From 15e24c360450b4622910137eb6d6f07900e460b9 Mon Sep 17 00:00:00 2001
From: Mike Cohen <scudette@users.noreply.github.com>
Date: Sun, 7 May 2023 23:53:22 +1000
Subject: [PATCH] Block collections in locked down servers (#2668)

Some minor changes to GUI
---
 .../Server/Internal/ToolDependencies.yaml     | 24 +++++++++----------
 .../src/components/artifacts/artifacts.css    |  2 ++
 .../src/components/core/paged-table.jsx       |  2 +-
 services/sanity/lockdown.go                   |  3 +++
 vql/tools/collector/collector.go              |  2 +-
 5 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/artifacts/definitions/Server/Internal/ToolDependencies.yaml b/artifacts/definitions/Server/Internal/ToolDependencies.yaml
index 89f22d48610..5210ee5db40 100644
--- a/artifacts/definitions/Server/Internal/ToolDependencies.yaml
+++ b/artifacts/definitions/Server/Internal/ToolDependencies.yaml
@@ -5,31 +5,31 @@ description: |
 
 tools:
   - name: VelociraptorWindows
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-amd64.exe
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-amd64.exe
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindows_x86
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-386.exe
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-386.exe
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorLinux
-    github_project: Velocidex/velociraptor
-    github_asset_regex: linux-amd64-musl
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-linux-amd64-musl
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorDarwin
-    github_project: Velocidex/velociraptor
-    github_asset_regex: darwin-amd64
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-darwin-amd64
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindowsMSI
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-amd64.msi
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-amd64.msi
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindows_x86MSI
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-386.msi
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-386.msi
     serve_locally: true
+    version: 0.6.9-rc1
diff --git a/gui/velociraptor/src/components/artifacts/artifacts.css b/gui/velociraptor/src/components/artifacts/artifacts.css
index 0998b7b90f0..658c84a6d6f 100644
--- a/gui/velociraptor/src/components/artifacts/artifacts.css
+++ b/gui/velociraptor/src/components/artifacts/artifacts.css
@@ -11,6 +11,8 @@
 
 .artifact-search-table button {
     cursor: pointer;
+    width: 100%;
+    text-align: left;
 }
 
 .artifact-search-table button:hover {
diff --git a/gui/velociraptor/src/components/core/paged-table.jsx b/gui/velociraptor/src/components/core/paged-table.jsx
index acb7c5df160..7beb050520d 100644
--- a/gui/velociraptor/src/components/core/paged-table.jsx
+++ b/gui/velociraptor/src/components/core/paged-table.jsx
@@ -430,7 +430,7 @@ class VeloPagedTable extends Component {
                         }}
                       >
                         <FontAwesomeIcon icon="filter"/>
-                        { filter_column == column.text && filter }
+                        { filter_column == column.text && !edit_filter_visible && filter }
                       </Button>
                       { edit_filter_visible &&
                         <Form.Control
diff --git a/services/sanity/lockdown.go b/services/sanity/lockdown.go
index 95f4d2d4dde..947a281537a 100644
--- a/services/sanity/lockdown.go
+++ b/services/sanity/lockdown.go
@@ -19,6 +19,9 @@ func (self SanityChecks) CheckForLockdown(
 	lockdown_token := &acl_proto.ApiClientACL{
 		ArtifactWriter:       true,
 		ServerArtifactWriter: true,
+		CollectClient:        true,
+		CollectServer:        true,
+		StartHunt:            true,
 		Execve:               true,
 		ServerAdmin:          true,
 		FilesystemWrite:      true,
diff --git a/vql/tools/collector/collector.go b/vql/tools/collector/collector.go
index ae8e82d88e3..74286282e43 100644
--- a/vql/tools/collector/collector.go
+++ b/vql/tools/collector/collector.go
@@ -237,7 +237,7 @@ func AddSpecProtobuf(
 		artifact_definitions, pres := repository.Get(ctx, config_obj, name)
 		if !pres {
 			// Artifact not known
-			return fmt.Errorf(`Parameter 'args' refers to an unknown artifact (%v). The 'args' parameter should be of the form {"Custom.Artifact.Name":{"arg":"value"}}`, name)
+			return fmt.Errorf(`Parameter refers to an unknown artifact (%v). The parameter should be of the form {"Custom.Artifact.Name":{"arg":"value"}}`, name)
 		}
 
 		// Check that we are allowed to collect this artifact