Limited disk encryption key escrowing when setting enabled#39047
Merged
Limited disk encryption key escrowing when setting enabled#39047
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #39047 +/- ##
========================================
Coverage 66.18% 66.19%
========================================
Files 2423 2424 +1
Lines 194006 194146 +140
Branches 8551 8551
========================================
+ Hits 128400 128506 +106
- Misses 53937 53956 +19
- Partials 11669 11684 +15
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
Author
|
@coderabbitai full review |
Contributor
✅ Actions performedFull review triggered. |
Contributor
WalkthroughThe PR adds guards to prevent disk encryption key archival when disk encryption is not enabled at the team or global level. A new helper function determines if encryption is enabled for a host, with this check applied in multiple key ingestion and archival paths. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@server/service/integration_mdm_test.go`:
- Around line 9476-9490: The loop that counts escrow activities is
order-dependent; modify it to count only activities with activity.ID >
seenEscrowKeyActivityID (treat seenEscrowKeyActivityID as the
lastSeenActivityID) instead of activity.ID != seenEscrowKeyActivityID, collect
those matching activities (Type ==
fleet.ActivityTypeEscrowedDiskEncryptionKey().ActivityName()), assert that
exactly one new activity was found (require.Equal(t, 1, newCount) or
require.Len), unmarshal Details into escrowKeyActivity and
require.True(activity.FleetInitiated) for that single new activity, and update
seenEscrowKeyActivityID to that activity.ID so results are deterministic and not
iteration-order dependent.
🧹 Nitpick comments (1)
server/service/osquery_utils/disk_encryption_helpers.go (1)
13-42: Add a defensive nil-host guard.This helper is public and can panic if a nil host is passed in future call sites. A lightweight guard keeps it safe without changing behavior.
♻️ Suggested patch
func IsDiskEncryptionEnabledForHost(ctx context.Context, logger log.Logger, ds fleet.Datastore, host *fleet.Host) bool { + if host == nil { + return false + } // team if host.TeamID != nil {
Comment on lines
9476
to
9490
| activities = s.listActivities() | ||
| escrowCountFinal := 0 | ||
| escrowKeyActivity = fleet.ActivityTypeEscrowedDiskEncryptionKey{} | ||
| for _, activity := range activities { | ||
| if activity.Type == escrowKeyActivity.ActivityName() && activity.ID != seenEscrowKeyActivityID { | ||
| escrowCountFinal++ | ||
| err := json.Unmarshal(*activity.Details, &escrowKeyActivity) | ||
| require.NoError(t, err) | ||
| require.True(t, activity.FleetInitiated) | ||
|
|
||
| seenEscrowKeyActivityID = activity.ID | ||
| } | ||
| } | ||
| require.Equal(t, escrowCountBefore+1, escrowCountFinal) | ||
| require.NotZero(t, seenEscrowKeyActivityID) |
Contributor
There was a problem hiding this comment.
Count only new escrow activities to avoid order-dependent results.
The current activity.ID != seenEscrowKeyActivityID filter depends on iteration order and can miscount when multiple prior escrow activities exist. Filter by activity.ID > lastSeenActivityID and assert exactly one new activity.
🐛 Make activity counting deterministic
- escrowCountFinal := 0
- escrowKeyActivity = fleet.ActivityTypeEscrowedDiskEncryptionKey{}
+ escrowCountFinal := 0
+ escrowKeyActivity = fleet.ActivityTypeEscrowedDiskEncryptionKey{}
+ lastSeenActivityID := seenEscrowKeyActivityID
for _, activity := range activities {
- if activity.Type == escrowKeyActivity.ActivityName() && activity.ID != seenEscrowKeyActivityID {
+ if activity.Type == escrowKeyActivity.ActivityName() && activity.ID > lastSeenActivityID {
escrowCountFinal++
err := json.Unmarshal(*activity.Details, &escrowKeyActivity)
require.NoError(t, err)
require.True(t, activity.FleetInitiated)
seenEscrowKeyActivityID = activity.ID
}
}
- require.Equal(t, escrowCountBefore+1, escrowCountFinal)
+ require.Equal(t, 1, escrowCountFinal)🤖 Prompt for AI Agents
In `@server/service/integration_mdm_test.go` around lines 9476 - 9490, The loop
that counts escrow activities is order-dependent; modify it to count only
activities with activity.ID > seenEscrowKeyActivityID (treat
seenEscrowKeyActivityID as the lastSeenActivityID) instead of activity.ID !=
seenEscrowKeyActivityID, collect those matching activities (Type ==
fleet.ActivityTypeEscrowedDiskEncryptionKey().ActivityName()), assert that
exactly one new activity was found (require.Equal(t, 1, newCount) or
require.Len), unmarshal Details into escrowKeyActivity and
require.True(activity.FleetInitiated) for that single new activity, and update
seenEscrowKeyActivityID to that activity.ID so results are deterministic and not
iteration-order dependent.
mostlikelee
approved these changes
Feb 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: Resolves #33296
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)Testing
Summary by CodeRabbit
Bug Fixes
Tests
✏️ Tip: You can customize this high-level summary in your review settings.