Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquerybeat: Disable allow_unsafe osquery configuration #40130

Merged
merged 5 commits into from
Jul 9, 2024

Conversation

aleksmaus
Copy link
Member

Proposed commit message

Osquerybeat: Disable allow_unsafe osquery configuration

The allow_unsafe flag was used for windows only since Oct 21, 2021.

This addresses the issue reported in:
https://github.com/elastic/security/issues/2194

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

If any of the existing users used their custom extensions since 2021 without proper permissions set (the osquerybeat was careful to preserve modifications to the autoload file in order to allow these use cases)
https://osquery.readthedocs.io/en/stable/deployment/extensions/#extensions-binary-permissions

then these extensions will fail to load.

How to test this PR locally

Install the Agent with osquery manager integration in the policy. Make sure the extension loads.

Related issues

@aleksmaus aleksmaus added bug backport-skip Skip notification from the automated backport with mergify labels Jul 5, 2024
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 5, 2024
@aleksmaus aleksmaus requested a review from a team as a code owner July 5, 2024 19:27
@aleksmaus aleksmaus added the Team:Security-Deployment and Devices Deployment and Devices Team in Security Solution label Jul 5, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 5, 2024
Copy link
Contributor

@pkoutsovasilis pkoutsovasilis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! nit: an entry to the changelog to capture that this change happened

@aleksmaus aleksmaus merged commit fec980b into elastic:main Jul 9, 2024
17 checks passed
@norrietaylor
Copy link
Member

Thanks Aleks!

@aleksmaus aleksmaus added backport-8.x Automated backport to the 8.x branch with mergify backport-8.15 Automated backport to the 8.15 branch with mergify and removed backport-skip Skip notification from the automated backport with mergify labels Oct 15, 2024
mergify bot pushed a commit that referenced this pull request Oct 15, 2024
* Osquerybeat: Disable allow_unsafe osquery configuration

* Make linter happier

* Added changelog

* Make linter happier

(cherry picked from commit fec980b)
@aleksmaus aleksmaus added the backport-7.17 Automated backport to the 7.17 branch with mergify label Oct 15, 2024
mergify bot pushed a commit that referenced this pull request Oct 15, 2024
* Osquerybeat: Disable allow_unsafe osquery configuration

* Make linter happier

* Added changelog

* Make linter happier

(cherry picked from commit fec980b)
aleksmaus added a commit that referenced this pull request Oct 15, 2024
…figuration (#41239)

* Osquerybeat: Disable allow_unsafe osquery configuration (#40130)

* Osquerybeat: Disable allow_unsafe osquery configuration

* Make linter happier

* Added changelog

* Make linter happier

(cherry picked from commit fec980b)

* Fix CHANGELOG.next.asciidoc

---------

Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>
aleksmaus added a commit that referenced this pull request Oct 15, 2024
…figuration (#41238)

* Osquerybeat: Disable allow_unsafe osquery configuration (#40130)

* Osquerybeat: Disable allow_unsafe osquery configuration

* Make linter happier

* Added changelog

* Make linter happier

(cherry picked from commit fec980b)

* Fix CHANGELOG.next.asciidoc

---------

Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-7.17 Automated backport to the 7.17 branch with mergify backport-8.x Automated backport to the 8.x branch with mergify backport-8.15 Automated backport to the 8.15 branch with mergify bug Team:Security-Deployment and Devices Deployment and Devices Team in Security Solution
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants