golden hour

/opt/osquery/share/osquery/lenses

File/Folder	Size	Actions
COPYING	25.91 KB
access.aug	3.58 KB
activemq_conf.aug	1.47 KB
activemq_xml.aug	864 B
afs_cellalias.aug	1.56 KB
aliases.aug	2.18 KB
anaconda.aug	775 B
anacron.aug	2.49 KB
approx.aug	1.26 KB
apt_update_manager.aug	1.11 KB
aptcacherngsecurity.aug	726 B
aptconf.aug	3.9 KB
aptpreferences.aug	1.79 KB
aptsources.aug	1.98 KB
authorized_keys.aug	1.84 KB
automaster.aug	3.31 KB
automounter.aug	4.05 KB
avahi.aug	1.38 KB
backuppchosts.aug	1014 B
bbhosts.aug	4.24 KB
bootconf.aug	3.65 KB
build.aug	16.65 KB
cachefilesd.aug	2 KB
carbon.aug	1.54 KB
ceph.aug	719 B
cgconfig.aug	3.37 KB
cgrules.aug	2.38 KB
channels.aug	3.84 KB
chrony.aug	12.87 KB
clamav.aug	1.53 KB
cobblermodules.aug	398 B
cobblersettings.aug	2.24 KB
collectd.aug	869 B
cpanel.aug	824 B
cron.aug	4.05 KB
cron_user.aug	1.26 KB
crypttab.aug	3.01 KB
csv.aug	1.18 KB
cups.aug	459 B
cyrus_imapd.aug	1.51 KB
darkice.aug	773 B
debctrl.aug	3.61 KB
desktop.aug	1.39 KB
devfsrules.aug	619 B
device_map.aug	620 B
dhclient.aug	6.69 KB
dhcpd.aug	20.88 KB
dns_zone.aug	2.89 KB
dnsmasq.aug	2.16 KB
dovecot.aug	3.98 KB
dpkg.aug	2.78 KB
dput.aug	2.16 KB
erlang.aug	4.33 KB
ethers.aug	663 B
exports.aug	2.37 KB
fai_diskconfig.aug	9.28 KB
fonts.aug	819 B
fstab.aug	1.23 KB
fuse.aug	871 B
gdm.aug	1.8 KB
getcap.aug	1.57 KB
group.aug	1.66 KB
grub.aug	11.04 KB
grubenv.aug	508 B
gshadow.aug	2.19 KB
gtkbookmarks.aug	855 B
host_conf.aug	1.9 KB
hostname.aug	435 B
hosts.aug	485 B
hosts_access.aug	4.32 KB
htpasswd.aug	1.02 KB
httpd.aug	7.35 KB
inetd.aug	6.22 KB
inifile.aug	15.49 KB
inittab.aug	780 B
inputrc.aug	1.62 KB
interfaces.aug	4.62 KB
iproute2.aug	323 B
iptables.aug	2.64 KB
iscsid.aug	684 B
jaas.aug	1.57 KB
jettyrealm.aug	1.52 KB
jmxaccess.aug	1.35 KB
jmxpassword.aug	1.34 KB
json.aug	2.15 KB
kdump.aug	2.91 KB
keepalived.aug	10.7 KB
known_hosts.aug	1.93 KB
koji.aug	898 B
krb5.aug	6.16 KB
ldif.aug	7.65 KB
ldso.aug	1.06 KB
lightdm.aug	1.75 KB
limits.aug	2.02 KB
login_defs.aug	615 B
logrotate.aug	4.22 KB
logwatch.aug	1.44 KB
lokkit.aug	2.16 KB
lvm.aug	2.03 KB
mailscanner.aug	1.66 KB
mailscanner_rules.aug	2.84 KB
masterpasswd.aug	4.36 KB
mcollective.aug	1.09 KB
mdadm_conf.aug	10.05 KB
memcached.aug	1.24 KB
mke2fs.aug	4.67 KB
modprobe.aug	3.34 KB
modules.aug	741 B
modules_conf.aug	1.04 KB
mongodbserver.aug	1.17 KB
monit.aug	2.13 KB
multipath.aug	4.21 KB
mysql.aug	1.95 KB
nagioscfg.aug	2.09 KB
nagiosobjects.aug	1.57 KB
netmasks.aug	1.69 KB
