mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
d5f9fcaeb2
This PR adds support for file integrity monitoring. This is done by providing a simplified API that can be used to PATCH/GET FIM configurations. There is also code to build the FIM configuration to send back to osquery. Each PATCH request, if successful, replaces Fleet's existing FIM configuration. For example: curl -X "PATCH" "https://localhost:8080/api/v1/kolide/fim" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2tleSI6IkVhaFhvZWswMGtWSEdaTTNCWndIMnhpYWxkNWZpcVFDR2hEcW1HK2UySmRNOGVFVE1DeTNTaUlFWmhZNUxhdW1ueFZDV2JiR1Bwdm5TKzdyK3NJUzNnPT0ifQ.SDCHAUA1vTuWGjXtcQds2GZLM27HAAiOUhR4WvgvTNY" \ -H "Content-Type: application/json; charset=utf-8" \ -d $'{ "interval": 500, "file_paths": { "etc": [ "/etc/%%" ], "users": [ "/Users/%/Library/%%", "/Users/%/Documents/%%" ], "usr": [ "/usr/bin/%%" ] } }'
41 lines
983 B
Go
41 lines
983 B
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/go-kit/kit/endpoint"
|
|
"github.com/kolide/fleet/server/kolide"
|
|
)
|
|
|
|
type modifyFIMResponse struct {
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
func (m modifyFIMResponse) error() error { return m.Err }
|
|
|
|
func makeModifyFIMEndpoint(svc kolide.Service) endpoint.Endpoint {
|
|
return func(ctx context.Context, req interface{}) (interface{}, error) {
|
|
fimConfig := req.(kolide.FIMConfig)
|
|
var resp modifyFIMResponse
|
|
if err := svc.ModifyFIM(ctx, fimConfig); err != nil {
|
|
resp.Err = err
|
|
}
|
|
return resp, nil
|
|
}
|
|
}
|
|
|
|
type getFIMResponse struct {
|
|
Err error `json:"error,omitempty"`
|
|
Payload *kolide.FIMConfig `json:"payload,omitempty"`
|
|
}
|
|
|
|
func makeGetFIMEndpoint(svc kolide.Service) endpoint.Endpoint {
|
|
return func(ctx context.Context, _ interface{}) (interface{}, error) {
|
|
fimConfig, err := svc.GetFIM(ctx)
|
|
if err != nil {
|
|
return getFIMResponse{Err: err}, nil
|
|
}
|
|
return getFIMResponse{Payload: fimConfig}, nil
|
|
}
|
|
}
|