osquery-1/osquery/tables/CMakeLists.txt

80 lines
2.2 KiB
CMake
Raw Normal View History

if(APPLE)
2014-09-23 03:40:28 +00:00
ADD_OSQUERY_OBJCXX_LIBRARY(osquery_tables_objc
2014-09-05 14:54:41 +00:00
../core/darwin/NSProcessInfo+PECocoaBackports.mm
../core/darwin/NSProcessInfo+PECocoaBackports.h
../core/darwin/PECocoaBackportsGlobal.h
2014-09-05 14:54:41 +00:00
system/darwin/osx_version.mm
2014-10-10 01:08:18 +00:00
system/darwin/users.mm
system/darwin/groups.mm
)
2014-09-23 03:40:28 +00:00
ADD_OSQUERY_LIBRARY(osquery_tables_darwin
events/darwin/passwd_changes.cpp
2014-09-09 05:44:46 +00:00
networking/darwin/interfaces.cpp
networking/darwin/listening_ports.cpp
networking/darwin/routes.cpp
2014-09-05 14:54:41 +00:00
system/darwin/apps.cpp
system/darwin/ca_certs.cpp
system/darwin/firewall.h
2014-09-05 14:54:41 +00:00
system/darwin/firewall.cpp
system/darwin/homebrew_packages.cpp
2014-09-05 14:54:41 +00:00
system/darwin/kextstat.cpp
system/darwin/launchd.cpp
system/darwin/nvram.cpp
system/darwin/processes.cpp
system/darwin/quarantine.cpp
2014-10-30 01:10:26 +00:00
system/darwin/startup_items.cpp
)
2014-09-06 01:12:37 +00:00
2014-09-23 03:40:28 +00:00
ADD_OSQUERY_LINK("-framework Foundation")
2014-09-06 01:12:37 +00:00
ADD_OSQUERY_LINK("-framework IOKit")
ADD_OSQUERY_LINK("-framework CoreFoundation")
ADD_OSQUERY_LINK("-framework Security")
ADD_OSQUERY_LINK("-framework OpenDirectory")
2014-09-05 14:54:41 +00:00
else()
2014-09-23 03:40:28 +00:00
ADD_OSQUERY_LIBRARY(osquery_tables_linux
events/linux/passwd_changes.cpp
2014-09-09 05:44:46 +00:00
networking/linux/routes.cpp
2014-09-05 14:54:41 +00:00
system/linux/kernel_modules.cpp
system/linux/processes.cpp
2014-10-10 01:08:18 +00:00
system/linux/users.cpp
system/linux/groups.cpp
2014-11-01 00:16:36 +00:00
system/linux/mounts.cpp
system/linux/pci_devices.cpp
2014-10-31 23:46:14 +00:00
system/linux/block_devices.cpp
2014-09-05 14:54:41 +00:00
)
2014-10-29 05:59:25 +00:00
# CentOS specific tables
ADD_OSQUERY_LIBRARY(osquery_tables_redhat
system/linux/rpm_packages.cpp
)
2014-10-29 05:59:25 +00:00
ADD_OSQUERY_LINK("rpm")
ADD_OSQUERY_LINK("rpmio")
endif()
FILE(GLOB table_sources
"generated/*.cpp"
"manual/*.cpp"
)
2014-09-23 03:40:28 +00:00
ADD_OSQUERY_LIBRARY(osquery_tables
2014-09-09 05:44:46 +00:00
networking/utils.cpp
networking/etc_hosts.cpp
2014-08-30 07:15:31 +00:00
utility/time.cpp
utility/crontab.cpp
system/cpuid.cpp
2014-10-14 01:19:08 +00:00
system/last.cpp
system/bash_history.cpp
Add suid_bin vtable The vtabel report : - path: full path of the file - unix_user: name of the owner (if not available display the uid) - unix_group: name of the groupe (if not available display the gid) - permissions: report suid or guid * S for suid bin * G for guid bin Example : osquery> select * from suid_bin; +----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+ | path | unix_user | unix_group | permissions | +----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+ | "/bin/ps" | root | wheel | S | | "/bin/rcp" | root | wheel | S | | "/Users/vmauge/suid_test" | vmauge | 999 | SG | | "/usr/bin/at" | root | wheel | S | | "/usr/bin/atq" | root | wheel | S | | "/usr/bin/atrm" | root | wheel | S | | "/usr/bin/batch" | root | wheel | S | | "/usr/bin/crontab" | root | wheel | S | | "/usr/bin/ipcs" | root | wheel | S | | "/usr/bin/lockfile" | root | mail | G | | "/usr/bin/login" | root | wheel | S | | "/usr/bin/newgrp" | root | wheel | S | | "/usr/bin/procmail" | root | mail | G | | "/usr/bin/quota" | root | wheel | S | | "/usr/bin/rlogin" | root | wheel | S | | "/usr/bin/rsh" | root | wheel | S | | "/usr/bin/su" | root | wheel | S | | "/usr/bin/sudo" | root | wheel | S | | "/usr/bin/top" | root | wheel | S | | "/usr/bin/wall" | root | tty | G | | "/usr/bin/write" | root | tty | G | | "/usr/sbin/postdrop" | root | _postdrop | G | | "/usr/sbin/postqueue" | root | _postdrop | G | | "/usr/sbin/rpc.net" | root | wheel | S | | "/usr/sbin/rpcset" | root | wheel | S | | "/usr/sbin/traceroute" | root | wheel | S | | "/usr/sbin/traceroute6" | root | wheel | S | +----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+ This commit fixes issue #253.
2014-10-29 05:08:10 +00:00
system/suid_bin.cpp
base.h
2014-07-31 00:35:19 +00:00
)
2014-09-23 02:54:59 +00:00
ADD_OSQUERY_TEST(etc_hosts_tests networking/etc_hosts_tests.cpp)
2014-08-30 21:26:24 +00:00
if(APPLE)
2014-09-23 02:54:59 +00:00
ADD_OSQUERY_TEST(apps_tests system/darwin/apps_tests.cpp)
ADD_OSQUERY_TEST(ca_certs_tests system/darwin/ca_certs_tests.cpp)
ADD_OSQUERY_TEST(firewall_tests system/darwin/firewall_tests.cpp)
ADD_OSQUERY_TEST(launchd_tests system/darwin/launchd_tests.cpp)
2014-08-30 21:26:24 +00:00
endif()