Osquerybeat: Disable allow_unsafe osquery configuration (#40130)

* Osquerybeat: Disable allow_unsafe osquery configuration * Make linter happier * Added changelog * Make linter happier
elastic · Jul 9, 2024 · fec980b · fec980b
1 parent b056515
commit fec980b
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -57,6 +57,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Osquerybeat*
 
 - Add action responses data stream, allowing osquerybeat to post action results directly to elasticsearch. {pull}39143[39143]
+- Disable allow_unsafe osquery configuration. {pull}40130[40130]
 
 *Packetbeat*
 

diff --git a/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go b/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go
@@ -28,9 +28,7 @@ func SocketPath(dir string) string {
 }
 
 func platformArgs() map[string]interface{} {
-	return map[string]interface{}{
-		"allow_unsafe": true,
-	}
+	return nil
 }
 
 func setpgid() *syscall.SysProcAttr {
@@ -41,6 +39,6 @@ func setpgid() *syscall.SysProcAttr {
 // For clean process tree kill
 func killProcessGroup(cmd *exec.Cmd) error {
 	// https://github.com/golang/dep/pull/857
-	exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()
-	return nil
+	//nolint:gosec // works as expected
+	return exec.Command("taskkill", "/F", "/T", "/PID", fmt.Sprint(cmd.Process.Pid)).Run()
 }