Skip to content

Commit b019be7

Browse files
Fix example for table and config (osquery#83)
Update the Makefile to handle existing `gen` directory. Update documented examples.
1 parent ff40fc9 commit b019be7

File tree

4 files changed

+62
-34
lines changed

4 files changed

+62
-34
lines changed

Diff for: Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ deps-go: go-mod-check go-mod-download
1414
deps: deps-go
1515

1616
gen: ./osquery.thrift
17-
mkdir ./gen
17+
mkdir -p ./gen
1818
thrift --gen go:package_prefix=github.com/kolide/osquery-go/gen/ -out ./gen ./osquery.thrift
1919
rm -rf gen/osquery/extension-remote gen/osquery/extension_manager-remote
2020
gofmt -w ./gen

Diff for: README.md

+13-10
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,20 @@ import (
3838
"context"
3939
"log"
4040
"os"
41+
"flag"
4142

4243
"github.com/kolide/osquery-go"
4344
"github.com/kolide/osquery-go/plugin/table"
4445
)
4546

4647
func main() {
47-
if len(os.Args) != 2 {
48-
log.Fatalf(`Usage: %s SOCKET_PATH`, os.Args[0])
48+
socket := flag.String("socket", "", "Path to osquery socket file")
49+
flag.Parse()
50+
if *socket == "" {
51+
log.Fatalf(`Usage: %s --socket SOCKET_PATH`, os.Args[0])
4952
}
5053

51-
server, err := osquery.NewExtensionManagerServer("foobar", os.Args[1])
54+
server, err := osquery.NewExtensionManagerServer("foobar", *socket)
5255
if err != nil {
5356
log.Fatalf("Error creating extension: %s\n", err)
5457
}
@@ -88,7 +91,7 @@ func FoobarGenerate(ctx context.Context, queryContext table.QueryContext) ([]map
8891

8992
To test this code, start an osquery shell and find the path of the osquery extension socket:
9093

91-
```
94+
```sql
9295
osqueryi --nodisable_extensions
9396
osquery> select value from osquery_flags where name = 'extensions_socket';
9497
+-----------------------------------+
@@ -100,20 +103,20 @@ osquery> select value from osquery_flags where name = 'extensions_socket';
100103

101104
Then start the Go extension and have it communicate with osqueryi via the extension socket that you retrieved above:
102105

103-
```
104-
go run ./my_table_plugin.go /Users/USERNAME/.osquery/shell.em
106+
```bash
107+
go run ./my_table_plugin.go --socket /Users/USERNAME/.osquery/shell.em
105108
```
106109

107110
Alternatively, you can also autoload your extension when starting an osquery shell:
108111

109-
```
112+
```bash
110113
go build -o my_table_plugin my_table_plugin.go
111114
osqueryi --extension /path/to/my_table_plugin
112115
```
113116

114117
This will register a table called "foobar". As you can see, the table will return two rows:
115118

116-
```
119+
```sql
117120
osquery> select * from foobar;
118121
+-----+-----+
119122
| foo | baz |
@@ -130,7 +133,7 @@ Using the instructions found on the [wiki](https://osquery.readthedocs.io/en/lat
130133

131134
### Creating logger and config plugins
132135

133-
The process required to create a config and/or logger plugin is very similar to the process outlined above for creating an osquery table. Specifically, you would create an `ExtensionManagerServer` instance in `func main()`, register your plugin and launch the extension as described above. The only difference is that the implementation of your plugin would be different. Each plugin package has a `NewPlugin` function which takes the plugin name as the first argument, followed by a list of required arguments to implement the plugin.
136+
The process required to create a config and/or logger plugin is very similar to the process outlined above for creating an osquery table. Specifically, you would create an `ExtensionManagerServer` instance in `func main()`, register your plugin and launch the extension as described above. The only difference is that the implementation of your plugin would be different. Each plugin package has a `NewPlugin` function which takes the plugin name as the first argument, followed by a list of required arguments to implement the plugin.
134137
For example, consider the implementation of an example logger plugin:
135138

