mirror of
https://github.com/empayre/fleet.git
synced 2024-11-07 01:15:22 +00:00
d5f9fcaeb2
This PR adds support for file integrity monitoring. This is done by providing a simplified API that can be used to PATCH/GET FIM configurations. There is also code to build the FIM configuration to send back to osquery. Each PATCH request, if successful, replaces Fleet's existing FIM configuration. For example: curl -X "PATCH" "https://localhost:8080/api/v1/kolide/fim" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2tleSI6IkVhaFhvZWswMGtWSEdaTTNCWndIMnhpYWxkNWZpcVFDR2hEcW1HK2UySmRNOGVFVE1DeTNTaUlFWmhZNUxhdW1ueFZDV2JiR1Bwdm5TKzdyK3NJUzNnPT0ifQ.SDCHAUA1vTuWGjXtcQds2GZLM27HAAiOUhR4WvgvTNY" \ -H "Content-Type: application/json; charset=utf-8" \ -d $'{ "interval": 500, "file_paths": { "etc": [ "/etc/%%" ], "users": [ "/Users/%/Library/%%", "/Users/%/Documents/%%" ], "usr": [ "/usr/bin/%%" ] } }'
47 lines
1.2 KiB
Go
47 lines
1.2 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/kolide/fleet/server/kolide"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
func (svc service) GetFIM(ctx context.Context) (*kolide.FIMConfig, error) {
|
|
config, err := svc.ds.AppConfig()
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "getting fim config")
|
|
}
|
|
paths, err := svc.ds.FIMSections()
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "getting fim paths")
|
|
}
|
|
result := &kolide.FIMConfig{
|
|
Interval: uint(config.FIMInterval),
|
|
FilePaths: paths,
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
// ModifyFIM will remove existing FIM settings and replace it
|
|
func (svc service) ModifyFIM(ctx context.Context, fim kolide.FIMConfig) error {
|
|
if err := svc.ds.ClearFIMSections(); err != nil {
|
|
return errors.Wrap(err, "updating fim")
|
|
}
|
|
config, err := svc.ds.AppConfig()
|
|
if err != nil {
|
|
return errors.Wrap(err, "updating fim")
|
|
}
|
|
config.FIMInterval = int(fim.Interval)
|
|
for sectionName, paths := range fim.FilePaths {
|
|
section := kolide.FIMSection{
|
|
SectionName: sectionName,
|
|
Paths: paths,
|
|
}
|
|
if _, err := svc.ds.NewFIMSection(§ion); err != nil {
|
|
return errors.Wrap(err, "creating fim section")
|
|
}
|
|
}
|
|
return svc.ds.SaveAppConfig(config)
|
|
}
|