Conversation
mostlikelee
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #39749 +/- ##
========================================
Coverage 66.26% 66.26%
========================================
Files 2438 2439 +1
Lines 195266 195348 +82
Branches 8540 8643 +103
========================================
+ Hits 129386 129445 +59
- Misses 54166 54181 +15
- Partials 11714 11722 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
mostlikelee
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
| if s != nil && s.Source == "rpm_packages" && s.Name == rpmKernelName && s.Release != "" { | ||
| s.Version = fmt.Sprintf("%s-%s", s.Version, s.Release) | ||
| s.Release = "" // Clear release to avoid issues with vulnerability matching |
There was a problem hiding this comment.
Not technically part of scope, but found that we were displaying a truncated version of the full kernel version in the API/UI:
5.14 -> 5.14.0-611.5.1.el9_7
Resolved in version shows the later, so it's easy to see the diff
| // For kernel-only platforms (e.g., RHEL), we only scan kernel packages via goval-dictionary. | ||
| // Non-kernel packages are scanned via regular OVAL processing. This keeps the testing | ||
| // surface smaller. We can consider expanding scope to all packages in the future if needed. | ||
| kernelsOnly := platform.IsGovalDictionaryKernelOnly() |
There was a problem hiding this comment.
To reiterate the comment, I scoped use of goval to kernel vulns only so we can keep the scope down. testing all RHEL vulns would be a bigger effort.
mostlikelee
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
WalkthroughThis PR introduces kernel vulnerability scanning capability for RHEL-based hosts. It adds a KernelsOnly filter to VulnSoftwareFilter that restricts vulnerability detection to kernel packages, updates database queries to apply this filter when needed, extends the OVAL platform configuration to identify RHEL as kernel-only platforms for goval-dictionary scanning, and modifies software ingestion logic to format RPM kernel version strings appropriately. The changes enable Fleet to detect vulnerabilities in Linux kernels on RHEL, CentOS, and Fedora systems. Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx`:
- Line 122: Update the tooltip text in the OSTableConfig component to explicitly
include Amazon Linux; change the sentence that currently reads "for Ubuntu,
Debian, and RHEL based systems." to mention "Ubuntu, Debian, Amazon Linux, and
RHEL based systems" so Amazon Linux users are clearly covered (locate the
tooltip string in the OSTableConfig React component).
🧹 Nitpick comments (2)
server/vulnerabilities/oval/oval_platform.go (1)
23-39: RHEL platforms are duplicated across three lists.
rhel_07,rhel_08,rhel_09appear inSupportedGovalPlatforms,GovalKernelOnlyPlatforms, and theIsSupported()method's local list. Consider deriving one from the other to reduce the risk of them drifting out of sync when new RHEL versions are added.server/service/osquery_utils/queries.go (1)
2278-2284: CombinedVersion-Releasecould theoretically exceed column width.After
SoftwareFromOsqueryRowtruncatesVersionto 255 chars andReleaseto 64 chars, this mutation concatenates them as"Version-Release", yielding up to 320 chars — exceeding theSoftwareVersionMaxLength(255) DB column. In practice kernel versions are short, but a defensive truncation would prevent a future DB error.🛡️ Optional defensive truncation
if s != nil && s.Source == "rpm_packages" && s.Name == rpmKernelName && s.Release != "" { s.Version = fmt.Sprintf("%s-%s", s.Version, s.Release) + if len(s.Version) > SoftwareVersionMaxLength { + s.Version = s.Version[:SoftwareVersionMaxLength] + } s.Release = "" // Clear release to avoid issues with vulnerability matching }Note:
SoftwareVersionMaxLengthwould need to be referenced from thefleetpackage (e.g.,fleet.SoftwareVersionMaxLength).
| <> | ||
| Vulnerabilities on Linux are currently supported <br /> | ||
| for Ubuntu, Debian, and Amazon Linux. | ||
| for Ubuntu, Debian, and RHEL based systems. |
There was a problem hiding this comment.
Tooltip no longer mentions Amazon Linux — is that intentional?
The previous text listed "Ubuntu, Debian, and Amazon Linux." The new text says "RHEL based systems" which doesn't clearly cover Amazon Linux (Amazon Linux isn't RHEL-based). Users with Amazon Linux hosts may wonder if vulnerability scanning is supported for them.
Consider: "for Ubuntu, Debian, Amazon Linux, and RHEL based systems."
🤖 Prompt for AI Agents
In `@frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx` at
line 122, Update the tooltip text in the OSTableConfig component to explicitly
include Amazon Linux; change the sentence that currently reads "for Ubuntu,
Debian, and RHEL based systems." to mention "Ubuntu, Debian, Amazon Linux, and
RHEL based systems" so Amazon Linux users are clearly covered (locate the
tooltip string in the OSTableConfig React component).
There was a problem hiding this comment.
lmk if this is good to go as is and I can approve
There was a problem hiding this comment.
@RachelElysia thx yeah this is good, Amazon is a rhel based system
3 participants
Related issue: Resolves #33990
This change will use the RHEL goval-dictionary sqlite to detect kernel vulnerabilities on RHEL based systems.
Checklist for submitter
Dependencies:
fleetdm/vulnerabilities#28
If some of the following don't apply, delete the relevant line.
Changes file added for user-visible changes in
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Input data is properly validated,
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)Testing
Added/updated automated tests
QA'd all new/changed functionality manually
Summary by CodeRabbit
New Features
Documentation