Skip to content

Commit 9bd0f53

Browse files
samrosesamrose
committed
feat: tmp install osquery, check all permissions, remove script and osquery
1 parent 53953ce commit 9bd0f53

File tree

4 files changed

+212
-6
lines changed

4 files changed

+212
-6
lines changed

‎ansible-nix/files/permission_check.py

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
import subprocess
2+
import json
3+
import sys
4+
5+
# Expected groups for each user
6+
expected_results = {
7+
"postgres": [
8+
{"groupname": "postgres", "username": "postgres"},
9+
{"groupname": "ssl-cert", "username": "postgres"}
10+
],
11+
"ubuntu": [
12+
{"groupname":"ubuntu","username":"ubuntu"},
13+
{"groupname":"adm","username":"ubuntu"},
14+
{"groupname":"dialout","username":"ubuntu"},
15+
{"groupname":"cdrom","username":"ubuntu"},
16+
{"groupname":"floppy","username":"ubuntu"},
17+
{"groupname":"sudo","username":"ubuntu"},
18+
{"groupname":"audio","username":"ubuntu"},
19+
{"groupname":"dip","username":"ubuntu"},
20+
{"groupname":"video","username":"ubuntu"},
21+
{"groupname":"plugdev","username":"ubuntu"},
22+
{"groupname":"lxd","username":"ubuntu"},
23+
{"groupname":"netdev","username":"ubuntu"}
24+
],
25+
"root": [
26+
{"groupname":"root","username":"root"}
27+
],
28+
"daemon": [
29+
{"groupname":"daemon","username":"daemon"}
30+
],
31+
"bin": [
32+
{"groupname":"bin","username":"bin"}
33+
],
34+
"sys": [
35+
{"groupname":"sys","username":"sys"}
36+
],
37+
"sync": [
38+
{"groupname":"nogroup","username":"sync"}
39+
],
40+
"games": [
41+
{"groupname":"games","username":"games"}
42+
],
43+
"man": [
44+
{"groupname":"man","username":"man"}
45+
],
46+
"lp": [
47+
{"groupname":"lp","username":"lp"}
48+
],
49+
"mail": [
50+
{"groupname":"mail","username":"mail"}
51+
],
52+
"news": [
53+
{"groupname":"news","username":"news"}
54+
],
55+
"uucp": [
56+
{"groupname":"uucp","username":"uucp"}
57+
],
58+
"proxy": [
59+
{"groupname":"proxy","username":"proxy"}
60+
],
61+
"www-data": [
62+
{"groupname":"www-data","username":"www-data"}
63+
],
64+
"backup": [
65+
{"groupname":"backup","username":"backup"}
66+
],
67+
"list": [
68+
{"groupname":"list","username":"list"}
69+
],
70+
"irc": [
71+
{"groupname":"irc","username":"irc"}
72+
],
73+
"gnats": [
74+
{"groupname":"gnats","username":"gnats"}
75+
],
76+
"nobody": [
77+
{"groupname":"nogroup","username":"nobody"}
78+
],
79+
"systemd-network": [
80+
{"groupname":"systemd-network","username":"systemd-network"}
81+
],
82+
"systemd-resolve": [
83+
{"groupname":"systemd-resolve","username":"systemd-resolve"}
84+
],
85+
"systemd-timesync": [
86+
{"groupname":"systemd-timesync","username":"systemd-timesync"}
87+
],
88+
"messagebus": [
89+
{"groupname":"messagebus","username":"messagebus"}
90+
],
91+
"ec2-instance-connect": [
92+
{"groupname":"nogroup","username":"ec2-instance-connect"}
93+
],
94+
"sshd": [
95+
{"groupname":"nogroup","username":"sshd"}
96+
],
97+
"wal-g": [
98+
{"groupname":"wal-g","username":"wal-g"},
99+
{"groupname":"postgres","username":"wal-g"}
100+
],
101+
"pgbouncer": [
102+
{"groupname":"pgbouncer","username":"pgbouncer"},
103+
{"groupname":"ssl-cert","username":"pgbouncer"},
104+
{"groupname":"postgres","username":"pgbouncer"}
105+
],
106+
"gotrue": [
107+
{"groupname":"gotrue","username":"gotrue"}
108+
],
109+
"envoy": [
110+
{"groupname":"envoy","username":"envoy"}
111+
],
112+
"kong": [
113+
{"groupname":"kong","username":"kong"}
114+
],
115+
"nginx": [
116+
{"groupname":"nginx","username":"nginx"}
117+
],
118+
"vector": [
119+
{"groupname":"vector","username":"vector"},
120+
{"groupname":"adm","username":"vector"},
121+
{"groupname":"systemd-journal","username":"vector"},
122+
{"groupname":"postgres","username":"vector"}
123+
],
124+
"adminapi": [
125+
{"groupname":"adminapi","username":"adminapi"},
126+
{"groupname":"root","username":"adminapi"},
127+
{"groupname":"systemd-journal","username":"adminapi"},
128+
{"groupname":"admin","username":"adminapi"},
129+
{"groupname":"postgres","username":"adminapi"},
130+
{"groupname":"pgbouncer","username":"adminapi"},
131+
{"groupname":"wal-g","username":"adminapi"},
132+
{"groupname":"postgrest","username":"adminapi"},
133+
{"groupname":"envoy","username":"adminapi"},
134+
{"groupname":"kong","username":"adminapi"},
135+
{"groupname":"vector","username":"adminapi"}
136+
],
137+
"postgrest": [
138+
{"groupname":"postgrest","username":"postgrest"}
139+
],
140+
"tcpdump": [
141+
{"groupname":"tcpdump","username":"tcpdump"}
142+
],
143+
"systemd-coredump": [
144+
{"groupname":"systemd-coredump","username":"systemd-coredump"}
145+
]
146+
}
147+
# This program depends on osquery being installed on the system
148+
# Function to run osquery
149+
def run_osquery(query):
150+
process = subprocess.Popen(['osqueryi', '--json', query], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
151+
output, error = process.communicate()
152+
return output.decode('utf-8')
153+
154+
def parse_json(json_str):
155+
try:
156+
return json.loads(json_str)
157+
except json.JSONDecodeError as e:
158+
print("Error decoding JSON:", e)
159+
sys.exit(1)
160+
161+
def compare_results(username, query_result):
162+
expected_result = expected_results.get(username)
163+
if expected_result is None:
164+
print(f"No expected result defined for user '{username}'")
165+
sys.exit(1)
166+
167+
if query_result == expected_result:
168+
print(f"The query result for user '{username}' matches the expected result.")
169+
else:
170+
print(f"The query result for user '{username}' does not match the expected result.")
171+
print("Expected:", expected_result)
172+
print("Got:", query_result)
173+
sys.exit(1)
174+
175+
# Define usernames for which you want to compare results
176+
usernames = ["postgres", "ubuntu", "root", "daemon", "bin", "sys", "sync", "games","man","lp","mail","news","uucp","proxy","www-data","backup","list","irc","gnats","nobody","systemd-network","systemd-resolve","systemd-timesync","messagebus","ec2-instance-connect","sshd","wal-g","pgbouncer","gotrue","envoy","kong","nginx","vector","adminapi","postgrest","tcpdump","systemd-coredump"]
177+
178+
# Iterate over usernames, run the query, and compare results
179+
for username in usernames:
180+
query = f"SELECT u.username, g.groupname FROM users u JOIN user_groups ug ON u.uid = ug.uid JOIN groups g ON ug.gid = g.gid WHERE u.username = '{username}';"
181+
query_result = run_osquery(query)
182+
parsed_result = parse_json(query_result)
183+
compare_results(username, parsed_result)

