Add screenlock table

cmd/launcher.ext/launcher-extension.go

@@ -53,7 +53,7 @@ func main() {
 	}
 
 	var plugins []osquery.OsqueryPlugin
-	for _, tablePlugin := range table.PlatformTables(client, logger) {
+	for _, tablePlugin := range table.PlatformTables(client, logger, "osqueryd") {
 		plugins = append(plugins, tablePlugin)
 	}
 	server.RegisterPlugin(plugins...)

pkg/osquery/runtime/runtime.go

@@ -670,7 +670,7 @@ func (r *Runner) launchOsqueryInstance() error {
 	}
 
 	plugins := o.opts.extensionPlugins
-	for _, t := range table.PlatformTables(o.extensionManagerClient, o.logger) {
+	for _, t := range table.PlatformTables(o.extensionManagerClient, o.logger, currentOsquerydBinaryPath) {
 		plugins = append(plugins, t)
 	}
 	o.extensionManagerServer.RegisterPlugin(plugins...)

pkg/osquery/table/platform_tables.go

@@ -10,6 +10,6 @@ import (
 
 // platformTables returns an empty set. It's here as a catchall for
 // unimplemented platforms.
-func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin {
+func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger, currentOsquerydBinaryPath string) []*table.Plugin {
 	return []*table.Plugin{}
 }

pkg/osquery/table/platform_tables_darwin.go

@@ -8,13 +8,14 @@ import (
 	"github.com/knightsc/system_policy/osquery/table/legacyexec"
 	"github.com/kolide/launcher/pkg/osquery/tables/dataflattentable"
 	"github.com/kolide/launcher/pkg/osquery/tables/munki"
+	"github.com/kolide/launcher/pkg/osquery/tables/screenlock"
 	"github.com/kolide/launcher/pkg/osquery/tables/systemprofiler"
 	osquery "github.com/kolide/osquery-go"
 	"github.com/kolide/osquery-go/plugin/table"
 	_ "github.com/mattn/go-sqlite3"
 )
 
-func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin {
+func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger, currentOsquerydBinaryPath string) []*table.Plugin {
 	munki := munki.New()
 
 	return []*table.Plugin{
@@ -38,6 +39,7 @@ func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger) [
 			"kolide_pwpolicy", dataflattentable.PlistType, []string{"/usr/bin/pwpolicy", "getaccountpolicies"}),
 		dataflattentable.TablePluginExec(client, logger,
 			"kolide_apfs_users", dataflattentable.PlistType, []string{"/usr/sbin/diskutil", "apfs", "listUsers", "/", "-plist"}),
+		screenlock.TablePlugin(client, logger, currentOsquerydBinaryPath),
 		systemprofiler.TablePlugin(client, logger),
 		munki.ManagedInstalls(client, logger),
 		munki.MunkiReport(client, logger),

pkg/osquery/table/platform_tables_windows.go

@@ -10,7 +10,7 @@ import (
 	"github.com/kolide/osquery-go/plugin/table"
 )
 
-func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin {
+func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger, currentOsquerydBinaryPath string) []*table.Plugin {
 	return []*table.Plugin{
 		ProgramIcons(),
 		wmitable.TablePlugin(client, logger),

pkg/osquery/table/table.go

@@ -21,7 +21,7 @@ func LauncherTables(db *bolt.DB, opts *launcher.Options) []osquery.OsqueryPlugin
 }
 
 // PlatformTables returns all tables for the launcher build platform.
-func PlatformTables(client *osquery.ExtensionManagerClient, logger log.Logger) []*table.Plugin {
+func PlatformTables(client *osquery.ExtensionManagerClient, logger log.Logger, currentOsquerydBinaryPath string) []*table.Plugin {
 	// Common tables to all platforms
 	tables := []*table.Plugin{
 		BestPractices(client),
@@ -38,7 +38,7 @@ func PlatformTables(client *osquery.ExtensionManagerClient, logger log.Logger) [
 	}
 
 	// add in the platform specific ones (as denboted by build tags)
-	tables = append(tables, platformTables(client, logger)...)
+	tables = append(tables, platformTables(client, logger, currentOsquerydBinaryPath)...)
 
