mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 08:55:24 +00:00
c89cd370d5
This adds the option to set up an S3 bucket as the storage backend for file carving (partially solving #111). It works by using the multipart upload capabilities of S3 to maintain compatibility with the "upload in blocks" protocol that osquery uses. It does this basically replacing the carve_blocks table while still maintaining the metadata in the original place (it would probably be possible to rely completely on S3 by using object tagging at the cost of listing performance). To make this pluggable, I created a new field in the service struct dedicated to the CarveStore which, if no configuration for S3 is set up will be just a reference to the standard datastore, otherwise it will point to the S3 one (effectively this separation will allow in the future to add more backends). |
||
|---|---|---|
| .. | ||
| bindata | ||
| config | ||
| contexts | ||
| datastore | ||
| health | ||
| kolide | ||
| launcher | ||
| live_query | ||
| logging | ||
| mock | ||
| pubsub | ||
| service | ||
| sso | ||
| test | ||
| websocket | ||