osquery: init at 2.5.2 #27347

cstrahan · 2017-07-13T01:04:57Z

Motivation for this change

I'd like to use osquery: https://osquery.io/

Things done

Tested using sandboxing
(nix.useSandbox on NixOS,
or option build-use-sandbox in nix.conf
on non-NixOS)
Built on platform(s)
- NixOS
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

The osqueryd daemon can be configured in NixOS like so:

{ config, lib, pkgs, ... }:

with lib;

{ services.osquery.enable = true;
  services.osquery.extraConfig = {
    schedule = {
      # a simple example of logging added/removed processes (by pid and name):
      processes = {
        query = "SELECT pid, name FROM processes;";
        interval = 10;
      };
    };
    packs = {
      # standard packs can be referenced like so:
      monitoring = "${pkgs.osquery}/share/osquery/packs/osquery-monitoring.conf";
    };
  };

}

As time goes by, we can try to expand the support for legitimate configuration options, but that's out of scope for this PR; for now, extraConfig provides an escape hatch (we'll want this anyway, since the config file schema is large, and we'll undoubtedly provide only subset as direct NixOS options at any given moment; we should allow people to easily express the config settings in the interim). The settings in extraConfig are merged recursively, so separate NixOS config files can specify separate schedules, packs, etc.

cstrahan · 2017-07-13T05:10:22Z

This currently builds the SDK as a static library, while it would be nice to instead provide a shared library.

Unfortunately, when I add:

  ${if (!enableStatic) then "OSQUERY_BUILD_SHARED" else null} = true;
  ${if (!enableStatic) then "BUILD_LINK_SHARED" else null} = true;

I get the following compile error:

[ 29%] Linking CXX shared library libosquery.so
cd /tmp/nix-build-osquery-2.5.2.drv-0/osquery-2.5.2-src/build/osquery && /nix/store/5dh82kd6qppsap7b12llcbp6w4d2i6a9-cmake-3.8.2/bin/cmake -E cmake_link_script CMakeFiles/libosquery_shared.dir/link.txt --verbose=1
/nix/store/3k978nnp7ppjim34di40vwz5f95rsxhw-gcc-wrapper-5.4.0/bin/g++ -fPIC -O3 -DNDEBUG  -shared -Wl,-soname,libosquery.so -o libosquery.so CMakeFiles/libosquery_shared.dir/main/lib.cpp.o config/CMakeFiles/osquery_config.dir/config.cpp.o config/CMakeFiles/osquery_config.dir/packs.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/decorators.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/events_parser.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/file_paths.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/options.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/prometheus_targets.cpp.o config/CMakeFiles/osquery_config_parsers.dir/parsers/views.cpp.o core/CMakeFiles/osquery_core.dir/conversions.cpp.o core/CMakeFiles/osquery_core.dir/init.cpp.o core/CMakeFiles/osquery_core.dir/system.cpp.o core/CMakeFiles/osquery_core.dir/posix/process.cpp.o core/CMakeFiles/osquery_core.dir/posix/process_ops.cpp.o core/CMakeFiles/osquery_core.dir/posix/utils.cpp.o core/CMakeFiles/osquery_core.dir/tables.cpp.o core/CMakeFiles/osquery_core.dir/flags.cpp.o core/CMakeFiles/osquery_core.dir/watcher.cpp.o database/CMakeFiles/osquery_database.dir/database.cpp.o database/CMakeFiles/osquery_database.dir/query.cpp.o database/CMakeFiles/osquery_database.dir/plugins/ephemeral.cpp.o dispatcher/CMakeFiles/osquery_dispatcher.dir/dispatcher.cpp.o distributed/CMakeFiles/osquery_distributed.dir/distributed.cpp.o events/CMakeFiles/osquery_events.dir/events.cpp.o extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/Extension.cpp.o extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/ExtensionManager.cpp.o extensions/CMakeFiles/osquery_extensions.dir/__/__/generated/gen-cpp/osquery_types.cpp.o extensions/CMakeFiles/osquery_extensions.dir/extensions.cpp.o extensions/CMakeFiles/osquery_extensions.dir/interface.cpp.o filesystem/CMakeFiles/osquery_filesystem_linux.dir/linux/mem.cpp.o filesystem/CMakeFiles/osquery_filesystem_linux.dir/linux/proc.cpp.o filesystem/CMakeFiles/osquery_filesystem.dir/filesystem.cpp.o filesystem/CMakeFiles/osquery_filesystem.dir/posix/fileops.cpp.o logger/CMakeFiles/osquery_logger.dir/logger.cpp.o registry/CMakeFiles/osquery_registry.dir/registry.cpp.o sql/CMakeFiles/osquery_sql.dir/sql.cpp.o tables/CMakeFiles/osquery_tables_utility.dir/utility/file.cpp.o tables/CMakeFiles/osquery_tables_utility.dir/utility/osquery.cpp.o tables/CMakeFiles/osquery_tables_utility.dir/utility/time.cpp.o CMakeFiles/osquery_amalgamation.dir/__/generated/utils_amalgamation.cpp.o -lpthread -lz -lgflags -lthrift -llz4 -ldl -lsqlite3 -lboost_system -lboost_filesystem -lboost_thread -lboost_context -lrt -lc -lglog -llzma -lbz2 -rdynamic -Wl,-zrelro -Wl,-znow -pie -lgcc_s -Wl,--build-id
/nix/store/f111ij1fc83965m48bf2zqgiaq88fqv5-glibc-2.25/lib/Scrt1.o: In function `_start':
/build/glibc-2.25/csu/../sysdeps/x86_64/start.S:104: undefined reference to `main'
collect2: error: ld returned 1 exit status