networkmanager.aug	2 KB
networks.aug	1.09 KB
nginx.aug	3.65 KB
nrpe.aug	1.75 KB
nslcd.aug	9.87 KB
nsswitch.aug	2.33 KB
ntp.aug	5.29 KB
ntpd.aug	4.75 KB
odbc.aug	1.42 KB
opendkim.aug	3.08 KB
openshift_config.aug	2.46 KB
openshift_http.aug	1.03 KB
openshift_quickstarts.aug	1.02 KB
openvpn.aug	22.28 KB
oz.aug	1.35 KB
pagekite.aug	2.6 KB
pam.aug	2.58 KB
pamconf.aug	1.23 KB
passwd.aug	3.52 KB
pbuilder.aug	638 B
pg_hba.aug	2.97 KB
pgbouncer.aug	1.43 KB
php.aug	2.34 KB
phpvars.aug	3.85 KB
postfix_access.aug	771 B
postfix_main.aug	1.52 KB
postfix_master.aug	1.9 KB
postfix_passwordmap.aug	1.28 KB
postfix_sasl_smtpd.aug	697 B
postfix_transport.aug	1.48 KB
postfix_virtual.aug	1.32 KB
postgresql.aug	2.1 KB
properties.aug	2.3 KB
protocols.aug	1.05 KB
puppet.aug	1.52 KB
puppet_auth.aug	1.95 KB
puppetfile.aug	2.27 KB
puppetfileserver.aug	3.12 KB
pylonspaste.aug	2.3 KB
pythonpaste.aug	1.99 KB
qpid.aug	670 B
quote.aug	6.71 KB
rabbitmq.aug	4.69 KB
radicale.aug	1.48 KB
rancid.aug	927 B
redis.aug	4.96 KB
reprepro_uploaders.aug	5.47 KB
resolv.aug	3.87 KB
rhsm.aug	1.1 KB
rmt.aug	788 B
rsyncd.aug	1.97 KB
rsyslog.aug	3.17 KB
rtadvd.aug	854 B
rx.aug	4.06 KB
samba.aug	1.71 KB
schroot.aug	1.79 KB
securetty.aug	450 B
semanage.aug	859 B
sep.aug	1.28 KB
services.aug	2.82 KB
shadow.aug	2.35 KB
shells.aug	745 B
shellvars.aug	11.97 KB
shellvars_list.aug	1.74 KB
simplelines.aug	1.13 KB
simplevars.aug	1.34 KB
sip_conf.aug	1.61 KB
slapd.aug	5.2 KB
smbusers.aug	781 B
solaris_system.aug	3.15 KB
soma.aug	1.14 KB
spacevars.aug	1.42 KB
splunk.aug	1.64 KB
squid.aug	15.95 KB
ssh.aug	3.91 KB
sshd.aug	4.01 KB
sssd.aug	861 B
star.aug	941 B
strongswan.aug	1.63 KB
stunnel.aug	2.21 KB
subversion.aug	2.75 KB
sudoers.aug	20.03 KB
sysconfig.aug	2.49 KB
sysconfig_route.aug	2.55 KB
sysctl.aug	923 B
syslog.aug	7.33 KB
systemd.aug	5.88 KB
termcap.aug	1.03 KB
thttpd.aug	1.31 KB
tmpfiles.aug	3.03 KB
toml.aug	4.06 KB
trapperkeeper.aug	4.01 KB
tuned.aug	387 B
up2date.aug	2.21 KB
updatedb.aug	1.13 KB
util.aug	4.85 KB
vfstab.aug	1.71 KB
vmware_config.aug	702 B
vsftpd.aug	2.72 KB
webmin.aug	1.23 KB
wine.aug	1.92 KB
xendconfsxp.aug	1.07 KB
xinetd.aug	4.02 KB
xml.aug	6.33 KB
xorg.aug	10.43 KB
xymon.aug	2.26 KB
xymon_alerting.aug	6.11 KB
yaml.aug	1.54 KB
yum.aug	2.19 KB

Edit: shellvars.aug

(*
Module: Shellvars
 Generic lens for shell-script config files like the ones found
 in /etc/sysconfig

About: License
   This file is licenced under the LGPL v2+, like the rest of Augeas.

