Commit graph

2067 commits

Author SHA1 Message Date
Noah Talerman
50edcc07d0
Docs: Windows OS updates (#16270)
Docs for the "Windows OS updates" (#11951) user story

- Update "macOS updates" doc page to cross-platform "OS updates" page
- Update pricing page
- Update copy in the UI to clarify behavior of Windows updates

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
2024-02-16 14:30:00 -06:00
Jahziel Villasana-Espinoza
05cfc3a364
Revert "fix: add observer and observer plus to lock/unlock permissions (#16886)" (#16924)
This reverts commit bd66898d38.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2024-02-16 10:52:14 -05:00
Sarah Gillespie
96bd31dc1f
Add validation to reject requests to enqueue scripts for plain osquery hosts (#16893) 2024-02-15 14:34:16 -06:00
Gabriel Hernandez
119d1df76f
add permission check to software titles/versions endpoints (#16561)
relates to #16052

This adds a team permission check the `GET software/titles/:id`
endpoint. If the user should not be able to get the software title if it
is not on a host that is on the same team as the user (e.g. software
title 1 is on host 1, which is on team 1. A user who is only on team 2
should get a 403 response)

The UI is also updated to show the access denied error page when the we
receive a 403 response for the software title

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
Co-authored-by: Roberto Dip <me@roperzh.com>
2024-02-15 17:22:27 -03:00
Jahziel Villasana-Espinoza
bd66898d38
fix: add observer and observer plus to lock/unlock permissions (#16886)
> Related issue: #16878

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any permissions changes (docs/Using
Fleet/manage-access.md)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-15 14:40:36 -03:00
Martin Angers
e1e1139da7
Fix duplicate activities created when running lock/unlocking scripts on hosts with scripts disabled (#16861) 2024-02-15 11:05:13 -06:00
Victor Lyuboslavsky
98e9de6861
Adding new hosts sql tests. (#16826)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
2024-02-14 10:35:22 -06:00
Victor Lyuboslavsky
e1aac9c776
Adding tests for new live query endpoints. (#16823)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any permissions changes (docs/Using
Fleet/manage-access.md)
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-02-14 09:43:21 -06:00
Lucas Manuel Rodriguez
a5a7df4527
Return 405 when receiving POST request on the route path (#16750)
#16182

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
2024-02-14 12:40:43 -03:00
Victor Lyuboslavsky
967eddcb37
New live query API endpoint for custom query SQL. (#16810)
#16805 

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality

---------

Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2024-02-14 01:45:07 -03:00
Martin Angers
9082438580
Feature: Remote Lock for macOS, Windows and Linux (#16783)
Feature branch for the #9949  story.

---------

Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
Co-authored-by: Roberto Dip <me@roperzh.com>
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
Co-authored-by: Sarah Gillespie <sarah@fleetdm.com>
2024-02-13 13:03:53 -05:00
Victor Lyuboslavsky
ab508028f5
Improved error message when creating a new user (via API or fleetctl) with a team that does not exist. (#16760)
Improved error message when creating a new user (via API or fleetctl)
with a team that does not exist.
#16541 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2024-02-13 10:32:30 -06:00
Victor Lyuboslavsky
ed9d155249
fleetctl can now transfer hosts to No team (#16759)
#16466 
fleetctl can now transfer hosts to No team like: `fleetctl hosts
transfer --team '' --hosts yourHost`

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-13 10:17:59 -06:00
Victor Lyuboslavsky
78808e02c6
Add fleetctl gitops integration test. (#16740)
#13643 

New integration test for `fleetctl gitops` which loads the configs from
https://github.com/fleetdm/fleet-gitops
2024-02-12 17:27:48 -06:00
Victor Lyuboslavsky
95437f9044
gitops role authorization changes for fleetctl gitops (#16710)
To support `fleetctl gitops`, gitops role can now read policies/queries
and write scripts.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Documented any permissions changes (docs/Using
Fleet/manage-access.md)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-12 16:44:35 -06:00
Victor Lyuboslavsky
4cbafafc91
Updating wall_time from seconds to ms. (#16706)
#15703 
`wall_time_ms` (not `wall_time`) coming from osquery will now be put
into `wall_time` in our DB.
Hence, `wall_time` coming from Fleet API will now be in milliseconds and
not seconds

