osquery 2.1.1

function Set-DenyWriteAcl {
  [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact="Medium")]
  param(
    [string] $targetDir = ''
  )
  if($PSCmdlet.ShouldProcess($targetDir)){
    $acl = Get-Acl $targetDir
    $inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
    $propagationFlag = [System.Security.AccessControl.PropagationFlags]::None
    $permType = [System.Security.AccessControl.AccessControlType]::Deny

    $permission = "everyone","write",$inheritanceFlag,$propagationFlag,$permType
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
    $acl.SetAccessRule($accessRule)
    $acl | Set-Acl $targetDir
  }
}

$packageName = 'osquery'
$url = 'https://osquery-packages.s3.amazonaws.com/choco/osquery-2.1.1.zip'
$progData =  [System.Environment]::GetEnvironmentVariable('ProgramData')
$targetFolder = Join-Path $progData "osquery"
$daemonFolder = Join-Path $targetFolder "osqueryd"

$packageArgs = @{
  packageName = $packageName
  url = $url
  unzipLocation = $targetFolder
  checkSum = 'BD95ECE4EC3C4E418275AB6B9DED61DD'
  checksumType = 'md5'
}

New-Item -Force -Type directory -Path $daemonFolder
Install-ChocolateyZipPackage @packageArgs

# In order to run osqueryd as a service, we need to have a folder that has a
# Deny Write ACL to everyone.
$targetDaemonBin = Join-Path $targetFolder "osqueryd.exe"
$destDaemonBin = Join-Path $daemonFolder "osqueryd.exe"
Move-Item -Force -Path $targetDaemonBin -Destination $destDaemonBin
Set-DenyWriteAcl $daemonFolder

# Add the osquery dir to the system path, to leverage osqueryi.exe
$oldPath = [System.Environment]::GetEnvironmentVariable('Path', 'Machine')
[System.Environment]::SetEnvironmentVariable('Path', "$oldPath;$targetFolder", 'Machine')

if (Test-Path $targetFolder) {
  Write-Output "osquery was successfully installed to $targetFolder."
} else {
  Write-Output 'There was an error installing osquery.'
}