Skip to content

Fix built-in Linux labels missing derived distributions - #51249

Open
juan-fdz-hawa wants to merge 3 commits into
mainfrom
46905-built-in-linux-labels-too-strict-to-match-all-applicable-distros
Open

Fix built-in Linux labels missing derived distributions#51249
juan-fdz-hawa wants to merge 3 commits into
mainfrom
46905-built-in-linux-labels-too-strict-to-match-all-applicable-distros

Conversation

@juan-fdz-hawa

@juan-fdz-hawa juan-fdz-hawa commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Resolves #46905

osquery reports a derived distribution's own ID in os_version.platform and lists only its ancestors in platform_like, so Pop!_OS (platform "pop", platform_like "ubuntu debian") matched neither "Ubuntu Linux" nor "Debian-based Linux hosts".

  • Ubuntu Linux: also match platform_like "%ubuntu%" (Pop!_OS, Linux Mint, Zorin OS, KDE neon).
  • Fedora Linux: name LIKE "%fedora%" instead of = "Fedora Linux", covering Fedora 33 and earlier, which report name "Fedora".
  • Debian-based Linux hosts: add platform = 'debian' (Debian reports no platform_like at all) and platform_like "%ubuntu%".
  • RPM-based Linux hosts: add the SUSE family and Amazon Linux.
  • Mirror the last two in the all-deb-hosts and all-rpm-hosts reports.

Test matrix:

  ┌─────────────────────┬─────────────────────────────────────┬───────────────────────────────────────────────────┐
  │       distro        │      platform / platform_like       │                 resulting labels                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Ubuntu 22.04        │ ubuntu / debian                     │ All Linux, Ubuntu Linux, Debian-based Linux hosts │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Debian 12           │ debian / (empty)                    │ All Linux, Debian-based Linux hosts               │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Pop!_OS 24          │ pop / ubuntu debian                 │ All Linux, Ubuntu Linux, Debian-based Linux hosts │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Linux Mint 21       │ linuxmint / ubuntu                  │ All Linux, Ubuntu Linux, Debian-based Linux hosts │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Zorin OS 17 †       │ zorin / ubuntu                      │ All Linux, Ubuntu Linux, Debian-based Linux hosts │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ KDE neon            │ neon / ubuntu debian                │ All Linux, Ubuntu Linux, Debian-based Linux hosts │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Kali rolling        │ kali / debian                       │ All Linux, Debian-based Linux hosts               │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Fedora 40           │ rhel / rhel                         │ All Linux, Fedora Linux, RPM-based Linux hosts    │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Fedora 33           │ rhel / rhel                         │ All Linux, Fedora Linux, RPM-based Linux hosts    │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ RHEL 9              │ rhel / rhel                         │ All Linux, Red Hat Linux, RPM-based Linux hosts   │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Rocky Linux 9       │ rhel / rhel                         │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ AlmaLinux 9         │ rhel / rhel                         │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ CentOS Stream 9     │ rhel / rhel                         │ All Linux, CentOS Linux, RPM-based Linux hosts    │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Amazon Linux 2023   │ amzn / fedora                       │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ SLES 15.6           │ sles / suse                         │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ openSUSE Leap 15.5  │ opensuse-leap / suse opensuse       │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ openSUSE Tumbleweed │ opensuse-tumbleweed / opensuse suse │ All Linux, RPM-based Linux hosts                  │
  ├─────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────────────┤
  │ Arch Linux          │ arch / (empty)                      │ All Linux                                         │
  └─────────────────────┴─────────────────────────────────────┴───────────────────────────────────────────────────┘

Checklist for submitter

If some of the following don't apply, delete the relevant line.

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

Testing

  • Added/updated automated tests
  • QA'd all new/changed functionality manually

Summary by CodeRabbit

  • New Features

    • Linux labels and reports now recognize a broader range of Debian-based distributions, including Ubuntu and related variants.
    • RPM-based labels and reports now include Red Hat, Fedora, and SUSE systems.
    • Fedora detection supports operating-system names containing “Fedora.”
  • Bug Fixes

    • Improved consistency between built-in Linux labels, reports, and platform identifiers.
    • Updated existing installations so built-in label queries reflect the expanded distribution coverage.

Resolves #46905

osquery reports a derived distribution's own ID in os_version.platform and
lists only its ancestors in platform_like, so Pop!_OS (platform "pop",
platform_like "ubuntu debian") matched neither "Ubuntu Linux" nor
"Debian-based Linux hosts".

- Ubuntu Linux: also match platform_like "%ubuntu%" (Pop!_OS, Linux Mint,
Zorin OS, KDE neon).
- Fedora Linux: name LIKE "%fedora%" instead of = "Fedora Linux", covering
Fedora 33 and earlier, which report name "Fedora".
- Debian-based Linux hosts: add platform = 'debian' (Debian reports no
platform_like at all) and platform_like "%ubuntu%".
- RPM-based Linux hosts: add the SUSE family and Amazon Linux.
- Mirror the last two in the all-deb-hosts and all-rpm-hosts reports.
@codecov

codecov Bot commented Aug 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 85.71429% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.78%. Comparing base (2c44db2) to head (46fa09d).
⚠️ Report is 10 commits behind head on main.

Files with missing lines Patch % Lines
...s/20260814130009_UpdateBuiltinLinuxLabelQueries.go 80.95% 3 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #51249      +/-   ##
==========================================
+ Coverage   68.77%   68.78%   +0.01%     
==========================================
  Files        4000     4002       +2     
  Lines      258322   258533     +211     
  Branches    13704    13704              
==========================================
+ Hits       177651   177822     +171     
- Misses      64890    64918      +28     
- Partials    15781    15793      +12     
Flag Coverage Δ
backend 69.89% <85.71%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@juan-fdz-hawa
juan-fdz-hawa force-pushed the 46905-built-in-linux-labels-too-strict-to-match-all-applicable-distros branch from 4622d74 to a19af61 Compare August 14, 2026 16:17
@juan-fdz-hawa
juan-fdz-hawa marked this pull request as ready for review August 14, 2026 16:17
@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e7f6b85d-ff22-4b44-b60a-8dd3e7ba20e6

📥 Commits

Reviewing files that changed from the base of the PR and between ef9f396 and 46fa09d.

📒 Files selected for processing (1)
  • server/datastore/mysql/migrations/tables/20260814130009_UpdateBuiltinLinuxLabelQueries.go

Walkthrough

Built-in Linux label queries now recognize Debian, Ubuntu, RHEL, Fedora, and SUSE platform values. Ubuntu and Fedora definitions were updated in test helpers and MySQL data. A MySQL migration applies the updated queries and records the migration. Label templates, reports, fixtures, and datastore tests were synchronized with the new matching rules.

Merge Risk: ⚪ Minimal · up to 46fa0

This change broadens built-in Linux label matching for derived distributions; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the primary change: fixing built-in Linux labels for derived distributions.
Description check ✅ Passed The description identifies issue #46905, explains the affected queries, and documents automated testing and manual QA.
Linked Issues check ✅ Passed The changes address issue #46905 by broadening Ubuntu, Debian, Fedora, and RPM-based Linux label queries and adding validation tests.
Out of Scope Changes check ✅ Passed The modified queries, reports, migrations, fixtures, and tests all support the linked issue objectives.
✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
⚔️ Resolve merge conflicts 💡
  • Resolve merge conflict in branch 46905-built-in-linux-labels-too-strict-to-match-all-applicable-distros
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 46905-built-in-linux-labels-too-strict-to-match-all-applicable-distros

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@getvictor getvictor left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Built-in Linux labels too strict to match all applicable distros

3 participants