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Manual QA for all new/changed functionality
2024-02-12 07:58:40 -06:00
Victor Lyuboslavsky
e4d5e27dd9
fleetctl gitops (#16535)
Add `fleetctl gitops` command for #13643 

Code review video:
https://www.loom.com/share/7941c51c709b44ccafd618dd05837d99?sid=27b923d7-1393-4396-bac7-30616b2d6de9

fleet-gitops PR that also needs review:
https://github.com/fleetdm/fleet-gitops/pull/26

Working global/team gitops configs that can be used for testing:
https://github.com/fleetdm/fleet-gitops/tree/victor/fixing-configs

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-09 13:34:57 -06:00
Victor Lyuboslavsky
6aedcf97be
Obfuscate enroll secret in error (#16684)
When attempting to set an enroll secret which already exists in DB,
error message no longer contains the secret in cleartext.
#16621 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-09 13:31:34 -06:00
Roberto Dip
5629b271d0
fix profile verification for windows and macos (#16705)
for #16675
2024-02-09 15:06:36 -03:00
Sarah Gillespie
45d1f91b48
Expand saved scripts features for Linux hosts (#16639) 2024-02-07 15:32:51 -06:00
Roberto Dip
2d4c1b079a
improvements for troubleshooting workflow for MDM commands (#16654)
for #16416
2024-02-07 16:24:03 -03:00
Tim Lee
6d1eee6279
Add resolved_in_version for Windows OS Vulns (#16546) 2024-02-07 06:19:59 -07:00
Roberto Dip
a9e837afaf
bootstrap package and eula endpoints platform agnosic (#16631)
for #15082

- POST /mdm/apple/setup/eula was replaced by POST /mdm/setup/eula
- GET /mdm/apple/setup/eula/metadata was replaced by GET
/mdm/setup/eula/metadata
- DELETE /mdm/apple/setup/eula/:token was replaced by DELETE
/mdm/setup/eula/:token
- POST /mdm/apple/bootstrap was replaced by POST /mdm/bootstrap
- GET /mdm/apple/bootstrap/:team_id/metadata was replaced by GET
/mdm/bootstrap/:team_id/metadata
- DELETE /mdm/apple/bootstrap/:team_id was replaced by DELETE
/mdm/bootstrap/:team_id
- GET /mdm/apple/bootstrap/summary was replaced by GET
/mdm/bootstrap/summary
2024-02-07 09:24:24 -03:00
Sarah Gillespie
78aa1b0080
Update backend MDM migration flow and add logging to aid in debugging migration errors (#16627) 2024-02-06 16:53:43 -06:00
Sarah Gillespie
424ffef185
Add count to host upcoming activities API response (#16511) 2024-02-06 10:02:38 -06:00
Jahziel Villasana-Espinoza
cf9f83604f
fix: return a better message when checking status of async script (#16611)
> Related issue: #16431

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-06 10:37:53 -05:00
Jahziel Villasana-Espinoza
feaf6f5a71
feat: add db table for host lock and wipe (#16580)
> Related issue: #16386 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Manual QA for all new/changed functionality
2024-02-05 13:45:27 -05:00
Martin Angers
792d76e2cd
Fix stack trace, duplicates and better coverage of captured errors in APM (#16516) 2024-02-05 11:53:39 -05:00
Martin Angers
9c37db2a05
Remove unnecessary nested transactions in batch-set of MDM profiles (#16449) 2024-02-05 10:51:32 -05:00
Martin Angers
9abb572194
Rename mdm profiles updated_at to uploaded_at and remove automatic setting (#16425) 2024-02-05 10:01:38 -05:00
Jahziel Villasana-Espinoza
fa46cfba20
fix: filter out software from parallels vm (#16520)
> Related issue: #15855

I followed a similar pattern to `sanitizeSoftware`, a function that
modifies the `Software`. I was originally going to update
`sanitizeSoftware` itself, but decided against it
1. to avoid making lots of changes to the function signature and
internals
2. because the logic this issue requires is pretty different from what
`sanitizeSoftware` is trying to do, so seemed to warrant its own
function.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Roberto Dip <me@roperzh.com>
2024-02-05 10:00:08 -05:00
Noah Talerman
9069850585
Docs and articles: Remove Windows MDM feature flag (#16399)
- Remove feature flag from the docs and articles (it no longer exists)
- Remove mention of Windows MDM not being ready for production
2024-02-05 09:11:45 -05:00
Roberto Dip
d4ef9be990
fix query generation for docs + update them (#16537)
this fixes the `go:generate` directive + adds the changes for the files
generated automatically after running `make generate-doc`
2024-02-05 09:50:05 -03:00
Roberto Dip
e35d1dacbd
improve validation of windows profiles (#16563)
for #16316, this improves the XML validation of Windows profiles and
ensures we support two ways of embedding XML:

