search

fleetdm / fleet

Open device management
https://fleetdm.com
Other
5.22k stars 611 forks source link

Host Software API bugs: Allow listhostsoftware to only show installed software and hide installers #30188

Open RachelElysia opened 2 weeks ago

RachelElysia commented 2 weeks ago

Fleet version: <!-- Copy this from the "My account" page in the Fleet UI, or run fleetctl --version -->

Web browser and operating system:

💥  Actual behavior

Image Image

🧑‍💻  Steps to reproduce

  1. Find a software available for install that is not on a host, and go to that host details page and search for that software that is not installed and see it under all software installed on your host Example: https://dogfood.fleetdm.com/hosts/1339/software?query=microsoft%20teams&order_direction=asc&order_key=name&page=0

  2. Install and uninstall a software and search on Fleet Desktop > Software and see the software show up in the list even though it's not installed and version is returned correct empty state

  3. 🕯️ More info (optional)

    N/A

🛠️ To fix

Allow somehow available_for_install: false or something similar to hide installers from the:

  1. GET /hosts/:id/software API response
  2. GET /device/:token/software API response
RachelElysia commented 2 weeks ago

cc: @iansltx

RachelElysia commented 2 weeks ago

Very evident bug now that we're separating Library and Inventory on host software page

eugkuo commented 2 weeks ago

Planning poker: https://fleetdm.slack.com/archives/C08RXDH5LHZ/p1750449685711069

mostlikelee commented 2 weeks ago

@ksykulev adding this to your queue

mostlikelee commented 1 week ago

It sounds like this fix breaks an existing test:

  1. software X is not in inventory
  2. software X install script successful
  3. software X uninstall script successful
  4. software X is showing in inventory without a refresh

The above behavior sounds like a bug. Since install/uninstall script results should not affect software inventory, I'm ok changing this behavior. Why? script results allude to a software's installed state as opposed to osquery being the definitive state of software on a host. Alluding to a state can lead to incorrect reporting of software and vulnerabilities and a mis-trust of Fleet data.

cc: @ksykulev

ksykulev commented 1 week ago

Existing test: https://github.com/fleetdm/fleet/blob/main/server/datastore/mysql/software_test.go#L4034-L4039

    SelfServiceOnly: false,
    IncludeAvailableForInstall: false,
    OnlyAvailableForInstall: false,

Returns i6

("*github.com/fleetdm/fleet/v4/server/fleet.HostSoftwareWithInstaller")(0x140001d3a20)
*github.com/fleetdm/fleet/v4/server/fleet.HostSoftwareWithInstaller {
    ID: 15,
    Name: "i6",
    Source: "apps",
    Status: *github.com/fleetdm/fleet/v4/server/fleet.SoftwareInstallerStatus nil,
    InstalledVersions: []*github.com/fleetdm/fleet/v4/server/fleet.HostSoftwareInstalledVersion len: 0, cap: 0, nil,
    SoftwarePackage: *github.com/fleetdm/fleet/v4/server/fleet.SoftwarePackageOrApp {
        AppStoreID: "",
        Name: "installer-7.pkg",
        AutomaticInstallPolicies: []github.com/fleetdm/fleet/v4/server/fleet.AutomaticInstallPolicy len: 0, cap: 0, nil,
        Version: "v7.0.0",
        Platform: "darwin",
        SelfService: *false,
        IconURL: *string nil,
        LastInstall: *(*"github.com/fleetdm/fleet/v4/server/fleet.HostSoftwareInstall")(0x14000839080),
        LastUninstall: *(*"github.com/fleetdm/fleet/v4/server/fleet.HostSoftwareUninstall")(0x140006de9c0),
        PackageURL: *string nil,
        InstallDuringSetup: *bool nil,
        FleetMaintainedAppID: *uint nil,
        Categories: []string len: 0, cap: 0, nil,},
    AppStoreApp: *github.com/fleetdm/fleet/v4/server/fleet.SoftwarePackageOrApp nil,}

Which is linked to swi8 https://github.com/fleetdm/fleet/blob/main/server/datastore/mysql/software_test.go#L3949-L3969

jmwatts commented 1 week ago

I'm still seeing this bug with the latest pull from main

Image

jmwatts commented 14 hours ago

QA Notes

  1. Find a software available for install that is not on a host, and go to that host details page, Inventory tab and search for that software that is not installed

    • [x] Software does not appear in list

  2. Install and uninstall a software and search on Fleet Desktop > Software > Inventory tab

    • [x] Software does not show up in the list because it's not installed and no version is returned