Shaun S
10/11/2021, 11:56 PM$ fleetctl package -type pkg
{"level":"debug","path":"/tmp/orbit-package308488698","time":"2021-10-11T23:43:54Z","message":"created temp dir"}
{"level":"debug","error":"stat /tmp/orbit-package308488698/root/var/lib/orbit/bin/osqueryd/macos/stable/osqueryd: no such file or directory","time":"2021-10-11T23:43:55Z","message":"stat file"}
{"level":"debug","path":"/tmp/orbit-package308488698/root/var/lib/orbit/bin/osqueryd/macos/stable/osqueryd","time":"2021-10-11T23:43:58Z","message":"got osqueryd"}
{"level":"debug","error":"stat /tmp/orbit-package308488698/root/var/lib/orbit/bin/orbit/macos/stable/orbit: no such file or directory","time":"2021-10-11T23:43:58Z","message":"stat file"}
{"level":"debug","path":"/tmp/orbit-package308488698/root/var/lib/orbit/bin/orbit/macos/stable/orbit","time":"2021-10-11T23:43:59Z","message":"got orbit"}
build pkg: cpio Payload: wait cpio: exit status 1
$ fleetctl package -type deb
{"level":"debug","path":"/tmp/orbit-package219856153","time":"2021-10-11T23:46:16Z","message":"created temp dir"}
{"level":"debug","error":"stat /tmp/orbit-package219856153/root/var/lib/orbit/bin/osqueryd/linux/stable/osqueryd: no such file or directory","time":"2021-10-11T23:46:18Z","message":"stat file"}
initialize updates: failed to get osqueryd: exec new version: : fork/exec /tmp/orbit-package219856153/root/var/lib/orbit/staging/osqueryd: no such file or directory
That makes it look like osquery needs to be separately installed inside of the container image?zwass
fleetctl
should be all you need. What is the OS that you are attempting this on?Shaun S
10/12/2021, 12:34 AMzwass
fleetctl
on the Docker image?Shaun S
10/12/2021, 1:15 AMChad
10/12/2021, 2:41 AMfleetctl
in the docker image, I mounted a named volume and exposed the docker service so that fleetctl
can spawn sibling instances. Then you need to modify the heat code to point to the named volume. Also creating temp dir didn't work for some reason so I hardcoded a temp dir to get it to work.Shaun S
10/12/2021, 2:46 AMChad
10/12/2021, 3:03 AMfleetctl
docker image access to docker service to spawn sibling instances and the second one is to share build artifacts between the images:
"volumes": [
{
"localPath": "/var/run/docker.sock",
"containerPath": "/var/run/docker.sock"
},
{
"localPath": "named_volume",
"containerPath": "/tmp/orbit-package"
}
Shaun S
10/12/2021, 3:22 AMChad
10/12/2021, 3:39 AMShaun S
10/12/2021, 3:52 AMzwass
fleetctl package
within the Docker container as of yet -- there are so many dependencies and weird platform-specific things that we've been testing with installing fleetctl
binary on the host machine (via npm install -g fleetctl
or just downloading/building the binary)Shaun S
10/12/2021, 4:22 PMzwass
Shaun S
10/12/2021, 4:23 PMfleet.zip
.
Do I need both fleetctl_v4.4.1_linux.tar.gz and fleet_v4.4.1_linux.tar.gz?zwass
fleet
binary) you'll just need fleetctl
to interact with the Fleet server and build osquery packages.Shaun S
10/12/2021, 4:40 PMzwass
Shaun S
10/12/2021, 4:48 PMfleetctl package -type pkg
Is there a list of dependencies some where?Chad
10/13/2021, 3:43 AMShaun S
10/13/2021, 3:44 AMChad
10/13/2021, 3:45 AMShaun S
10/13/2021, 3:45 AMbuild pkg: mkbom: exec: "mkbom": executable file not found in $PATH
Chad
10/13/2021, 3:51 AM# Install xar from source
RUN git clone --depth=1 \
--branch=master \
<https://github.com/mackyle/xar.git> \
&& cd /xar/xar; \
sed -i '332s/^.*$/AC_CHECK_LIB([crypto], [OPENSSL_init_crypto], , [have_libcrypto="0"])/' <http://configure.ac|configure.ac> \
&& ./autogen.sh --noconfigure \
&& ./configure LDFLAGS=-lfts \
&& make \
&& make install \
&& cd / \
&& rm -rf /xar
# Install bomutils from sources
RUN git clone --depth=1 \
--branch=master \
<https://github.com/hogliux/bomutils.git> \
&& cd bomutils \
&& make \
&& make install \
&& chmod 755 build/bin/mkbom \
&& cp build/bin/mkbom /usr/local/bin/mkbom \
&& cd / \
&& rm -rf /bomutils
zwass