postinstall

#!/bin/sh
# postinstall script for the osquery-extension installer.
#
# 1. Ensures /usr/local/zentral/osquery/flagfile.txt declares the four
#    flags osquery needs to autoload this extension on startup. See:
#      https://osquery.readthedocs.io/en/stable/deployment/extensions/#auto-loading-extensions
#
# 2. Always restarts the pro.zentral.osqueryd launch daemon (if loaded).
#
# pkgbuild's --scripts directory requires this file to be named exactly
# "postinstall" (no extension) and to be executable. Installer.app runs
# it as root after the payload is laid down; stdout/stderr land in
# /var/log/install.log.

set -eu

FLAGFILE="/usr/local/zentral/osquery/flagfile.txt"
EXTENSIONS_LOAD="/usr/local/zentral/osquery/extensions.load"
LAUNCH_DAEMON_PLIST="/Library/LaunchDaemons/pro.zentral.osqueryd.plist"
LAUNCH_DAEMON_LABEL="pro.zentral.osqueryd"

mkdir -p "$(dirname "$FLAGFILE")"
[ -f "$FLAGFILE" ] || touch "$FLAGFILE"

# Append a flag with the given default if the key is not already present
# in the file (with any value).
ensure_present() {
    key="$1"
    default_value="$2"
    if ! grep -qE "^[[:space:]]*--${key}([[:space:]]|=|$)" "$FLAGFILE"; then
        printf '%s\n' "--${key}=${default_value}" >> "$FLAGFILE"
    fi
}

# Force a flag to the exact required value. Leaves the file alone if the
# key is already set to that value (and no other lines match the same
# key). Otherwise strips any existing lines for the key and appends the
# canonical form.
ensure_value() {
    key="$1"
    required_value="$2"
    if grep -qE "^[[:space:]]*--${key}=${required_value}[[:space:]]*$" "$FLAGFILE" \
       && [ "$(grep -cE "^[[:space:]]*--${key}([[:space:]]|=|$)" "$FLAGFILE")" = "1" ]; then
        return
    fi
    TMP=$(mktemp)
    grep -vE "^[[:space:]]*--${key}([[:space:]]|=|$)" "$FLAGFILE" > "$TMP" 2>/dev/null || true
    printf '%s\n' "--${key}=${required_value}" >> "$TMP"
    mv "$TMP" "$FLAGFILE"
}

ensure_present "extensions_autoload" "$EXTENSIONS_LOAD"
ensure_present "extensions_timeout"  "10"
ensure_present "extensions_interval" "10"
ensure_value   "disable_extensions"  "false"

chmod 0644 "$FLAGFILE"

# Restart osqueryd so it re-spawns the extension child process from
# the freshly-installed .ext on disk. Extensions are separate child
# processes that talk to osqueryd over a Thrift socket (not shared
# libraries loaded into osqueryd), so the old child keeps running with
# the old bytes until osqueryd exits and re-execs it. kickstart -k
# restarts the daemon if it's loaded; otherwise the kickstart fails
# silently and the plist's RunAtLoad will start it later.
if [ -f "$LAUNCH_DAEMON_PLIST" ]; then
    if launchctl kickstart -k "system/${LAUNCH_DAEMON_LABEL}" >/dev/null 2>&1; then
        echo "osquery-extension: restarted ${LAUNCH_DAEMON_LABEL}"
    else
        echo "osquery-extension: ${LAUNCH_DAEMON_LABEL} not loaded yet; will start via plist RunAtLoad"
    fi
else
    echo "osquery-extension: no daemon plist at ${LAUNCH_DAEMON_PLIST}; nothing to reload"
fi

exit 0