osquery icon indicating copy to clipboard operation
osquery copied to clipboard

Update linux block_device and disk_encryption source data to simple sysfs implementation

Open Micah-Kolide opened this issue 2 years ago • 5 comments

Fixes #8033

Purpose of this PR is to remove Linux's disk_encryption reliance on block_devices. We want a list of all block devices by name and a way to access their parent device, so I walk sysfs for that.

libudev accesses block devices primarily in the same way, but with a lot of other options. Those options aren't utilized in osquery's current implementation. Since we don't use them I figured I could take out libudevs usage in our Linux block_device and disk_encryption table generations.

I've added block_device_enumeration as a fairly simple traversal of sysfs to access all of the relevant data we previously were collecting. This should also be easy to add to if other data is desired down the road.

Micah-Kolide avatar Nov 08 '23 17:11 Micah-Kolide

Purpose of this PR is to remove Linux's disk_encryption reliance on block_devices. We want a list of all block devices by name and a way to access their parent device, so I walk sysfs for that.

Would this implementation also allow block_devices to work with query context? It's probably worth moving to a helper function and letting both table's generate methods call it.

directionless avatar Nov 09 '23 13:11 directionless

Purpose of this PR is to remove Linux's disk_encryption reliance on block_devices. We want a list of all block devices by name and a way to access their parent device, so I walk sysfs for that.

Would this implementation also allow block_devices to work with query context? It's probably worth moving to a helper function and letting both table's generate methods call it.

I could definitely look at making that possible.

Micah-Kolide avatar Nov 09 '23 20:11 Micah-Kolide

@Smjert I think you said you could review this PR this week?

directionless avatar Feb 28 '24 20:02 directionless

@Smjert I think you said you could review this PR this week?

Yes I began looking into it today but other things got my priority; I'll be able to finish my review by eod tomorrow. I mostly have minor corrections for now.

Smjert avatar Feb 28 '24 20:02 Smjert

While I don't think there are major issues, I'm a bit concerned on the support for the various combinations of distros and disk setups.

Would it be possible to know on which distros and which setups has this been tested on?

Very sorry I have taken a long time to get back to this. I've tested these changes on Ubuntu 22.04, CentOS 7, and openSUSE 15.4. For disk setups I've been mostly testing with the below on my openSUSE device:

NAME                        MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
sda                           8:0    0   10G  0 disk
├─sda1                        8:1    0    2M  0 part
├─sda2                        8:2    0   20M  0 part  /boot/efi
└─sda3                        8:3    0   10G  0 part  /
sdb                           8:16   0   10G  0 disk
├─sdb1                        8:17   0    1M  0 part
├─sdb2                        8:18   0    1G  0 part
└─sdb3                        8:19   0    9G  0 part
  └─cryptlvm                254:4    0    9G  0 crypt
    ├─MyVolGroup-root       254:5    0    8G  0 lvm   /mnt/test_drives/lvm_on_encryption
    └─MyVolGroup-home       254:6    0 1016M  0 lvm   /mnt/test_drives/lvm_on_encryption/home
sdc                           8:32   0   10G  0 disk
├─sdc1                        8:33   0    1M  0 part
└─sdc2                        8:34   0   10G  0 part
  ├─LvmEncrypt-lvmcryptroot 254:0    0    5G  0 lvm
  │ └─lvmcrypt              254:7    0    5G  0 crypt /mnt/test_drives/encryption_on_lvm
  ├─LvmEncrypt-lvmcryptswap 254:1    0    1G  0 lvm
  ├─LvmEncrypt-lvmcrypttmp  254:2    0    1G  0 lvm
  └─LvmEncrypt-lvmcrypthome 254:3    0    3G  0 lvm   /mnt/test_drives/encryption_on_lvm/home
sdd                           8:48   0   10G  0 disk
├─sdd1                        8:49   0    1M  0 part
├─sdd2                        8:50   0    1G  0 part
├─sdd3                        8:51   0    5G  0 part
│ └─cryptsetuproot          254:8    0    5G  0 crypt /mnt/test_drives/full_encryption_split_root_home
└─sdd4                        8:52   0    4G  0 part
  └─cryptsetuphome          254:9    0    4G  0 crypt /mnt/test_drives/full_encryption_split_root_home/home

Micah-Kolide avatar Jul 05 '24 19:07 Micah-Kolide