- Go 68.5%
- Nix 31.5%
Lucas Pick
72d77cc07c
osquery-go's extension manager creates its own UNIX socket at <orbit-socket>.<random> adjacent to orbit's. With ProtectSystem= strict, /var/lib/orbit/ was read-only and bind() failed with "read-only file system". Add ReadWritePaths for the directory the extension socket lives in (derived from extensionsSocket). Observed on framepick after first activation — service crash- looped with "listen unix /var/lib/orbit/orbit-osquery.em.NNNNN: bind: read-only file system". |
||
|---|---|---|
| vendor | ||
| .gitignore | ||
| flake.nix | ||
| go.mod | ||
| go.sum | ||
| main.go | ||
| main_test.go | ||
| README.md | ||
osquery-nix-tables
osquery extension exposing Nix package information as SQL-queryable virtual tables.
Tables
nix_system_packages
Walks /run/current-system/sw/bin/ symlinks, parses each resolved store
path. Reports the unique set of packages backing the system PATH (i.e.
environment.systemPackages from configuration.nix).
| Column | Type | Description |
|---|---|---|
name |
text | Derivation name (e.g., git, coreutils-full) |
version |
text | Version segment (e.g., 2.53.0), may include -bin etc. |
store_path |
text | Full /nix/store/<hash>-<name>-<version> directory |
hash |
text | 32-char nix store hash |
binary_count |
integer | Number of symlinks under bin/ pointing at this store path |
nix_user_packages
Same shape as nix_system_packages, with an extra user column. Walks
/etc/profiles/per-user/<user>/bin/ for every user that has a profile
(typically home-manager-managed).
Usage
Standalone (test against osqueryi)
nix build
sudo ./result/bin/osquery-nix-tables --socket /tmp/osquery.em &
osqueryi --extension /tmp/osquery.em
osquery> SELECT name, version FROM nix_system_packages ORDER BY name LIMIT 10;
As a NixOS module alongside orbit
Add as a flake input:
inputs.osquery-nix-tables.url = "git+https://code.grail.tiberius.com/tiberius-grail/osquery-nix-tables";
Import the module and enable:
{
imports = [ inputs.osquery-nix-tables.nixosModules.default ];
services.osquery-nix-tables.enable = true;
}
The systemd service binds to orbit.service — starts after orbit
creates its osqueryd extensions socket, restarts when orbit does,
stops when orbit does. Runs as root (orbit's socket is owner-only
writable).
In fleet's UI, the new tables show up in Reports / per-host query runs:
SELECT name, version FROM nix_system_packages ORDER BY name;
Development
go test ./...
nix build
vendor/ is checked in (vendorHash = null in flake.nix) — no network
at build time, matches the grail-fleet-proxies convention.