-
Notifications
You must be signed in to change notification settings - Fork 99
/
onepassword_config.go
130 lines (114 loc) · 3.7 KB
/
onepassword_config.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
package table
import (
"context"
"database/sql"
"io/ioutil"
"os"
"path/filepath"
"runtime"
"github.com/go-kit/kit/log"
"github.com/go-kit/kit/log/level"
"github.com/pkg/errors"
"github.com/kolide/kit/fs"
"github.com/kolide/osquery-go"
"github.com/kolide/osquery-go/plugin/table"
)
var onepasswordDataFiles = map[string][]string{
"windows": []string{"AppData/Local/1password/data/1Password10.sqlite"},
"darwin": []string{
"Library/Application Support/1Password 4/Data/B5.sqlite",
"Library/Group Containers/2BUA8C4S2C.com.agilebits/Library/Application Support/1Password/Data/B5.sqlite",
"Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-helper/Data/Library/Data/B5.sqlite",
},
}
func OnePasswordAccounts(client *osquery.ExtensionManagerClient, logger log.Logger) *table.Plugin {
columns := []table.ColumnDefinition{
table.TextColumn("username"),
table.TextColumn("user_email"),
table.TextColumn("team_name"),
table.TextColumn("server"),
table.TextColumn("user_first_name"),
table.TextColumn("user_last_name"),
table.TextColumn("account_type"),
}
o := &onePasswordAccountsTable{
client: client,
logger: logger,
}
return table.NewPlugin("kolide_onepassword_accounts", columns, o.generate)
}
type onePasswordAccountsTable struct {
client *osquery.ExtensionManagerClient
logger log.Logger
}
// generate the onepassword account info results given the path to a
// onepassword sqlite DB
func (o *onePasswordAccountsTable) generateForPath(ctx context.Context, fileInfo userFileInfo) ([]map[string]string, error) {
dir, err := ioutil.TempDir("", "kolide_onepassword_accounts")
if err != nil {
return nil, errors.Wrap(err, "creating kolide_onepassword_accounts tmp dir")
}
defer os.RemoveAll(dir) // clean up
dst := filepath.Join(dir, "tmpfile")
if err := fs.CopyFile(fileInfo.path, dst); err != nil {
return nil, errors.Wrap(err, "copying sqlite db to tmp dir")
}
db, err := sql.Open("sqlite3", dst)
if err != nil {
return nil, errors.Wrap(err, "connecting to sqlite db")
}
defer db.Close()
rows, err := db.Query("SELECT user_email, team_name, server, user_first_name, user_last_name, account_type FROM accounts")
if err != nil {
return nil, errors.Wrap(err, "query rows from onepassword account configuration db")
}
defer rows.Close()
var results []map[string]string
for rows.Next() {
var email, team, server, firstName, lastName, accountType string
if err := rows.Scan(&email, &team, &server, &firstName, &lastName, &accountType); err != nil {
return nil, errors.Wrap(err, "scanning onepassword account configuration db row")
}
results = append(results, map[string]string{
"user_email": email,
"username": fileInfo.user,
"team_name": team,
"server": server,
"user_first_name": firstName,
"user_last_name": lastName,
"account_type": accountType,
})
}
return results, nil
}
func (o *onePasswordAccountsTable) generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
var results []map[string]string
osDataFiles, ok := onepasswordDataFiles[runtime.GOOS]
if !ok {
return results, errors.New("No onepasswordDataFiles for this platform")
}
for _, dataFilePath := range osDataFiles {
files, err := findFileInUserDirs(dataFilePath, o.logger)
if err != nil {
level.Info(o.logger).Log(
"msg", "Find 1password sqlite DBs",
"path", dataFilePath,
"err", err,
)
continue
}
for _, file := range files {
res, err := o.generateForPath(ctx, file)
if err != nil {
level.Info(o.logger).Log(
"msg", "Generating onepassword result",
"path", file.path,
"err", err,
)
continue
}
results = append(results, res...)
}
}
return results, nil
}