Initial commit

.gitignore

@@ -0,0 +1,2 @@
+
+*.pkg

Makefile

@@ -0,0 +1,20 @@
+USE_PKGBUILD=1
+include /usr/local/share/luggage/luggage.make
+PACKAGE_VERSION=0.0.1
+TITLE=sal-osquery-conf
+PACKAGE_NAME=${TITLE}
+REVERSE_DOMAIN=com.github.salopensource
+PAYLOAD=\
+	pack-logging \
+	pack-osquery \
+	pack-Library-LaunchDaemons-com.facebook.osqueryd.plist
+
+pack-logging:
+	@sudo mkdir -p ${WORK_D}/private/var/log/osquery/
+	@sudo mkdir -p ${WORK_D}/private/etc/newsyslog.d/
+	@sudo ${INSTALL} -m 644 -g wheel -o root "com.facebook.osqueryd.conf" ${WORK_D}/private/etc/newsyslog.d
+
+pack-osquery:
+	@sudo mkdir -p ${WORK_D}/private/var/osquery/osquery.conf.d
+	@sudo ${INSTALL} -m 644 -g wheel -o root "osquery.conf" ${WORK_D}/private/var/osquery
+	@sudo ${INSTALL} -m 644 -g wheel -o root "sal.conf" ${WORK_D}/private/var/osquery/osquery.conf.d

README.md

@@ -1,2 +1,7 @@
 # osquery-conf
 A LaunchDaemon and configuration file for using osquery with Sal
+
+## Usage
+* Download [The Lugagge](https://github.com/unixorn/luggage)
+* ``cd`` into the cloned directory
+* ``make pkg``

com.facebook.osqueryd.conf

@@ -0,0 +1,3 @@
+# logfilename                         [owner:group]  mode count size   when  flags [/pid_file] [sig_num]
+# Keep this small so we can ship them easier
+/var/log/osquery/osqueryd.results.log root:wheel     600  50     50  *     NZ

com.facebook.osqueryd.plist

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>KeepAlive</key>
+  <true/>
+  <key>Disabled</key>
+  <false/>
+  <key>OnDemand</key>
+  <false/>
+  <key>Label</key>
+  <string>com.facebook.osqueryd</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/usr/local/bin/osqueryd</string>
+    <string>--log_result_events=false</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>60</integer>
+</dict>
+</plist>

osquery.conf

@@ -0,0 +1,13 @@
+{
+  "options": {
+    "host_identifier": "uuid",
+    "schedule_splay_percent": 10
+  },
+
+  "schedule": {
+    },
+
+
+  "packs": {
+  }
+}

sal.conf

@@ -0,0 +1,7 @@
+{
+    "options": {},
+    "schedule": {},
+    "packs": {
+        "sal": "/var/osquery/sal_packs/sal.conf"
+    }
+}