- Escape the XML
- Use a wrapping `<![CDATA[ ... ]]>` element
2024-02-05 09:49:55 -03:00
Lucas Manuel Rodriguez
5360029d67
Allow custom osquery database on fleetd (#16554)
#16014

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
- [x] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [x] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-02-05 09:41:06 -03:00
Roberto Dip
db58539c9d
set exit_code = -1 for scripts that are pending before upgrade to 4.44.0 (#16581)
for https://github.com/fleetdm/fleet/issues/16547

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-02-02 21:20:56 -03:00
Victor Lyuboslavsky
dbf53cae6a
Policies are now unique for (team_id, name). (#16501)
#13643 

Updating the `policies` table to use a checksum column for uniqueness.
The checksum is computed with team_id (which may be null) and name. This
change is modeled on the checksum in the software table.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Manual QA for all new/changed functionality
2024-02-02 17:41:32 -06:00
Roberto Dip
7ddf275a64
fix treatment of sync scripts + prevent running expired scripts on fleet upgrade (#16567)
for #16547

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Manual QA for all new/changed functionality
2024-02-02 17:57:46 -03:00
Rachael Shaw
6c6364b5af
Update error message when scripts are disabled for a host (#16301)
In newer designs, we are moving toward always using the phrase "the
fleetd agent" in place of "a Fleet installer", so updating this existing
error message to reflect that.
2024-01-31 16:39:18 -06:00
Tim Lee
6e79ed6a83
Implement OS Version ID (#16463) 2024-01-31 10:14:24 -07:00
Victor Lyuboslavsky
66ec651ec4
Switching from FixedBuild to FixedBuilds (part 2). (#16465)
Switching from FixedBuild to FixedBuilds (part 2).
#16412
2024-01-30 14:24:41 -06:00
Jahziel Villasana-Espinoza
8b2e94ed95
fix: add "w" prefix to Windows OS update profile UUIDs (#16437)
> Related issue: #16411

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Manual QA for all new/changed functionality
2024-01-30 12:05:43 -05:00
Victor Lyuboslavsky
72705ef93a
Switching from FixedBuild to FixedBuilds (part 1). (#16454)
Switching from FixedBuild to FixedBuilds (part 1).
#16412 

Converting msrc files from using FixedBuild to FixedBuilds. In part 2,
FixedBuild will be completely removed.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
2024-01-30 10:43:28 -06:00
Victor Lyuboslavsky
f3df2394e6
When writing to logging destination fails, fleet server now issues a 4xx error instead of 500. (#16420) 2024-01-29 18:38:10 -06:00
Roberto Dip
384d0a6af0
timeout is valid only if script is sync (#16428)
this prevents us from sending `host_timeout: true` for async scripts, as
those can be queued for long periods of time.
2024-01-29 19:07:17 -03:00
Tim Lee
ae87519938
16356 Unreleased bugfix for osversions filter (#16391) 2024-01-29 13:04:26 -07:00
Martin Angers
ca435eb244
Queued scripts feature (#16300)
This is the feature branch for the [queued
scripts](https://github.com/fleetdm/fleet/issues/15529) story.

---------

Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
2024-01-29 11:37:54 -03:00
Jahziel Villasana-Espinoza
0ef59081ba
feat: add manual enrollment profile endpoint (#16357)
> Related issue: #16252

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-01-26 19:57:19 -05:00
Roberto Dip
7d00d5a41e
feature: target profiles by labels (#16202)
for #14715

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Jahziel Villasana-Espinoza <jahziel@fleetdm.com>
2024-01-26 11:00:58 -05:00
Roberto Dip
b9be12b604
fix query to get windows MDM enrollment (#16348)
for #16332, this updates the windows mdm query to always return at least
one row, so we can detect windows unenrollments
2024-01-25 15:37:36 -05:00