From 4f07cf97be9bb4d42598dd4c289abb3875a79ff1 Mon Sep 17 00:00:00 2001
From: Javier Marcos <1271349+javuto@users.noreply.github.com>
Date: Thu, 10 Sep 2026 15:49:38 +0200
Subject: [PATCH] Add flag to increase read_max in osquery to 1GB

---
 pkg/environments/flags.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkg/environments/flags.go b/pkg/environments/flags.go
index 01aca69c0..f775016a3 100644
--- a/pkg/environments/flags.go
+++ b/pkg/environments/flags.go
@@ -11,12 +11,16 @@ import (
 const (
 	// CarverBlockSizeValue to configure size in bytes for carver blocks
 	CarverBlockSizeValue string = "5120000"
+	// ReadMaxValue to configure the read_max value for osquery, 1GB = 1073741824 bytes
+	ReadMaxValue string = "1073741824"
 	// FlagGenericValue to use as generator for generic flags
 	FlagGenericValue string = `--{{ .FlagName }}={{ .FlagValue }}`
 	// FlagTLSServerCerts for the --tls_server_certs flag
 	FlagNameTLSServerCerts string = `tls_server_certs`
 	// FlagCarverBlockSize for the --carver_block_size flag
 	FlagNameCarverBlockSize string = `carver_block_size`
+	// FlagReadMax to use as generator for the --read_max flag
+	FlagReadMax string = `read_max`
 	// FlagsConfigPlugin to configure the config plugin
 	FlagsConfigPlugin string = `
 --config_plugin=tls
@@ -53,6 +57,7 @@ const (
 --host_identifier=uuid
 --force=true
 --utc=true
+{{ .FlagReadMaxValue }}
 --enroll_secret_path={{ .SecretFile }}
 --enroll_tls_endpoint=/{{ .Environment.UUID }}/{{ .Environment.EnrollPath }}
 {{ .FlagsConfigPlugin }}
@@ -80,6 +85,7 @@ type flagData struct {
 	FlagsCarverPlugin string
 	FlagServerCerts   string
 	FlagCarverBlock   string
+	FlagReadMaxValue  string
 }
 
 // GenServerCertsFlag to generate the --tls_server_certs flag
@@ -98,6 +104,14 @@ func GenCarveBlockSizeFlag(blockSize string) string {
 	return GenSingleFlag("blocksize", FlagNameCarverBlockSize, blockSize)
 }
 
+// GenReadMaxFlag to generate the --read_max flag
+func GenReadMaxFlag(readMax string) string {
+	if readMax == "" {
+		return ""
+	}
+	return GenSingleFlag("readmax", FlagReadMax, readMax)
+}
+
 // GenSingleFlag to generate a generic flag to be used by osquery
 func GenSingleFlag(tmplName, flagName, flagValue string) string {
 	data := struct {
@@ -191,6 +205,7 @@ func (environment *EnvManager) GenerateFlags(env TLSEnvironment, secretPath, cer
 		FlagsQueryPlugin:  queryFlags,
 		FlagsCarverPlugin: carverFlags,
 		FlagServerCerts:   flagServerCerts,
+		FlagReadMaxValue:  GenReadMaxFlag(ReadMaxValue),
 	}
 	return ParseFlagTemplate("flags", FlagsTemplate, data), nil
 }