Linux disk encryption :: Update standard-query-library.yml

[mikermcneil]

Credit: @jbilling

[mikermcneil]

TODO: needs some testing

@spokanemac @nonpunctual anything we could test this one out on in the realm of eating our own dogfood?

[spokanemac]

@spokanemac @nonpunctual anything we could test this one out on in the realm of eating our own dogfood?

@mikermcneil Issue created to dogfood after MacSysAdmin Conference.

[mikermcneil]

JD: Issue created to dogfood after MacSysAdmin Conference.

@lukeheath @spokanemac Who should cover this so we can get the PR merged or changed quickly?

[rachaelshaw]

@mikermcneil @lukeheath @spokanemac I made a PR to the GitOps folder to test out the change: #22516
(Will leave it to you to verify it's working as expected.)

[lukeheath]

@zayhanlon Can anyone on CS help us test this out while JD and Brock are traveling? I merged Rachael's PR so it's in dogfood for testing.

[zayhanlon]

@ddribeiro can you take this one tomorrow?

[ddribeiro]

I was able to get an Ubuntu VM set up with disk encryption enabled. I ran the updated query as a policy on my host and it passed.

My Ubuntu VM without disk encryption enabled failed the policy.

cc: @mikermcneil @lukeheath @zayhanlon

[lukeheath]

@rachaelshaw @noahtalerman Since this is a doc change I'll wait for y'all or Mike to merge, but this has cleared QA thanks to @ddribeiro.

[noahtalerman]

Nice!

FYI looks like this new query is the one Fleet uses for the disk encryption host vital on Linux: https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Understanding-host-vitals.md#disk_encryption_linux