[7.17](backport #40130) Osquerybeat: Disable allow_unsafe osquery configuration (#41239)

mergify[bot] · aleksmaus · web-flow · commit ef6504bc5cb5 · 2024-10-15T11:15:38.000-04:00
* Osquerybeat: Disable allow_unsafe osquery configuration (#40130) * Osquerybeat: Disable allow_unsafe osquery configuration * Make linter happier * Added changelog * Make linter happier (cherry picked from commit fec980b) * Fix CHANGELOG.next.asciidoc --------- Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -20,6 +20,9 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Metricbeat*
 
+*Osquerybeat*
+
+- Disable allow_unsafe osquery configuration. {pull}40130[40130]
 
 *Packetbeat*
 
diff --git a/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go b/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go
@@ -29,9 +29,7 @@ func SocketPath(dir string) string {
 }
 
 func platformArgs() map[string]interface{} {
-	return map[string]interface{}{
-		"allow_unsafe": true,
-	}
+	return nil
 }
 
 func setpgid() *syscall.SysProcAttr {
@@ -42,6 +40,6 @@ func setpgid() *syscall.SysProcAttr {
 // For clean process tree kill
 func killProcessGroup(cmd *exec.Cmd) error {
 	// https://github.com/golang/dep/pull/857
-	exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()
-	return nil
+	//nolint:gosec // works as expected
+	return exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()
 }

Original file line number	Diff line number	Diff line change
`@@ -29,9 +29,7 @@ func SocketPath(dir string) string {`
`29`	`29`	`}`
`30`	`30`
`31`	`31`	`func platformArgs() map[string]interface{} {`
`32`		`- return map[string]interface{}{`
`33`		`- "allow_unsafe": true,`
`34`		`- }`
	`32`	`+ return nil`
`35`	`33`	`}`
`36`	`34`
`37`	`35`	`func setpgid() *syscall.SysProcAttr {`
`@@ -42,6 +40,6 @@ func setpgid() *syscall.SysProcAttr {`
`42`	`40`	`// For clean process tree kill`
`43`	`41`	`func killProcessGroup(cmd *exec.Cmd) error {`
`44`	`42`	`// https://github.com/golang/dep/pull/857`
`45`		`- exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()`
`46`		`- return nil`
	`43`	`+ //nolint:gosec // works as expected`
	`44`	`+ return exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()`
`47`	`45`	`}`