o

�N�g�c�@s*dZd
dl
Z
d
dlZd
dlZd
dlZe
�e�
Zdddd�Z	dZ
dd	�Zd
d�Zd�d
d�
Z
d�dd�
Zdd�Zd�dd�
Zd�dd�
Zd�dd�
Zd�dd�
Zd�dd�
Zd�dd�
Zd�dd �
Zd�d!d"�
Zd�d#d$�
Zd�d%d&�
Zd�d'd(�
Zd�d)d*�
Zd�d+d,�
Zd�d-d.�
Zd�d/d0�
Zd�d1d2�
Zd�d3d4�
Z d�d5d6�
Z!d�d7d8�
Z"d�d9d:�
Z#d�d;d<�
Z$d�d=d>�
Z%d�d?d@�
Z&d�dAdB�
Z'd�dCdD�
Z(d�dEdF�
Z)d�dGdH�
Z*d�dIdJ�
Z+d�dKdL�
Z,d�dMdN�
Z-d�dOdP�
Z.d�dQdR�
Z/d�dSdT�
Z0d�dUdV�
Z1d�dWdX�
Z2d�dYdZ�
Z3d�d[d\�
Z4d�d]d^�
Z5d�d_d`�
Z6d�dadb�
Z7d�dcdd�
Z8d�dedf�
Z9d�dgdh�
Z:d�didj�
Z;d�dkdl�
Z<d�dmdn�
Z=d�dodp�
Z>d�dqdr�
Z?d�dsdt�
Z@d�dudv�
ZAd�dwdx�
ZBd�dydz�
ZCd�d{d|�
ZDd�d}d~�
ZEd�dd��
ZFd�d�d��
ZGd�d�d��
ZHd�d�d��
ZId�d�d��
ZJd�d�d��
ZKd�d�d��
ZLd�d�d��
ZMd�d�d��
ZNd�d�d��
ZOd�d�d��
ZPd�d�d��
ZQd�d�d��
ZRd�d�d��
ZSd�d�d��
ZTd�d�d��
ZUdS)�zG
Support for OSQuery - https://osquery.io.

.. versionadded:: 2015.8.0
�N�file�hash�time)�file_�hash_�time_ZosquerycCstj
j�d
�
r	tSdS)N�osqueryi)FzRThe osquery execution module cannot be loaded: osqueryi binary is not in the path.)�salt�utils�path�which�__virtualname__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/osquery.py�__virtual__s


rc
Cshd
g
dg
d|�d�g
}
td|
�
}|ddkr2g}t
jj�|d�
}|D]	}|�|d	�

q&|Sd
S)z8
    Helper function to find valid table attributes
    r�--jsonzpragma table_info(�
)�cmd.run_all�retcoder
�stdout�nameF)�__salt__r	r
�json�loads�append)�table�cmd�res�attrs�text�itemrrr�_table_attrs#s







r!rcCsjd
di
}dg
dg
|g
}td|�
}|dr"d|d
<|d|d<nt
jj�|d	�
|d
<t�d|�
|S)z4
    Helper function to run raw osquery queries
    �resultTrrr�stderrF�errorr�dataz== %s ==)rr	r
rr�log�debug)�sql�format�retrrrrr�_osquery2s�





r+c
Cs�d
di
}|
rIt|
t
�r?t|�
}|r1|
D]}||v
r*d|d
<|�d|��|d<|
Sqd�|
�
}nd|d
<d|�d�|d<|Sd	|d<d|d
<|Sd
}d|�d|��}|r\|�d
|��}|�d�}t|�
}	|	d
rq|	d|d<|S|	d|d<|S)z0
    Helper function to run osquery queries
    r"TFz$ is not a valid attribute for table �comment�
,zInvalid table �
.z"attrs must be specified as a list.�
*zselect z from z where �
;r%r$)�
isinstance�listr!�joinr+)
rr�wherer)r*Zvalid_attrs�
aZ_attrsr(rrrr�_osquery_cmdEs>�






��







�
r6cCsZd
dd�}tddg
d�}
d|
vr+|
dr+d|
vr+t
|
dt�r+|
dd	�dd
�p*|S|S)zq
    Return version of osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.version
    FzOSQuery version unavailable.�r"r,�osquery_info�version�rrr"r%r
�)r6r1r2�get)Z
_false_returnrrrrr9ss






r9cC�$td
dkr
t
d||
d�Sddd�S)z�
    Return cpuid information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.rpm_packages
    �	os_family�RedHat�rpm_packages�rrr4Fz(Only available on Red Hat based systems.r7�Z
__grains__r6�rr4rrrr@��



r@cC�$td
dvr
t
d||
d�Sddd�S)z�
    Return kernel_integrity information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_integrity
    r>�r?�Debian�kernel_integrityrAF�2Only available on Red Hat or Debian based systems.r7rBrCrrrrH��



