Cannot find command with "collector: command"

Hi, I am trying to create new artifacts like below:

version: 0.1
condition: command_exists "dpkg"
output_directory: /live_response/packages
artifacts:
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: command
    command: find /sbin/ /usr/sbin/ /bin/ /usr/bin/ /opt/ /usr/local/ \( -type f -o -type l \) -exec dpkg -S {} 2>&1 \;
    output_file: dpkg_-S.txt

It is intended to verify that files under the specified directory are included in the installed package. The uac.log records that the command was executed, but the output destination file is zero bytes.

$ tail uac.log
2024-07-19 17:34:10 +0900 INFO 'gzip' tool available: true
2024-07-19 17:34:10 +0900 INFO 'perl' tool available: true
2024-07-19 17:34:10 +0900 INFO 'stat' tool available: true
2024-07-19 17:34:10 +0900 INFO 'stat' btime support: true
2024-07-19 17:34:10 +0900 INFO 'statx' tool available: false
2024-07-19 17:34:10 +0900 INFO PATH: /home/john/Downloads/src/uac/tools/linux_procmemdump.sh:/home/john/Downloads/src/uac/tools/avml/linux:/home/john/Downloads/src/uac/bin/linux/x86_64:/usr/xpg4/bin:/usr/xpg6/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/ucb:/usr/ccs/bin:/opt/bin:/opt/sbin:/opt/local/bin:/snap/bin:/netscaler:/opt/homebrew/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
2024-07-19 17:34:10 +0900 INFO Artifacts collection started
2024-07-19 17:34:10 +0900 INFO Parsing artifacts file 'test3.yaml'
2024-07-19 17:34:10 +0900 COMMAND find /sbin/ /usr/sbin/ /bin/ /usr/bin/ /opt/ /usr/local/ ( -type f -o -type l ) -exec dpkg -S {} 2>&1 ;
2024-07-19 17:34:10 +0900 INFO Artifacts collection complete. Total execution time: 0 seconds

$ LC_TIME=C ls -al live_response/packages/dpkg_-S.txt
-rw-r--r-- 1 john john 0 Jul 19 17:34 live_response/packages/dpkg_-S.txt

Is there a better alternative?

Hi, Yes, you need to use a combination with the find and command collectors. First use find collector to find your files of interest. You can store them into a temporary location (%temp_directory%) if you do not want it to be part of the output file.

Then you need to use command collector to go through each line (using foreach) and run your dpkg command.

Never use find with command collector as some systems do not accept -exec, or even operators ( ).

The find collector will build the find command on the fly for you.

Note that the first example only works with the code in the develop branch (which is the future UAC v3) as some properties are new and do not work with UAC v2. If you want to run this in UAC 2.9.1, please take a look in the second example.

works only in UAC v3.

version: 0.1
condition: command_exists "dpkg"
artifacts:
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /sbin/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/sbin/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /bin/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/bin/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /opt/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/local/*
    file_type: [f, l]
    output_directory: /%temp_directory%/live_response/packages
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: command
    foreach: cat /%temp_directory%/live_response/packages/binary_files.txt
    command: dpkg -S "%line%"
    output_directory: /live_response/packages
    output_file: dpkg_-S.txt

Works only in UAC 2.9.1

version: 0.1
artifacts:
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /sbin/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/sbin/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /bin/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/bin/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /opt/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: find
    path: /usr/local/*
    file_type: f
    output_file: binary_files.txt
  -
    description: Search for a filename from installed packages.
    supported_os: [linux]
    collector: command
    foreach: cat "%destination_directory%/binary_files.txt"
    command: dpkg -S "%line%"
    output_file: dpkg_-S.txt

tclahr / uac

Cannot find command with "collector: command" #250