 	return tables
 }

pkg/osquery/tables/screenlock/screenlock.go

@@ -0,0 +1,155 @@
+// +build darwin
+
+// Screenlock calls out to osquery to get the screenlock status.
+//
+// While this could be implemented as a
+// `dataflattentable.TablePluginExec` table, instead we have a
+// dedicated table. This allows us to have a consistent set of
+// columns, and change the implementation as desired. It's also
+// simpler to add the `launchctl` functionality.
+//
+// Getting User Information
+//
+// This table uses undocumented APIs, There is some discussion at the
+// PR adding the table. See
+// https://github.com/osquery/osquery/pull/6243
+//
+// Empirically, it only works when run in the specific user
+// context. Furthermore, setting the effective uid (as sudo might) is
+// in adequate. Intead, we need to use `launchctl asuser`.
+//
+// Resulting data is odd. If a user is logged in, even inactive,
+// correct data is returned. If a user has not ever configured these
+// settings, the default values are returned. If the user has
+// configured these settings, _and_ the user is not logged in, no data
+// is returned.
+
+package screenlock
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"os/user"
+	"strings"
+	"time"
+
+	"github.com/go-kit/kit/log"
+	"github.com/go-kit/kit/log/level"
+	"github.com/kolide/osquery-go"
+	"github.com/kolide/osquery-go/plugin/table"
+	"github.com/pkg/errors"
+)
+
+type Table struct {
+	client   *osquery.ExtensionManagerClient
+	logger   log.Logger
+	osqueryd string
+}
+
+func TablePlugin(client *osquery.ExtensionManagerClient, logger log.Logger, osqueryd string) *table.Plugin {
+
+	columns := []table.ColumnDefinition{
+		table.IntegerColumn("enabled"),
+		table.IntegerColumn("grace_period"),
+
+		table.TextColumn("user"),
+	}
+
+	t := &Table{
+		client:   client,
+		logger:   logger,
+		osqueryd: osqueryd,
+	}
+
+	return table.NewPlugin("kolide_screenlock", columns, t.generate)
+
+}
+
+func (t *Table) generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
+	var results []map[string]string
+
+	userQ, ok := queryContext.Constraints["user"]
+	if !ok || len(userQ.Constraints) == 0 {
+		return nil, errors.New("The kolide_screenlock table requires a user")
+	}
+
+	for _, userConstraint := range userQ.Constraints {
+		user := userConstraint.Expression
+
+		osqueryResults, err := t.osqueryScreenlock(ctx, user)
+		if err != nil {
+			continue
+		}
+
+		for _, row := range osqueryResults {
+			row["user"] = userConstraint.Expression
+			results = append(results, row)
+		}
+	}
+	return results, nil
+}
+
+func (t *Table) osqueryScreenlock(ctx context.Context, username string) ([]map[string]string, error) {
+
+	targetUser, err := user.Lookup(username)
+	if err != nil {
+		return nil, errors.Wrapf(err, "looking up username %s", username)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx,
+		"launchctl",
+		"asuser",
+		targetUser.Uid,
+		t.osqueryd,
+		"--config_path", "/dev/null",
+		"-S",
+		"--json",
+		"select enabled, grace_period from screenlock",
+	)
+
+	dir, err := ioutil.TempDir("", "osq-screenlock")
+	if err != nil {
+		return nil, errors.Wrap(err, "mktemp")
+	}
+	defer os.RemoveAll(dir)
+
+	if err := os.Chmod(dir, 0755); err != nil {
+		return nil, errors.Wrap(err, "chmod")
+	}
+
+	cmd.Dir = dir
+
+	stdout, stderr := new(bytes.Buffer), new(bytes.Buffer)
+	cmd.Stdout, cmd.Stderr = stdout, stderr
+
+	if err := cmd.Run(); err != nil {
+		level.Info(t.logger).Log(
+			"msg", "Error getting screenlock status",
+			"stderr", strings.TrimSpace(stderr.String()),
+			"stdout", strings.TrimSpace(stdout.String()),
+			"err", err,
+		)
+		return nil, errors.Wrap(err, "running osquery")
+	}
+
+	var osqueryResults []map[string]string
+
+	if err := json.Unmarshal([]byte(stdout.Bytes()), &osqueryResults); err != nil {
+		level.Info(t.logger).Log(
+			"msg", "error unmarshalling json",
+			"err", err,
+			"stdout", stdout,
+		)
+		return nil, errors.Wrap(err, "unmarshalling json")
+	}
+
+	return osqueryResults, nil
+
+}