About: Lens Usage
   To be documented
*)

module Shellvars =
  autoload xfm

(* Delete a blank line, rather than mapping it *)
  let del_empty = del (Util.empty_generic_re . "\n") "\n"

let empty   = Util.empty
  let empty_part_re = Util.empty_generic_re . /\n+/
  let eol = del (/[ \t]+|[ \t]*[;\n]/ . empty_part_re*) "\n"
  let semicol_eol = del (/[ \t]*[;\n]/ . empty_part_re*) "\n"
  let brace_eol = del /[ \t\n]+/ "\n"

let key_re = /[A-Za-z0-9_][-A-Za-z0-9_]*(\[[0-9A-Za-z_,]+\])?/ - ("unset" | "export")
  let matching_re = "${!" . key_re . /[\*@]\}/
  let eq = Util.del_str "="

let eol_for_comment = del /([ \t]*\n)([ \t]*(#[ \t]*)?\n)*/ "\n"
  let comment = Util.comment_generic_seteol /[ \t]*#[ \t]*/ " # " eol_for_comment
  (* comment_eol in shell MUST begin with a space *)
  let comment_eol = Util.comment_generic_seteol /[ \t]+#[ \t]*/ " # " eol_for_comment
  let comment_or_eol = comment_eol | semicol_eol

let xchgs   = Build.xchgs
  let semicol = del /;?/ ""

let char  = /[^`;()'"&|\n\\# \t]#*|\\\\./
  let dquot =
       let char = /[^"\\]|\\\\./ | Rx.cl
    in "\"" . char* . "\""                    (* " Emacs, relax *)
  let squot = /'[^']*'/
  let bquot = /`[^`\n]+`/
  (* dbquot don't take spaces or semi-colons *)
  let dbquot = /``[^` \t\n;]+``/
  let dollar_assign = /\$$[^\($#\n]*\)/
  let dollar_arithm = /\$$\([^$#\n]*\)\)/

(* Array values of the form '(val1 val2 val3)'. We do not handle empty *)
  (* arrays here because of typechecking headaches. Instead, they are    *)
  (* treated as a simple value                                           *)
  let array =
    let array_value = store anyquot in
    del /$[ \t]*/ "(" . counter "values" .
      [ seq "values" . array_value ] .
      [ del /[ \t\n]+/ " " . seq "values" . array_value ] *
      . del /[ \t]*$/ ")"

(* Treat an empty list () as a value '()'; that's not quite correct *)
  (* but fairly close.                                                *)
  let simple_value =
    let empty_array = /$[ \t]*$/ in
      store (anyquot | empty_array)?

let export = [ key "export" . Util.del_ws_spc ]
  let kv = Util.indent . export? . key key_re
           . eq . (simple_value | array)

let var_action (name:string) =
    Util.indent . del name name . Util.del_ws_spc
    . label ("@" . name) . counter "var_action"
    . Build.opt_list [ seq "var_action" . store (key_re | matching_re) ] Util.del_ws_spc

let unset = var_action "unset"
  let bare_export = var_action "export"

let source =
    Util.indent
    . del /\.|source/ "." . label ".source"
    . Util.del_ws_spc . store /[^;=# \t\n]+/

let shell_builtin_cmds = "ulimit" | "shift" | "exit"

let eval =
    Util.indent . Util.del_str "eval" . Util.del_ws_spc
    . label "@eval" . store anyquot

let alias =
    Util.indent . Util.del_str "alias" . Util.del_ws_spc
    . label "@alias" . store key_re . eq
    . [ label "value" . store anyquot ]

let builtin =
    Util.indent . label "@builtin"
    . store shell_builtin_cmds
    . (Sep.cl_or_space
    . [ label "args" . sto_to_semicol ])?

