Block collections in locked down servers (#2668)

Some minor changes to GUI
Velocidex · May 7, 2023 · 15e24c3 · 15e24c3
1 parent cc370c8
commit 15e24c3
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 14 deletions.
diff --git a/artifacts/definitions/Server/Internal/ToolDependencies.yaml b/artifacts/definitions/Server/Internal/ToolDependencies.yaml
@@ -5,31 +5,31 @@ description: |
 
 tools:
   - name: VelociraptorWindows
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-amd64.exe
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-amd64.exe
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindows_x86
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-386.exe
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-386.exe
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorLinux
-    github_project: Velocidex/velociraptor
-    github_asset_regex: linux-amd64-musl
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-linux-amd64-musl
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorDarwin
-    github_project: Velocidex/velociraptor
-    github_asset_regex: darwin-amd64
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-darwin-amd64
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindowsMSI
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-amd64.msi
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-amd64.msi
     serve_locally: true
+    version: 0.6.9-rc1
 
   - name: VelociraptorWindows_x86MSI
-    github_project: Velocidex/velociraptor
-    github_asset_regex: windows-386.msi
+    url: https://github.com/Velocidex/velociraptor/releases/download/v0.6.9-rc1/velociraptor-v0.6.9-rc1-windows-386.msi
     serve_locally: true
+    version: 0.6.9-rc1
diff --git a/gui/velociraptor/src/components/artifacts/artifacts.css b/gui/velociraptor/src/components/artifacts/artifacts.css
@@ -11,6 +11,8 @@
 
 .artifact-search-table button {
     cursor: pointer;
+    width: 100%;
+    text-align: left;
 }
 
 .artifact-search-table button:hover {

diff --git a/gui/velociraptor/src/components/core/paged-table.jsx b/gui/velociraptor/src/components/core/paged-table.jsx
@@ -430,7 +430,7 @@ class VeloPagedTable extends Component {
                         }}
                       >
                         <FontAwesomeIcon icon="filter"/>
-                        { filter_column == column.text && filter }
+                        { filter_column == column.text && !edit_filter_visible && filter }
                       </Button>
                       { edit_filter_visible &&
                         <Form.Control

diff --git a/services/sanity/lockdown.go b/services/sanity/lockdown.go
@@ -19,6 +19,9 @@ func (self SanityChecks) CheckForLockdown(
 	lockdown_token := &acl_proto.ApiClientACL{
 		ArtifactWriter:       true,
 		ServerArtifactWriter: true,
+		CollectClient:        true,
+		CollectServer:        true,
+		StartHunt:            true,
 		Execve:               true,
 		ServerAdmin:          true,
 		FilesystemWrite:      true,

diff --git a/vql/tools/collector/collector.go b/vql/tools/collector/collector.go
@@ -237,7 +237,7 @@ func AddSpecProtobuf(
 		artifact_definitions, pres := repository.Get(ctx, config_obj, name)
 		if !pres {
 			// Artifact not known
-			return fmt.Errorf(`Parameter 'args' refers to an unknown artifact (%v). The 'args' parameter should be of the form {"Custom.Artifact.Name":{"arg":"value"}}`, name)
+			return fmt.Errorf(`Parameter refers to an unknown artifact (%v). The parameter should be of the form {"Custom.Artifact.Name":{"arg":"value"}}`, name)
 		}
 
 		// Check that we are allowed to collect this artifact