Gilad Reich
02/01/2023, 8:51 AMosquery.conf
file? I was looking into some of the available `options` using osqueryd --help
command. However I only see that extensions_*
related flags are only possible to pass via CLI flags, not configuration flags. This is because possible flags are split into two sections:
• osquery command line flags
• osquery configuration options (set by config or CLI flags)
I was checking other possible ways to load my extension via the osquery flags file, but unfortunately I'm quite limited in how I can pass arguments to Osquery due to limitation in Wazuh's Wodle design: https://github.com/wazuh/wazuh/issues/16062
If there is another way to load extensions (like maybe global configurations that Osquery always know about), this would solve my problem.
Many thanks for your attention! 🙂zwass
02/01/2023, 5:46 PMGilad Reich
02/01/2023, 7:41 PMoptions
category in osquery.conf
a new field to accept array of paths to extensions from disk:
"options": {
"extensions": [
"path/to/extension1",
"path/to/extension2"
],
},
or alternative way would be to give it extension dir path and whatever extensions in that dir will be automatically loaded:
"options": {
"extensions_dir": "path/to/dir/with/extensions"
},
But I’d rather not go down this rabbit hole and looking for alternatives.extensions.cpp
I found this:
CLI_FLAG(string,
extensions_autoload,
OSQUERY_HOME "extensions.load",
"Optional path to a list of autoloaded & managed extensions");
Looks like the paths are hardcoded to where OSQUERY_HOME
is:
#if defined(__linux__)
#define OSQUERY_HOME "/etc/osquery/"
#define OSQUERY_DB_HOME "/var/osquery/"
#define OSQUERY_SOCKET OSQUERY_DB_HOME
#define OSQUERY_PIDFILE "/var/run/"
#define OSQUERY_LOG_HOME "/var/log/osquery/"
#define OSQUERY_CERTS_HOME "/opt/osquery/share/osquery/certs/"
#elif defined(WIN32)
#define OSQUERY_HOME "\\Program Files\\osquery\\"
#define OSQUERY_DB_HOME OSQUERY_HOME
#define OSQUERY_SOCKET "\\\\.\\pipe\\"
#define OSQUERY_PIDFILE OSQUERY_DB_HOME
#define OSQUERY_LOG_HOME OSQUERY_HOME "log\\"
#define OSQUERY_CERTS_HOME OSQUERY_HOME "certs\\"
#elif defined(FREEBSD)
#define OSQUERY_HOME "/var/db/osquery/"
#define OSQUERY_DB_HOME OSQUERY_HOME
#define OSQUERY_SOCKET "/var/run/"
#define OSQUERY_PIDFILE "/var/run/"
#define OSQUERY_LOG_HOME "/var/log/osquery/"
#define OSQUERY_CERTS_HOME "/etc/ssl/"
#else
#define OSQUERY_HOME "/var/osquery/"
#define OSQUERY_DB_HOME OSQUERY_HOME
#define OSQUERY_SOCKET OSQUERY_DB_HOME
#define OSQUERY_PIDFILE OSQUERY_DB_HOME
#define OSQUERY_LOG_HOME "/var/log/osquery/"
#define OSQUERY_CERTS_HOME OSQUERY_HOME "certs/"
#endif
Kinda weird and I wish the devs wouldn’t use hardcoded preprocessor here and made it configureable. This is because I’m packaging Osquery in a single folder within the Wazuh agent installation in order to have everything in one place.
So the “hack” here was to create extensions.load
file within the custom osquery directory. Inside this file give it the path to where the actual extension to be loaded (as officially documented). Then creating a symbolic link to the path from where the custom packaged Osquery installation is to /var/osquery
, e.g.:
ln -s /My/Custom/Path/osquery /var/osquery
And osquery will auto-load the extensions.load
file.
IMHO it would have been much nicer to be able to configure this as suggested above.zwass
02/01/2023, 9:46 PMGilad Reich
02/01/2023, 10:29 PMosquery.flags.default
file in the default paths and adding a startup flag in there to load the extension. e.g. content of `osquery.flags.default`:
--extension=/path/to/ext/myext
since one can always append there more startup flags and not necessarily be doomed to the enforced logic of having to set my extension name with .ext
suffix (unless I’m missing the rational behind it): https://osquery.slack.com/archives/CBMR0L7SM/p1675359720465939
But I’m still a bit unhappy by the fact that I have to create this symbolic link to trick it to think that it’s located in the default path.seph
02/05/2023, 4:30 PM--flagfile
argument that can be used to specify flags. It is further documented as:
If no --flagfile is provided, osquery will try to find and use a "default" flagfile at /etc/osquery/osquery.flags.default. Both the shell and daemon will discover and use the defaults.
Though I’m not sure how that applies to windows.Gilad Reich
02/05/2023, 4:38 PMoptions are split between config flags, and CLI-only flags mostly because of osquery startup sequencing. (And some concern about forcing features to be disabled outside of configuration)Thanks @seph. Yeah, I realized while digging into the sequencing of loading things. There is still some inconsistency there though; like there are some options that are not documented as startup flags, but could be used in both scenarios. As an example, take a look at
logger_path
, which is documented as option, but could also be passed as startup flag.seph
02/05/2023, 4:39 PMGilad Reich
02/05/2023, 4:39 PMseph
02/05/2023, 4:40 PMosqueryd --help
splits them into sections:
• osquery command line flags
• osquery configuration options (set by config or CLI flags)Gilad Reich
02/05/2023, 4:41 PMOSQUERY_HOME
dir, so that I don’t have to override all possible flags to make my installation portable. e.g.: osqueryd --home_dir my/custom/path
.seph
02/05/2023, 4:42 PMI also wished Osquery had a startup flag to override the hardcoded preprocessor OSQUERY_HOME dir.yeah, I agree. that does seem reasonable. I have no idea how easy it would be to implement, It might be trivial, or it might have sprawling effects on startup
Gilad Reich
02/05/2023, 4:43 PMsplits them into sections:osqueryd --help
• osquery command line flags
• osquery configuration options (set by config or CLI flags)Exactly, and some flags are in the configuration options section, but I can also override them as in startup flags as the case with the
logger_path
.seph
02/05/2023, 4:46 PMGilad Reich
02/05/2023, 4:56 PMosqueryd --help
, from what I understood;
• command line flags (aka startup flags), are passed directly at startup to the osqueryd
executable as arguments or via the --flagfile
• Options are being set via osquery.conf
file
They are split into two sections because they can’t be used interchangeably to keep them separate from each other, right? Meaning that you can’t set command line flags in the osquery.conf
, and same apply that you can’t set options as command line flags.
If so far I’m understanding correctly, then I was able to set some options as command line flags whilst they’re not documented so. As an example the logger_path
option, may be provided directly as command line flag: osqueryd --logger_path my/custom/path
seph
02/05/2023, 5:09 PMGilad Reich
02/05/2023, 5:17 PMSome flags, either because they’re important for startup or because they’re deemed privacy sensitive, cannot be set by the TLS controlled server. But they can just as well be set on the command line.That’s exactly the part that could be documented better per option/flag, since checking the docs I was under the assumption that whatever I see in the options section can’t be provided as startup flags, until I tried out.