let keyword (kw:string) = Util.indent . Util.del_str kw
  let keyword_label (kw:string) (lbl:string) = keyword kw . label lbl

let return =
    Util.indent . label "@return"
    . Util.del_str "return"
    . ( Util.del_ws_spc . store Rx.integer )?

let action (operator:string) (lbl:string) (sto:lens) =
       let sp = Rx.cl_or_opt_space | /[ \t\n]+/
    in [ del (sp . operator . sp) (" " . operator . " ")
       . label ("@".lbl) . sto ]

let action_pipe = action "|" "pipe"
  let action_and = action "&&" "and"
  let action_or = action "||" "or"

let condition =
    let cond (start:string) (end:string) = [ label "type" . store start ]
                                         . Util.del_ws_spc . sto_to_semicol
                                         . Util.del_ws_spc . Util.del_str end
                                         . ( action_and sto_to_semicol | action_or sto_to_semicol )*
    in Util.indent . label "@condition" . (cond "[" "]" | cond "[[" "]]")

(* Entry types *)
  let entry_eol_item (item:lens) = [ item . comment_or_eol ]
  let entry_item (item:lens) = [ item ]

let entry_eol = entry_eol_nocommand
                | entry_eol_item command

let entry_noeol = entry_noeol_nocommand
                  | entry_item command

(************************************************************************
 * Group:                 CONDITIONALS AND LOOPS
 *************************************************************************)

let generic_cond_start (start_kw:string) (lbl:string)
                         (then_kw:string) (contents:lens) =
      keyword_label start_kw lbl . Sep.space
      . sto_to_semicol
      . ( action_and sto_to_semicol | action_or sto_to_semicol )*
      . semicol_eol
      . keyword then_kw . eol
      . contents

let generic_cond (start_kw:string) (lbl:string)
                       (then_kw:string) (contents:lens) (end_kw:string) =
      [ generic_cond_start start_kw lbl then_kw contents
        . keyword end_kw . comment_or_eol ]

let cond_if (entry:lens) =
    let elif = [ generic_cond_start "elif" "@elif" "then" entry+ ] in
    let else = [ keyword_label "else" "@else" . eol . entry+ ] in
    generic_cond "if" "@if" "then" (entry+ . elif* . else?) "fi"

let loop_for (entry:lens) =
    generic_cond "for" "@for" "do" entry+ "done"

let loop_while (entry:lens) =
    generic_cond "while" "@while" "do" entry+ "done"

let loop_until (entry:lens) =
    generic_cond "until" "@until" "do" entry+ "done"

let loop_select (entry:lens) =
    generic_cond "select" "@select" "do" entry+ "done"

let case (entry:lens) (entry_noeol:lens) =
       let pattern = [ label "@pattern" . sto_to_semicol . Sep.opt_space ]
    in let case_entry = [ label "@case_entry"
                       . Util.indent . pattern
                       . (Util.del_str "|" . Sep.opt_space . pattern)*
                       . Util.del_str ")" . eol
                       . entry* . entry_noeol?
                       . Util.indent . Util.del_str ";;" . eol ] in
      [ keyword_label "case" "@case" . Sep.space
        . store (char+ | ("\"" . char+ . "\""))
        . del /[ \t\n]+/ " " . Util.del_str "in" . eol
        . (empty* . comment* . case_entry)*
        . empty* . comment*
        . keyword "esac" . comment_or_eol ]

let subshell (entry:lens) =
    [ Util.indent . label "@subshell"
    . Util.del_str "{" . brace_eol
    . entry+
    . Util.indent . Util.del_str "}" . eol ]

let function (entry:lens) (start_kw:string) (end_kw:string) =
    [ Util.indent . label "@function"
    . del /(function[ \t]+)?/ ""
    . store Rx.word . del /[ \t]*/ "()"
    . (comment_eol|brace_eol) . Util.del_str start_kw . brace_eol
    . entry+
    . Util.indent . Util.del_str end_kw . eol ]

