https://github.com/macadmins/osquery-extension/pull/58) for more details. |
1920
| `authdb` | macOS Authorization database | macOS | Use the constraint `name` to specify a right name to query, otherwise all rights will be returned. |
2021
| `file_lines` | Read an arbitrary file | Linux / macOS / Windows | Use the constraint `path` and `last` to specify the file to read lines from |
2122
| `filevault_users` | Information on the users able to unlock the current boot volume when encrypted with Filevault | macOS | |

‎go.mod

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ require (
88
github.com/osquery/osquery-go v0.0.0-20231130195733-61ac79279aaa
99
github.com/pkg/errors v0.9.1
1010
github.com/stretchr/testify v1.9.0
11+
golang.org/x/sync v0.8.0
1112
gopkg.in/yaml.v3 v3.0.1
1213
)
1314

‎go.sum

+2
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26
4040
go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
4141
go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
4242
go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
43+
golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
44+
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
4345
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
4446
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
4547
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

‎main.go

+6
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"runtime"
88
"time"
99

10+
"github.com/macadmins/osquery-extension/tables/alt_system_info"
1011
"github.com/macadmins/osquery-extension/tables/chromeuserprofiles"
1112
"github.com/macadmins/osquery-extension/tables/fileline"
1213
"github.com/macadmins/osquery-extension/tables/filevaultusers"
@@ -100,6 +101,11 @@ func main() {
100101
return wifi_network.WifiNetworkGenerate(ctx, queryContext, *flSocketPath)
101102
},
102103
),
104+
table.NewPlugin("alt_system_info", alt_system_info.AltSystemInfoColumns(),
105+
func(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
106+
return alt_system_info.AltSystemInfoGenerate(ctx, queryContext, *flSocketPath)
107+
},
108+
),
103109
}
104110
plugins = append(plugins, darwinPlugins...)
105111
}

‎pkg/utils/BUILD.bazel

+7-1
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,24 @@ go_library(
55
srcs = [
66
"exec.go",
77
"exec_mocks.go",
8+
"osquery.go",
89
"utils.go",
910
],
1011
importpath = "github.com/macadmins/osquery-extension/pkg/utils",
1112
visibility = ["//visibility:public"],
13+
deps = ["@com_github_osquery_osquery_go//:osquery-go"],
1214
)
1315

1416
go_test(
1517
name = "utils_test",
1618
srcs = [
1719
"exec_test.go",
20+
"osquery_test.go",
1821
"utils_test.go",
1922
],
2023
embed = [":utils"],
21-
deps = ["@com_github_stretchr_testify//assert"],
24+
deps = [
25+
"@com_github_stretchr_testify//assert",
26+
"@com_github_stretchr_testify//require",
27+
],
2228
)

‎pkg/utils/exec_mocks.go

+16
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package utils
22

3+
import "strings"
4+
35
type MockCmdRunner struct {
46
Output string
57
Err error
@@ -12,3 +14,17 @@ func (m MockCmdRunner) RunCmd(name string, arg ...string) ([]byte, error) {
1214
func (m MockCmdRunner) RunCmdWithStdin(name string, stdin string, arg ...string) ([]byte, error) {
1315
return []byte(m.Output), m.Err
1416
}
17+
18+
type MultiMockCmdRunner struct {
19+
Commands map[string]MockCmdRunner
20+
}
21+
22+
func (m MultiMockCmdRunner) RunCmd(name string, arg ...string) ([]byte, error) {
23+
key := append([]string{name}, arg...)
24+
return m.Commands[strings.Join(key, " ")].RunCmd(name, arg...)
25+
}
26+
27+
func (m MultiMockCmdRunner) RunCmdWithStdin(name string, stdin string, arg ...string) ([]byte, error) {
28+
key := append([]string{name}, arg...)
29+
return m.Commands[strings.Join(key, " ")].RunCmdWithStdin(name, stdin, arg...)
30+
}

‎pkg/utils/exec_test.go

+18-10
Original file line numberDiff line numberDiff line change
@@ -5,33 +5,41 @@ import (
55
)
66

77
func TestRunCmd(t *testing.T) {
8-
runner := MockCmdRunner{
9-
Output: "test output",
10-
Err: nil,
8+
runner := MultiMockCmdRunner{
9+
Commands: map[string]MockCmdRunner{
10+
"echo test": {
11+
Output: "test output",
12+
Err: nil,
13+
},
14+
},
1115
}
1216
output, err := runner.RunCmd("echo", "test")
1317
if err != nil {
1418
t.Fatalf("RunCmd() error = %v, wantErr nil", err)
1519
return
1620
}
1721
got := string(output)
18-
if got != runner.Output {
19-
t.Errorf("RunCmd() = %q, want %q", got, runner.Output)
22+
if got != runner.Commands["echo test"].Output {
23+
t.Errorf("RunCmd() = %q, want %q", got, runner.Commands["echo test"].Output)
2024
}
2125
}
2226