136139
```go
@@ -224,7 +227,7 @@ If you write an extension with a logger or config plugin, you'll likely want to
224227
1. Build the plugin. Make sure to add `.ext` as the file extension. It is required by osqueryd.
225228
```go build -o /usr/local/osquery_extensions/my_logger.ext```
226229

227-
2. Set the correct permissions on the file and directory. If `osqueryd` runs as root, the directory for the extension must only be writable by root.
230+
2. Set the correct permissions on the file and directory. If `osqueryd` runs as root, the directory for the extension must only be writable by root.
228231

229232
```
230233
sudo chown -R root /usr/local/osquery_extensions/

Diff for: examples/config/main.go

+24-11
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,41 @@ package main
22

33
import (
44
"context"
5-
"fmt"
5+
"flag"
66
"log"
7-
"os"
7+
"time"
88

99
"github.com/kolide/osquery-go"
1010
"github.com/kolide/osquery-go/plugin/config"
1111
)
1212

13+
var (
14+
socket = flag.String("socket", "", "Path to the extensions UNIX domain socket")
15+
timeout = flag.Int("timeout", 3, "Seconds to wait for autoloaded extensions")
16+
interval = flag.Int("interval", 3, "Seconds delay between connectivity checks")
17+
)
18+
1319
func main() {
14-
if len(os.Args) != 2 {
15-
fmt.Printf(`Usage: %s SOCKET_PATH\n
20+
flag.Parse()
1621

17-
Registers an example config plugin.
22+
if *socket == "" {
23+
log.Fatalln("Missing required --socket argument")
24+
}
1825

19-
Test with an invocation like:
26+
serverTimeout := osquery.ServerTimeout(
27+
time.Second * time.Duration(*timeout),
28+
)
29+
serverPingInterval := osquery.ServerPingInterval(
30+
time.Second * time.Duration(*interval),
31+
)
2032

21-
sudo ./example_call /var/osquery/osquery.em config example_config genConfig
22-
`, os.Args[0])
23-
os.Exit(1)
24-
}
33+
server, err := osquery.NewExtensionManagerServer(
34+
"example_extension",
35+
*socket,
36+
serverTimeout,
37+
serverPingInterval,
38+
)
2539

26-
server, err := osquery.NewExtensionManagerServer("example_extension", os.Args[1])
2740
if err != nil {
2841
log.Fatalf("Error creating extension: %s\n", err)
2942
}

Diff for: examples/table/main.go

+24-12
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,39 @@ package main
22

33
import (
44
"context"
5-
"fmt"
5+
"flag"
66
"log"
7-
"os"
7+
"time"
88

99
"github.com/kolide/osquery-go"
1010
"github.com/kolide/osquery-go/plugin/table"
1111
)
1212

13-
func main() {
14-
if len(os.Args) != 2 {
15-
fmt.Printf(`Usage: %s SOCKET_PATH\n
16-
17-
Registers an example table extension.
13+
var (
14+
socket = flag.String("socket", "", "Path to the extensions UNIX domain socket")
15+
timeout = flag.Int("timeout", 3, "Seconds to wait for autoloaded extensions")
16+
interval = flag.Int("interval", 3, "Seconds delay between connectivity checks")
17+
)
1818

19-
This extension provides the "example_table" table. Try 'SELECT * FROM
20-
example_table' in the osquery process the extension attaches to.
21-
`, os.Args[0])
22-
os.Exit(1)
19+
func main() {
20+
flag.Parse()
21+
if *socket == "" {
22+
log.Fatalln("Missing required --socket argument")
2323
}
24+
serverTimeout := osquery.ServerTimeout(
25+
time.Second * time.Duration(*timeout),
26+
)
27+
serverPingInterval := osquery.ServerPingInterval(
28+
time.Second * time.Duration(*interval),
29+
)
30+
31+
server, err := osquery.NewExtensionManagerServer(
32+
"example_extension",
33+
*socket,
34+
serverTimeout,
35+
serverPingInterval,
36+
)
2437

25-
server, err := osquery.NewExtensionManagerServer("example_extension", os.Args[1])
2638
if err != nil {
2739
log.Fatalf("Error creating extension: %s\n", err)
2840
}

0 commit comments

Comments
 (0)