let rec rec_entry =
    let entry = comment | entry_eol | rec_entry in
        cond_if entry
      | loop_for entry
      | loop_select entry
      | loop_while entry
      | loop_until entry
      | case entry entry_noeol
      | function entry "{" "}"
      | function entry "(" ")"
      | subshell entry

let lns_norec = del_empty* . (comment | entry_eol) *

let lns = del_empty* . (comment | entry_eol | rec_entry) *

let sc_incl (n:string) = (incl ("/etc/sysconfig/" . n))
  let sc_excl (n:string) = (excl ("/etc/sysconfig/" . n))

let filter_sysconfig =
      sc_incl "*" .
      sc_excl "anaconda" .
      sc_excl "bootloader" .
      sc_excl "hw-uuid" .
      sc_excl "hwconf" .
      sc_excl "ip*tables" .
      sc_excl "ip*tables.save" .
      sc_excl "kernel" .
      sc_excl "*.pub" .
      sc_excl "sysstat.ioconf" .
      sc_excl "system-config-firewall" .
      sc_excl "system-config-securitylevel" .
      sc_incl "network/config" .
      sc_incl "network/dhcp" .
      sc_incl "network/dhcp6r" .
      sc_incl "network/dhcp6s" .
      sc_incl "network/ifcfg-*" .
      sc_incl "network/if-down.d/*" .
      sc_incl "network/ifroute-*" .
      sc_incl "network/if-up.d/*" .
      sc_excl "network/if-up.d/SuSEfirewall2" .
      sc_incl "network/providers/*" .
      sc_excl "network-scripts" .
      sc_incl "network-scripts/ifcfg-*" .
      sc_excl "rhn" .
      sc_incl "rhn/allowed-actions/*" .
      sc_excl "rhn/allowed-actions/script" .
      sc_incl "rhn/allowed-actions/script/*" .
      sc_incl "rhn/rhnsd" .
      sc_excl "SuSEfirewall2.d" .
      sc_incl "SuSEfirewall2.d/cobbler" .
      sc_incl "SuSEfirewall2.d/services/*" .
      sc_excl "SuSEfirewall2.d/services/TEMPLATE" .
      sc_excl "*.systemd"

let filter_default = incl "/etc/default/*"
                     . excl "/etc/default/grub_installdevice*"
                     . excl "/etc/default/rmt"
                     . excl "/etc/default/star"
                     . excl "/etc/default/whoopsie"
                     . incl "/etc/profile"
                     . incl "/etc/profile.d/*"
                     . excl "/etc/profile.d/*.csh"
                     . excl "/etc/profile.d/csh.local"
  let filter_misc    = incl "/etc/arno-iptables-firewall/debconf.cfg"
                     . incl "/etc/conf.d/*"
                     . incl "/etc/cron-apt/config"
                     . incl "/etc/environment"
                     . incl "/etc/firewalld/firewalld.conf"
                     . incl "/etc/blkid.conf"
                     . incl "/etc/adduser.conf"
                     . incl "/etc/cowpoke.conf"
                     . incl "/etc/cvs-cron.conf"
                     . incl "/etc/cvs-pserver.conf"
                     . incl "/etc/devscripts.conf"
                     . incl "/etc/kamailio/kamctlrc"
                     . incl "/etc/lbu/lbu.conf"
                     . incl "/etc/lintianrc"
                     . incl "/etc/lsb-release"
                     . incl "/etc/os-release"
                     . incl "/etc/periodic.conf"
                     . incl "/etc/popularity-contest.conf"
                     . incl "/etc/rc.conf"
                     . incl "/etc/rc.conf.d/*"
                     . incl "/etc/rc.conf.local"
                     . incl "/etc/selinux/config"
                     . incl "/etc/ucf.conf"
                     . incl "/etc/locale.conf"
                     . incl "/etc/vconsole.conf"
                     . incl "/etc/byobu/*"

let filter = filter_sysconfig
             . filter_default
             . filter_misc
             . Util.stdexcl

let xfm = transform lns filter

(* Local Variables: *)
(* mode: caml       *)
(* End:             *)