osquery-1/osquery/events/CMakeLists.txt

if(APPLE)
  ADD_OSQUERY_LINK(FALSE "-framework CoreServices")
  ADD_OSQUERY_LINK(FALSE "-framework SystemConfiguration")
  ADD_OSQUERY_LINK(FALSE "-framework IOKit")
  ADD_OSQUERY_LINK(FALSE "-framework DiskArbitration")

  ADD_OSQUERY_LIBRARY(FALSE osquery_events_darwin
    darwin/fsevents.cpp
    darwin/iokit_hid.cpp
    darwin/diskarbitration.cpp
    darwin/scnetwork.cpp
  )
elseif(FREEBSD)
  ADD_OSQUERY_LIBRARY(FALSE osquery_events_freebsd
  )
else()
  ADD_OSQUERY_LINK(FALSE "udev")

  ADD_OSQUERY_LIBRARY(FALSE osquery_events_linux
    linux/inotify.cpp
    linux/udev.cpp
  )
endif()

ADD_OSQUERY_LIBRARY(TRUE osquery_events
  events.cpp
)

file(GLOB OSQUERY_EVENTS_TESTS "tests/*.cpp")
ADD_OSQUERY_TEST(TRUE ${OSQUERY_EVENTS_TESTS})

# Kernel-related userland code.
file(GLOB OSQUERY_EVENTS_KERNEL "kernel/*.cpp")
ADD_OSQUERY_LIBRARY(FALSE osquery_events_kernel
  kernel.cpp
  ${OSQUERY_EVENTS_KERNEL}
)

if(NOT OSQUERY_BUILD_RELEASE)
  set_target_properties(osquery_events_kernel
    PROPERTIES COMPILE_DEFINITIONS "KERNEL_TEST=1")
endif()

file(GLOB OSQUERY_EVENTS_KERNEL_TESTS "kernel/tests/*.cpp")
ADD_OSQUERY_KERNEL_TEST(${OSQUERY_EVENTS_KERNEL_TESTS})

if(APPLE)
  file(GLOB OSQUERY_DARWIN_EVENTS_TESTS "darwin/tests/*.cpp")
  ADD_OSQUERY_TEST(FALSE ${OSQUERY_DARWIN_EVENTS_TESTS})
elseif(LINUX)
  file(GLOB OSQUERY_LINUX_EVENTS_TESTS "linux/tests/*.cpp")
  ADD_OSQUERY_TEST(FALSE ${OSQUERY_LINUX_EVENTS_TESTS})
endif()
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`if(APPLE)`
Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LINK(FALSE "-framework CoreServices")`
			`ADD_OSQUERY_LINK(FALSE "-framework SystemConfiguration")`
			`ADD_OSQUERY_LINK(FALSE "-framework IOKit")`
Implements disk_events and the related publisher and subscriber. We now have a Publisher to report on disk events and its metadata, using the DiskArbitration framework on OS X. Currently disk appearance and disappearance events are published for both physical and virtual disks (DMG files). On an event trigger, disk properties are parsed and that metadata is reported along with the action. The Subscriber subscribes to virtual disk events currently. This closes #1103. 2015-06-22 18:09:15 +00:00			`ADD_OSQUERY_LINK(FALSE "-framework DiskArbitration")`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00
Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LIBRARY(FALSE osquery_events_darwin`
cmake cleanups 2014-09-23 03:40:28 +00:00			`darwin/fsevents.cpp`
IOKit HID events and OSX hardware_events table 2014-12-12 02:06:08 +00:00			`darwin/iokit_hid.cpp`
Implements disk_events and the related publisher and subscriber. We now have a Publisher to report on disk events and its metadata, using the DiskArbitration framework on OS X. Currently disk appearance and disappearance events are published for both physical and virtual disks (DMG files). On an event trigger, disk properties are parsed and that metadata is reported along with the action. The Subscriber subscribes to virtual disk events currently. This closes #1103. 2015-06-22 18:09:15 +00:00			`darwin/diskarbitration.cpp`
[events] OSX SCNetwork Publisher 2014-10-07 22:16:26 +00:00			`darwin/scnetwork.cpp`
cmake cleanups 2014-09-23 03:40:28 +00:00			`)`
Make room for FreeBSD events 2014-11-07 15:33:16 +00:00			`elseif(FREEBSD)`
Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LIBRARY(FALSE osquery_events_freebsd`
Make room for FreeBSD events 2014-11-07 15:33:16 +00:00			`)`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`else()`
Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LINK(FALSE "udev")`
Build leaner libosquery, allow control over spec/impl 2014-12-24 04:07:12 +00:00
Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LIBRARY(FALSE osquery_events_linux`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`linux/inotify.cpp`
Linux udev events 2014-12-08 10:22:59 +00:00			`linux/udev.cpp`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`)`
			`endif()`

Organizing headers/build for SDK 2015-02-03 05:21:36 +00:00			`ADD_OSQUERY_LIBRARY(TRUE osquery_events`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`events.cpp`
Added kernel event publisher. 2015-06-30 21:16:43 +00:00			`)`

Added kernel process events table. 2015-06-30 21:20:04 +00:00			`file(GLOB OSQUERY_EVENTS_TESTS "tests/*.cpp")`
			`ADD_OSQUERY_TEST(TRUE ${OSQUERY_EVENTS_TESTS})`

[Fix #1339] Add kernel-build to packages when used 2015-07-16 22:23:29 +00:00			`# Kernel-related userland code.`
			`file(GLOB OSQUERY_EVENTS_KERNEL "kernel/*.cpp")`
			`ADD_OSQUERY_LIBRARY(FALSE osquery_events_kernel`
Added kernel event publisher. 2015-06-30 21:16:43 +00:00			`kernel.cpp`
[Fix #1339] Add kernel-build to packages when used 2015-07-16 22:23:29 +00:00			`${OSQUERY_EVENTS_KERNEL}`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`)`

[Fix #1339] Add kernel-build to packages when used 2015-07-16 22:23:29 +00:00			`if(NOT OSQUERY_BUILD_RELEASE)`
			`set_target_properties(osquery_events_kernel`
			`PROPERTIES COMPILE_DEFINITIONS "KERNEL_TEST=1")`
			`endif()`

			`file(GLOB OSQUERY_EVENTS_KERNEL_TESTS "kernel/tests/*.cpp")`
			`ADD_OSQUERY_KERNEL_TEST(${OSQUERY_EVENTS_KERNEL_TESTS})`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00
			`if(APPLE)`
Fast tests 2015-04-27 09:12:58 +00:00			`file(GLOB OSQUERY_DARWIN_EVENTS_TESTS "darwin/tests/*.cpp")`
			`ADD_OSQUERY_TEST(FALSE ${OSQUERY_DARWIN_EVENTS_TESTS})`
linux/inotify_tests.cpp is Linux only 2014-11-16 20:27:45 +00:00			`elseif(LINUX)`
Fast tests 2015-04-27 09:12:58 +00:00			`file(GLOB OSQUERY_LINUX_EVENTS_TESTS "linux/tests/*.cpp")`
			`ADD_OSQUERY_TEST(FALSE ${OSQUERY_LINUX_EVENTS_TESTS})`
[events] Linux inotify event type 2014-09-19 08:54:33 +00:00			`endif()`