zentralopensource / zentral / 32706729750

91%

Build Type

push

github

Committed by np5

Commit Message

osquery: publish audit events from the management views

Osquery was the last large module with no zentral_audit event. Creating, updating
or deleting a configuration, a pack, a query, an automatic table construction, a
file category, an enrollment or a distributed query run from the web console left
no record at all, and no test in the module asserted a single event.

The Zentral Terraform provider manages seven of these objects: the automatic
table constructions, the configurations, the configuration packs, the
enrollments, the file categories, the packs and the queries. They are managed as
code, so the event that matters is the one for a change that did not come from
the Terraform configuration.

Runs are the exception: the provider does not manage them, and they are audited
for a different reason. A run executes operator SQL on the machines.

Twenty-four views move to the CreateViewWithAudit / UpdateViewWithAudit /
DeleteViewWithAudit bases. The two enrollment views that drive two forms or
implement post() themselves cannot, and call post_audit_event(). The pack upload
keeps the osquery_pack_update events for now, because it goes through
update_or_create_pack, which needs its own change.

"Halt current runs" ended every other active run of the query with a queryset
update: no save, no signal, no instance, and so no event from a view that only
knows its own object. Creating one run stopped three others and the trail
recorded one change. DistributedQuery.objects.halt_for_query() reads the rows
before the update and reports them, so each stopped run gets its own event. The
form receives the request to publish them, like UploadPackForm.

Five models had no serialize_for_event(): the automatic table constructions, the
configurations, the configuration packs, the file categories and the distributed
queries. AuditEvent.build() calls it with no fallback, so they come first. The
enrollments, the configuration packs and the runs also declare their linked
ob... (continued)

Coverage Stats

96 of 96 new or added lines in 9 files covered. (100.0%)

23 existing lines in 2 files now uncovered.

51203 of 56862 relevant lines covered (90.05%)

0.9 hits per line