�rHcCrE)z�
    Return kernel_modules information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_modules
    r>rF�kernel_modulesrAFrIr7rBrCrrrrK�rJrKcCrE)z�
    Return memory_map information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.memory_map
    r>rF�
memory_maprAFrIr7rBrCrrrrL�rJrLcCrE)z�
    Return process_memory_map information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_memory_map
    r>rF�process_memory_maprAFrIr7rBrCrrrrM�rJrMcCrE)z�
    Return shared_memory information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.shared_memory
    r>rF�
shared_memoryrAFrIr7rBrCrrrrN�rJrNcCr=)z�
    Return apt_sources information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.apt_sources
    r>rG�apt_sourcesrAF�'Only available on Debian based systems.r7rBrCrrrrO�rDrOcCr=)z�
    Return deb_packages information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.deb_packages
    r>rG�deb_packagesrAFrPr7rBrCrrrrQ�rDrQcC�td
||
d�S)z�
    Return acpi_tables information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.acpi_tables
    �acpi_tablesrA�
r6rCrrrrS
�
rScCrR)z�
    Return arp_cache information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.arp_cache
    �	arp_cacherArTrCrrrrV
rUrVcCrR)z�
    Return block_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.block_devices
    �
block_devicesrArTrCrrrrW&
rUrWcCrR)z{
    Return cpuid information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.cpuid
    �cpuidrArTrCrrrrX3
rUrXcCrR)z
    Return crontab information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.crontab
    �crontabrArTrCrrrrY@
rUrYcCrR)z�
    Return etc_hosts information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.etc_hosts
    �	etc_hostsrArTrCrrrrZM
rUrZcCrR)z�
    Return etc_services information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.etc_services
    �etc_servicesrArTrCrrrr[Z
rUr[cCrR)z�
    Return file_changes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.file_changes
    �file_changesrArTrCrrrr\g
rUr\cCrR)z}
    Return groups information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.groups
    �groupsrArTrCrrrr]t
rUr]cCrR)z�
    Return hardware_events information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.hardware_events
    �hardware_eventsrArTrCrrrr^�
rUr^cCrR)z�
    Return interface_addresses information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.interface_addresses
    �interface_addressesrArTrCrrrr_�
rUr_cCrR)z�
    Return interface_details information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.interface_details
    �interface_detailsrArTrCrrrr`�
rUr`cCrR)z�
    Return kernel_info information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_info
    �kernel_inforArTrCrrrra�
rUracCrR)zy
    Return last information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.last
    �lastrArTrCrrrrb�
rUrbcCrR)z�
    Return listening_ports information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.listening_ports
    �listening_portsrArTrCrrrrc�
rUrccCrR)z�
    Return logged_in_users information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.logged_in_users
    �logged_in_usersrArTrCrrrrd�
rUrdcCrR)z}
    Return mounts information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.mounts
    �mountsrArTrCrrrre�
rUrecCrR)z�
    Return os_version information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.os_version
    �
os_versionrArTrCrrrrf�
rUrfcCrR)z�
    Return passwd_changes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.passwd_changes
    �passwd_changesrArTrCrrrrg�
rUrgcCrR)z�
    Return pci_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.pci_devices
    �pci_devicesrArTrCrrrrhrUrhcCrR)z�
    Return process_envs information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_envs
    �process_envsrArTrCrrrrirUricCrR)z�
    Return process_open_files information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_open_files
    �process_open_filesrArTrCrrrrjrUrjcCrR)z�
    Return process_open_sockets information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.process_open_sockets
    �process_open_socketsrArTrCrrrrk*rUrkcCrR)z�
    Return processes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.processes
    �	processesrArTrCrrrrl7rUrlcCrR)z}
    Return routes information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.routes
    �routesrArTrCrrrrmDrUrmcCrR)z�
    Return shell_history information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.shell_history
    �
shell_historyrArTrCrrrrnQrUrncCrR)z�
    Return smbios_tables information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.smbios_tables
    �
smbios_tablesrArTrCrrrro^rUrocCrR)z�
    Return suid_bin information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.suid_bin
    �suid_binrArTrCrrrrpkrUrpcCrR)z�
    Return system_controls information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.system_controls
    �system_controlsrArTrCrrrrqxrUrqcCrR)z�
    Return usb_devices information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.usb_devices
