diff --git a/providers/os/resources/files.go b/providers/os/resources/files.go index 4f66d8e85..27ac507f2 100644 --- a/providers/os/resources/files.go +++ b/providers/os/resources/files.go @@ -87,7 +87,13 @@ func (l *mqlFilesFind) list() ([]interface{}, error) { perm = &p } - foundFiles, err = fsSearch.Find(l.From.Data, compiledRegexp, l.Type.Data, perm, nil) + var depth *int + if l.Depth.IsSet() { + d := int(l.Depth.Data) + depth = &d + } + + foundFiles, err = fsSearch.Find(l.From.Data, compiledRegexp, l.Type.Data, perm, depth) if err != nil { return nil, err } @@ -124,6 +130,11 @@ func (l *mqlFilesFind) list() ([]interface{}, error) { call.WriteString(l.Name.Data) } + if l.Depth.IsSet() { + call.WriteString(" -maxdepth ") + call.WriteString(octal2string(l.Depth.Data)) + } + rawCmd, err := CreateResource(l.MqlRuntime, "command", map[string]*llx.RawData{ "command": llx.StringData(call.String()), }) diff --git a/providers/os/resources/os.lr b/providers/os/resources/os.lr index caa3d844b..39d701854 100644 --- a/providers/os/resources/os.lr +++ b/providers/os/resources/os.lr @@ -426,6 +426,8 @@ files.find { permissions int // Search name name string + // The depth of the file search. + depth int } // Parse INI files diff --git a/providers/os/resources/os.lr.go b/providers/os/resources/os.lr.go index 2708b29bf..96ff8bc9e 100644 --- a/providers/os/resources/os.lr.go +++ b/providers/os/resources/os.lr.go @@ -990,6 +990,9 @@ var getDataFields = map[string]func(r plugin.Resource) *plugin.DataRes{ "files.find.name": func(r plugin.Resource) *plugin.DataRes { return (r.(*mqlFilesFind).GetName()).ToDataRes(types.String) }, + "files.find.depth": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlFilesFind).GetDepth()).ToDataRes(types.Int) + }, "files.find.list": func(r plugin.Resource) *plugin.DataRes { return (r.(*mqlFilesFind).GetList()).ToDataRes(types.Array(types.Resource("file"))) }, @@ -3008,6 +3011,10 @@ var setDataFields = map[string]func(r plugin.Resource, v *llx.RawData) bool { r.(*mqlFilesFind).Name, ok = plugin.RawToTValue[string](v.Value, v.Error) return }, + "files.find.depth": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlFilesFind).Depth, ok = plugin.RawToTValue[int64](v.Value, v.Error) + return + }, "files.find.list": func(r plugin.Resource, v *llx.RawData) (ok bool) { r.(*mqlFilesFind).List, ok = plugin.RawToTValue[[]interface{}](v.Value, v.Error) return @@ -7461,6 +7468,7 @@ type mqlFilesFind struct { Regex plugin.TValue[string] Permissions plugin.TValue[int64] Name plugin.TValue[string] + Depth plugin.TValue[int64] List plugin.TValue[[]interface{}] } @@ -7525,6 +7533,10 @@ func (c *mqlFilesFind) GetName() *plugin.TValue[string] { return &c.Name } +func (c *mqlFilesFind) GetDepth() *plugin.TValue[int64] { + return &c.Depth +} + func (c *mqlFilesFind) GetList() *plugin.TValue[[]interface{}] { return plugin.GetOrCompute[[]interface{}](&c.List, func() ([]interface{}, error) { if c.MqlRuntime.HasRecording { diff --git a/providers/os/resources/os.lr.manifest.yaml b/providers/os/resources/os.lr.manifest.yaml index cbfc76548..87fc897ab 100644 --- a/providers/os/resources/os.lr.manifest.yaml +++ b/providers/os/resources/os.lr.manifest.yaml @@ -375,6 +375,8 @@ resources: min_mondoo_version: latest files.find: fields: + depth: + min_mondoo_version: 9.0.0 from: {} list: min_mondoo_version: latest