Mic92 · 2017-07-13T07:03:41Z

nixos/modules/services/monitoring/osquery.nix

+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.osquery ];
+      preStart = ''
+        mkdir -p ${escapeShellArg cfg.loggerPath}


escapeShellArg will not add quotes around the argument. You have to add them manually.

That's not what it looks like:

nix-repl> lib.escapeShellArg "this is a test" "'this is a test'"

Note, specifically, the inner single quotes (').

You are right.

Mic92 · 2017-07-13T07:12:57Z

pkgs/tools/system/osquery/platform-nixos.patch

+ GENTOO_RELEASE = "/etc/gentoo-release"
+
+ def _platform():
+    return ("nixos", "nixos")


To bad that they have no support for /etc/os-release. The only disadvantage of this patch is, that it won't work on non-nixos. Also I don't how many people would use osqueryd that way.

Mic92 · 2017-07-13T07:18:31Z

pkgs/tools/system/osquery/misc.patch

+   else()
+     set(LINUX TRUE)
+-    set(CXX_COMPILE_FLAGS "${CXX_COMPILE_FLAGS} -std=c++14 -stdlib=libstdc++")
+    set(CXX_COMPILE_FLAGS "${CXX_COMPILE_FLAGS} -std=c++14")


What was the problem with libstdc++ in nixos? It might also helpful to add a comment so future maintainer have an easier job.

@Mic92 I get: g++: error: unrecognized command line option '-stdlib=libstdc++'

The osquery devs build their stuff with clang, where that flag makes sense.

Do think we could run into subtle runtime bugs due not using clang++ on nixos?

No; we're not mixing different standard libs, so everything should be fine.

See: https://github.com/facebook/rocksdb/blob/master/ROCKSDB_LITE.md

cstrahan · 2017-07-25T01:50:27Z

I've further split-up the commits (factoring out rocksdb-lite and linenoise-ng).

cstrahan · 2017-07-25T01:50:59Z

I think this is fairly uncontroversial; merging.

apt: init at 1.4.6

7f8e3f8

cstrahan force-pushed the osquery-new branch from d759d0d to 97c6e02 Compare July 13, 2017 01:06

cstrahan changed the title ~~Osquery new~~ osquery: init at 2.5.2 Jul 13, 2017

cstrahan mentioned this pull request Jul 13, 2017

shared build failure: "undefined reference to main" osquery/osquery#3466

Closed

Mic92 reviewed Jul 13, 2017

View reviewed changes

cstrahan force-pushed the osquery-new branch from 9935f7b to 6fc4fd1 Compare July 25, 2017 01:39

cstrahan added 4 commits July 24, 2017 21:44

linenoise-ng: init at 1.0.1

dc21851

rocksdb: enable support for lite mode

29d2fe4

See: https://github.com/facebook/rocksdb/blob/master/ROCKSDB_LITE.md

osquery: init at 2.5.2

53426f6

osquery: use packaged sqlite and gtest/gmock

232c34b

cstrahan force-pushed the osquery-new branch from 6fc4fd1 to 232c34b Compare July 25, 2017 01:48

cstrahan merged commit c1fdf33 into NixOS:master Jul 25, 2017

kamilchm mentioned this pull request Jul 28, 2017

osquery kamilchm/nixos-config#3

Open

infinisil mentioned this pull request Apr 4, 2018

Compilation failure with NixOS osquery/osquery#4257

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

osquery: init at 2.5.2 #27347

osquery: init at 2.5.2 #27347

cstrahan commented Jul 13, 2017 •

edited

Loading

cstrahan commented Jul 13, 2017

Mic92 Jul 13, 2017

cstrahan Jul 13, 2017

Mic92 Jul 13, 2017

Mic92 Jul 13, 2017

Mic92 Jul 13, 2017

cstrahan Jul 13, 2017

Mic92 Jul 13, 2017

cstrahan Jul 25, 2017

cstrahan commented Jul 25, 2017

cstrahan commented Jul 25, 2017

osquery: init at 2.5.2 #27347

osquery: init at 2.5.2 #27347

Conversation

cstrahan commented Jul 13, 2017 • edited Loading

Motivation for this change

Things done

cstrahan commented Jul 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cstrahan commented Jul 25, 2017

cstrahan commented Jul 25, 2017

cstrahan commented Jul 13, 2017 •

edited

Loading