From 75051cc150c9376940ccfbb874816a221c68e775 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Tue, 26 May 2026 09:34:36 -0700 Subject: [PATCH] Handle FreeBSD check command failures before reading status Return unknown when service status commands fail so remote login and malware checks cannot pass on empty output after an error. Signed-off-by: Bryan Frimin --- pkg/deviceagent/checks/checks_freebsd.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkg/deviceagent/checks/checks_freebsd.go b/pkg/deviceagent/checks/checks_freebsd.go index a6fefd251..ec9e77ea4 100644 --- a/pkg/deviceagent/checks/checks_freebsd.go +++ b/pkg/deviceagent/checks/checks_freebsd.go @@ -130,7 +130,10 @@ func freebsdMalwareProtection(ctx context.Context) Result { ) } out := RunCommand(ctx, "service", "clamav_clamd", "status") - ev := map[string]any{"raw": out.Stdout} + ev := map[string]any{"raw": out.Stdout, "stderr": out.Stderr} + if out.Err != nil { + return unknown(ev) + } if strings.Contains(strings.ToLower(out.Stdout), "is running") { return pass(ev) } @@ -139,7 +142,10 @@ func freebsdMalwareProtection(ctx context.Context) Result { func freebsdRemoteLogin(ctx context.Context) Result { out := RunCommand(ctx, "service", "sshd", "status") - ev := map[string]any{"raw": out.Stdout} + ev := map[string]any{"raw": out.Stdout, "stderr": out.Stderr} + if out.Err != nil { + return unknown(ev) + } if strings.Contains(strings.ToLower(out.Stdout), "is running") { return fail(ev) }