‎ansible-nix/playbook.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,31 @@
117117
- name: Print result to Ansible log output
118118
debug:
119119
msg: "The postgres user is {{ 'not ' if check_user_group.rc != 0 else '' }}part of the users group"
120+
121+
- name: Install osquery from nixpkgs binary cache
122+
become: yes
123+
shell: |
124+
sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install nixpkgs#osquery"
125+
126+
- name: Install osquery permission check script
127+
become: yes
128+
copy:
129+
src: files/permission_check.py
130+
dest: /home/ubuntu/permission_check.py
131+
mode: "0755"
132+
133+
- name: Run osquery permission checks
134+
become: yes
135+
shell: |
136+
sudo -u ubuntu bash -c "python3 /home/ubuntu/permission_check.py"
137+
138+
- name: Remove osquery permission check script
139+
become: yes
140+
file:
141+
path: /home/ubuntu/permission_check.py
142+
state: absent
143+
144+
- name: Remove osquery
145+
become: yes
146+
shell: |
147+
sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile osquery"

‎ansible-nix/tasks/stage2/stage2-setup-postgres.yml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,6 @@
88
shell: |
99
sudo -u postgres bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/sam/2-stage-ami-nix#pg_prove"
1010
11-
- name: Install pg_prove from nix binary cache
12-
become: yes
13-
shell: |
14-
sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install nixpkgs#osquery"
15-
1611
#TODO switch pg_prove sourcing to develop branch once PR is merged
1712

1813
# - name: Generate en_US.UTF-8 locale

‎common-nix.vars.pkr.hcl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
postgres-version = "15.6.1.45-nix-staged"
1+
postgres-version = "15.6.1.46-nix-staged"

0 commit comments

Comments
 (0)