    �usb_devicesrArTrCrrrrr�rUrrcCrR)z{
    Return users information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.users
    �usersrArTrCrrrrs�rUrscC�$tj
j��r
td
||
d�Sddd�S)zw
    Return alf information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf
    �alfrAF� Only available on macOS systems.r7�r	r
�platformZ	is_darwinr6rCrrrru�rDrucCrt)z�
    Return alf_exceptions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_exceptions
    �alf_exceptionsrAFrvr7rwrCrrrry�rDrycCrt)z�
    Return alf_explicit_auths information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_explicit_auths
    �alf_explicit_authsrAFrvr7rwrCrrrrz�rDrzcCrt)z�
    Return alf_services information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.alf_services
    �alf_servicesrAFrvr7rwrCrrrr{�rDr{cCrt)zy
    Return apps information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.apps
    �appsrAFrvr7rwrCrrrr|�rDr|cCrt)z�
    Return certificates information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.certificates
    �certificatesrAFrvr7rwrCrrrr}�rDr}cCrt)z�
    Return chrome_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.chrome_extensions
    �chrome_extensionsrAFrvr7rwrCrrrr~�rDr~cCrt)z�
    Return firefox_addons information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.firefox_addons
    �firefox_addonsrAFrvr7rwrCrrrrrDrcCrt)z�
    Return homebrew_packages information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.homebrew_packages
    �homebrew_packagesrAFrvr7rwrCrrrr�rDr�cCrt)z�
    Return iokit_devicetree information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.iokit_devicetree
    �iokit_devicetreerAFrvr7rwrCrrrr�&rDr�cCrt)z�
    Return iokit_registry information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.iokit_registry
    �iokit_registryrAFrvr7rwrCrrrr�5rDr�cCrt)z�
    Return kernel_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.kernel_extensions
    �kernel_extensionsrAFrvr7rwrCrrrr�DrDr�cCrt)z�
    Return keychain_items information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.keychain_items
    �keychain_itemsrAFrvr7rwrCrrrr�SrDr�cCrt)z
    Return launchd information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.launchd
    �launchdrAFrvr7rwrCrrrr�brDr�cCrt)z�
    Return nfs_shares information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.nfs_shares
    �
nfs_sharesrAFrvr7rwrCrrrr�qrDr�cCrt)z{
    Return nvram information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.nvram
    �nvramrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return preferences information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.preferences
    �preferencesrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return quarantine information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.quarantine
    �
quarantinerAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return safari_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.safari_extensions
    �safari_extensionsrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return startup_items information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.startup_items
    �
startup_itemsrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return xattr_where_from information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xattr_where_from
    �xattr_where_fromrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return xprotect_entries information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xprotect_entries
    �xprotect_entriesrAFrvr7rwrCrrrr��rDr�cCrt)z�
    Return xprotect_reports information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.xprotect_reports
    �xprotect_reportsrAFrvr7rwrCrrrr��rDr�cCrR)zy
    Return file information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.file
    rrArTrCrrrr�rUrcCrR)zy
    Return hash information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.hash
    rrArTrCrrrrrUrcCrR)z�
    Return osquery_extensions information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_extensions
    �osquery_extensionsrArTrCrrrr�rUr�cCrR)z�
    Return osquery_flags information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_flags
    �
osquery_flagsrArTrCrrrr�rUr�cCrR)z�
    Return osquery_info information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_info
    r8rArTrCrrrr8,rUr8cCrR)z�
    Return osquery_registry information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.osquery_registry
    �osquery_registryrArTrCrrrr�9rUr�c

Cstd
|d�S)zy
    Return time information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.time
    rr:rT)
rrrrrFs
rc

Cst|�
S)
z�
    Return time information from osquery

    CLI Example:

    .. code-block:: bash

        salt '*' osquery.query "select * from users;"
    )
r+)
r(rrr�querySs
r�)
r)NNr)NN)
N)V�__doc__�loggingZsalt.utils.jsonr	Zsalt.utils.pathZsalt.utils.platform�	getLogger�__name__r&Z__func_alias__r
rr!r+r6r9r@rHrKrLrMrNrOrQrSrVrWrXrYrZr[r\r]r^r_r`rarbrcrdrerfrgrhrirjrkrlrmrnrorprqrrrsruryrzr{r|r}r~rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrr�r�r8r�rr�rrrr�<module>
s�




�


.