Fleetctl denylist:false option still doesn't work #338
Labels
bug
Something isn't working as documented
Comments
|
I was able to confirm that the value is persisted properly in Fleet but is not returned to the osquery client. |
zwass
added a commit
to zwass/fleet
that referenced
this issue
Feb 21, 2021
This was previously handled correctly within the Fleet server datastores and API endpoints, but not returned to the actual osquery client. Fixes fleetdm#338
|
My apologies for that. I've now fully end-to-end tested the changes and I think we are good to go. |
zwass
added a commit
that referenced
this issue
Feb 21, 2021
This was previously handled correctly within the Fleet server datastores and API endpoints, but not returned to the actual osquery client. Fixes #338
|
@zwass I confirm that this feature now works fine, thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What version of
fleetare you using (fleet version --full)?fleet - version 3.7.1
branch: master
revision: 413695b
build date: 2021-02-03T19:56:20Z
build user: zwass
go version: go1.15.6
What operating system are you using?
NAME="CentOS Linux"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Linux 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"
CENTOS_MANTISBT_PROJECT="CentOS-8"
CENTOS_MANTISBT_PROJECT_VERSION="8"
If this is a UI issue: What browser are you using?
No
If this is a performance issue: Please attach the debug archive.
Partially
What did you do?
Tried setting
denylist: falsefor my scheduled queries viafleetctlWhat did you expect to see?
Correct working of this option.
I have already done several reports on the problems of the denylist option.
#195
#202
What did you see instead?
I see that
denylist: falseoption can now be added to the query pack settings viafleetctlI also see that there is an additional column in the database for denylist
But at the same time, I see that this option does not come to osquery clients from the Fleet server, and, as a result, does not work.
I ran
osqueryd --flagfile /var/osquery/osquery.flags --verbose --tls_dumpfrom console and got such output:The text was updated successfully, but these errors were encountered: