Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 08:58:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 111

modify query for when encryption key has newlines (#10094)

Browse source
This commit is contained in:
Roberto Dip 2023-02-28 15:54:24 -03:00 committed by GitHub
parent af6d4059b9
commit 69bb2abc18
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 36 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
server/service/osquery_utils/queries.go
View file

@ -570,7 +570,7 @@ var mdmQueries = map[string]DetailQuery{
// > location at any time.
//
// [1]: https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow
Query: `SELECT to_base64(group_concat(line)) as filevault_key FROM file_lines WHERE path='/var/db/FileVaultPRK.dat'`,
Query: `SELECT to_base64(group_concat(line, x'0a')) as filevault_key FROM file_lines WHERE path='/var/db/FileVaultPRK.dat'`,
Platforms: []string{"darwin"},
DirectIngestFunc: directIngestDiskEncryptionKeyDarwin,
Discovery: discoveryTable("file_lines"),
@ -1292,6 +1292,16 @@ func directIngestDiskEncryptionKeyDarwin(
)
}
if strings.TrimSpace(rows[0]["filevault_key"]) == "" {
level.Debug(logger).Log(
"component", "service",
"method", "directIngestDiskEncryptionKeyDarwin",
"msg", "host reported empty /var/db/FileVaultPRK.dat contents",
"host", host.Hostname,
)
return nil
}
return ds.SetOrUpdateHostDiskEncryptionKey(ctx, host.ID, rows[0]["filevault_key"])
}

25
server/service/osquery_utils/queries_test.go
View file

@ -868,3 +868,28 @@ func TestDirectIngestDiskEncryptionLinux(t *testing.T) {
require.NoError(t, err)
require.True(t, ds.SetOrUpdateHostDisksEncryptionFuncInvoked)
}
func TestDirectIngestDiskEncryptionKeyDarwin(t *testing.T) {
ds := new(mock.Store)
ctx := context.Background()
logger := log.NewNopLogger()
wantKey := "OTM5ODRDQTYtOUY1Mi00NERELTkxOUEtMDlBN0ZBOUUzNUY5Cg=="
host := &fleet.Host{ID: 1}
ds.SetOrUpdateHostDiskEncryptionKeyFunc = func(ctx context.Context, hostID uint, encryptedBase64Key string) error {
require.Equal(t, wantKey, encryptedBase64Key)
require.Equal(t, host.ID, hostID)
return nil
}
err := directIngestDiskEncryptionKeyDarwin(ctx, logger, host, ds, []map[string]string{})
require.NoError(t, err)
require.False(t, ds.SetOrUpdateHostDiskEncryptionKeyFuncInvoked)
err = directIngestDiskEncryptionKeyDarwin(ctx, logger, host, ds, []map[string]string{{"filevault_key": ""}})
require.NoError(t, err)
require.False(t, ds.SetOrUpdateHostDiskEncryptionKeyFuncInvoked)
err = directIngestDiskEncryptionKeyDarwin(ctx, logger, host, ds, []map[string]string{{"filevault_key": wantKey}})
require.NoError(t, err)
require.True(t, ds.SetOrUpdateHostDiskEncryptionKeyFuncInvoked)
}