mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 00:49:03 +00:00
810eb58b95
#10292, #12554 When scanning tens of thousands of files for permissions, using the `find` command exposed as a fleetd table is more performant than trying to use the `file` table. This change caused the watchdog to *stop* killing osquery because of exceeding memory or CPU limit. - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - [X] Added/updated tests - [X] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [X] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
63 lines
3.8 KiB
Go
63 lines
3.8 KiB
Go
//go:build darwin
|
|
|
|
package table
|
|
|
|
import (
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/authdb"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/csrutil_info"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/diskutil/apfs"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/diskutil/corestorage"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/dscl"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/filevault_prk"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/find_cmd"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/firmware_eficheck_integrity_check"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/nvram_info"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/pmset"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/privaterelay"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/pwd_policy"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/software_update"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/sudo_info"
|
|
"github.com/fleetdm/fleet/v4/orbit/pkg/table/user_login_settings"
|
|
"github.com/macadmins/osquery-extension/tables/filevaultusers"
|
|
"github.com/macadmins/osquery-extension/tables/macos_profiles"
|
|
"github.com/macadmins/osquery-extension/tables/macosrsr"
|
|
"github.com/macadmins/osquery-extension/tables/mdm"
|
|
"github.com/macadmins/osquery-extension/tables/munki"
|
|
"github.com/macadmins/osquery-extension/tables/unifiedlog"
|
|
"github.com/osquery/osquery-go"
|
|
"github.com/osquery/osquery-go/plugin/table"
|
|
)
|
|
|
|
func PlatformTables() []osquery.OsqueryPlugin {
|
|
return []osquery.OsqueryPlugin{
|
|
// Fleet tables
|
|
table.NewPlugin("icloud_private_relay", privaterelay.Columns(), privaterelay.Generate),
|
|
table.NewPlugin("user_login_settings", user_login_settings.Columns(), user_login_settings.Generate),
|
|
table.NewPlugin("pwd_policy", pwd_policy.Columns(), pwd_policy.Generate),
|
|
table.NewPlugin("csrutil_info", csrutil_info.Columns(), csrutil_info.Generate),
|
|
table.NewPlugin("nvram_info", nvram_info.Columns(), nvram_info.Generate),
|
|
table.NewPlugin("authdb", authdb.Columns(), authdb.Generate),
|
|
table.NewPlugin("pmset", pmset.Columns(), pmset.Generate),
|
|
table.NewPlugin("sudo_info", sudo_info.Columns(), sudo_info.Generate),
|
|
table.NewPlugin("software_update", software_update.Columns(), software_update.Generate),
|
|
table.NewPlugin("firmware_eficheck_integrity_check", firmware_eficheck_integrity_check.Columns(), firmware_eficheck_integrity_check.Generate),
|
|
table.NewPlugin("dscl", dscl.Columns(), dscl.Generate),
|
|
table.NewPlugin("apfs_volumes", apfs.VolumesColumns(), apfs.VolumesGenerate),
|
|
table.NewPlugin("apfs_physical_stores", apfs.PhysicalStoresColumns(), apfs.PhysicalStoresGenerate),
|
|
table.NewPlugin("corestorage_logical_volumes", corestorage.LogicalVolumesColumns(), corestorage.LogicalVolumesGenerate),
|
|
table.NewPlugin("corestorage_logical_volume_families", corestorage.LogicalVolumeFamiliesColumns(), corestorage.LogicalVolumeFamiliesGenerate),
|
|
table.NewPlugin("filevault_prk", filevault_prk.Columns(), filevault_prk.Generate),
|
|
table.NewPlugin("find_cmd", find_cmd.Columns(), find_cmd.Generate),
|
|
|
|
// Macadmins extension tables
|
|
table.NewPlugin("filevault_users", filevaultusers.FileVaultUsersColumns(), filevaultusers.FileVaultUsersGenerate),
|
|
table.NewPlugin("macos_profiles", macos_profiles.MacOSProfilesColumns(), macos_profiles.MacOSProfilesGenerate),
|
|
table.NewPlugin("mdm", mdm.MDMInfoColumns(), mdm.MDMInfoGenerate),
|
|
table.NewPlugin("munki_info", munki.MunkiInfoColumns(), munki.MunkiInfoGenerate),
|
|
table.NewPlugin("munki_installs", munki.MunkiInstallsColumns(), munki.MunkiInstallsGenerate),
|
|
table.NewPlugin("macos_rsr", macosrsr.MacOSRsrColumns(), macosrsr.MacOSRsrGenerate),
|
|
// osquery version 5.5.0 and up ships a unified_log table in core
|
|
// we are renaming the one from the macadmins extension to avoid collision
|
|
table.NewPlugin("macadmins_unified_log", unifiedlog.UnifiedLogColumns(), unifiedlog.UnifiedLogGenerate),
|
|
}
|
|
}
|