2327
func TestRunCmdWithStdin(t *testing.T) {
24-
runner := MockCmdRunner{
25-
Output: "test output",
26-
Err: nil,
28+
runner := MultiMockCmdRunner{
29+
Commands: map[string]MockCmdRunner{
30+
"echo": {
31+
Output: "test output",
32+
Err: nil,
33+
},
34+
},
2735
}
2836
output, err := runner.RunCmdWithStdin("echo", "test")
2937
if err != nil {
3038
t.Fatalf("RunCmdWithStdin() error = %v, wantErr nil", err)
3139
return
3240
}
3341
got := string(output)
34-
if got != runner.Output {
35-
t.Errorf("RunCmdWithStdin() = %q, want %q", got, runner.Output)
42+
if got != runner.Commands["echo"].Output {
43+
t.Errorf("RunCmdWithStdin() = %q, want %q", got, runner.Commands["echo"].Output)
3644
}
3745
}

‎pkg/utils/osquery.go

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package utils
2+
3+
import (
4+
"fmt"
5+
"time"
6+
7+
"github.com/osquery/osquery-go"
8+
)
9+
10+
type OsqueryClienter interface {
11+
NewOsqueryClient() (OsqueryClient, error)
12+
}
13+
14+
type OsqueryClient interface {
15+
QueryRows(query string) ([]map[string]string, error)
16+
QueryRow(query string) (map[string]string, error)
17+
Close()
18+
}
19+
20+
type SocketOsqueryClienter struct {
21+
SocketPath string
22+
Timeout time.Duration
23+
}
24+
25+
func (s *SocketOsqueryClienter) NewOsqueryClient() (OsqueryClient, error) {
26+
osqueryClient, err := osquery.NewClient(s.SocketPath, s.Timeout)
27+
if err != nil {
28+
return nil, fmt.Errorf("could not create osquery client: %w", err)
29+
}
30+
return osqueryClient, nil
31+
}
32+
33+
type MockOsqueryClienter struct {
34+
Data map[string][]map[string]string
35+
}
36+
37+
func (m *MockOsqueryClienter) NewOsqueryClient() (OsqueryClient, error) {
38+
return &MockOsqueryClient{Data: m.Data}, nil
39+
}
40+
41+
type MockOsqueryClient struct {
42+
Data map[string][]map[string]string
43+
}
44+
45+
func (m *MockOsqueryClient) QueryRows(query string) ([]map[string]string, error) {
46+
return m.Data[query], nil
47+
}
48+
49+
func (m *MockOsqueryClient) QueryRow(query string) (map[string]string, error) {
50+
return m.Data[query][0], nil
51+
}
52+
53+
func (m *MockOsqueryClient) Close() {}

‎pkg/utils/osquery_test.go

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package utils
2+
3+
import (
4+
"testing"
5+
6+
"github.com/stretchr/testify/assert"
7+
"github.com/stretchr/testify/require"
8+
)
9+
10+
func TestQueryRows(t *testing.T) {
11+
query := "SELECT * FROM table"
12+
clienter := &MockOsqueryClienter{
13+
Data: map[string][]map[string]string{
14+
query: {{"column1": "value1", "column2": "value2"}},
15+
},
16+
}
17+
18+
mock, err := clienter.NewOsqueryClient()
19+
require.NoError(t, err)
20+
21+
data, err := mock.QueryRows(query)
22+
require.NoError(t, err)
23+
assert.Equal(t, clienter.Data[query], data)
24+
}
25+
26+
func TestQueryRow(t *testing.T) {
27+
query := "SELECT * FROM table"
28+
clienter := &MockOsqueryClienter{
29+
Data: map[string][]map[string]string{
30+
query: {{"column1": "value1", "column2": "value2"}},
31+
},
32+
}
33+
34+
mock, err := clienter.NewOsqueryClient()
35+
require.NoError(t, err)
36+
37+
data, err := mock.QueryRow("SELECT * FROM table")
38+
require.NoError(t, err)
39+
assert.Equal(t, clienter.Data[query][0], data)
40+
}

‎tables/alt_system_info/BUILD.bazel

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
2+
3+
go_library(
4+
name = "alt_system_info",
5+
srcs = ["alt_system_info.go"],
6+
importpath = "github.com/macadmins/osquery-extension/tables/alt_system_info",
7+
visibility = ["//visibility:public"],
8+
deps = [
9+
"//pkg/utils",
10+
"@com_github_groob_plist//:plist",
11+
"@com_github_osquery_osquery_go//plugin/table",
12+
"@org_golang_x_sync//errgroup:go_default_library",
13+
],
14+
)
15+
16+
go_test(
17+
name = "alt_system_info_test",
18+
srcs = ["alt_system_info_test.go"],
19+
deps = [
20+
":alt_system_info",
21+
"//pkg/utils",
22+
"@com_github_stretchr_testify//assert",
23+
"@com_github_stretchr_testify//require",
24+
],
25+
)

0 commit comments

Comments
 (0)