diff --git a/README.md b/README.md index 343509a6..63150e6e 100644 --- a/README.md +++ b/README.md @@ -10,13 +10,13 @@ The tools make low-level operating system analytics and monitoring both performa | Platform | Build status | | | | |----------|---------------|---|---|---| -RHEL 6.5 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL6Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL6Package/) | | | +RHEL 6.5 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL6Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL6Package/) | | | RHEL 7.0 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL7Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildRHEL7Package/) | | **Homepage:** | https://osquery.io CentOS 6.5 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildCentOS6Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildCentOS6Package/) | | **Downloads:** | https://osquery.io/downloads CentOS 7.0 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildCentOS7Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildCentOS7Package/) | | **Tables:** | https://osquery.io/tables Ubuntu 12.04 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildUbuntu12Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildUbuntu12Package/) | | **Guide:** | https://osquery.readthedocs.org Ubuntu 14.04 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildUbuntu14Package/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildUbuntu14Package/) | | **Homebrew:** | `brew install osquery` -OS X 10.10 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildOSXPackage/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildOSXPackage/) | | | +OS X 10.10 | [![Build Status](https://jenkins.osquery.io/job/osqueryMasterBuildOSXPackage/badge/icon)](https://jenkins.osquery.io/job/osqueryMasterBuildOSXPackage/) | | | #### What is osquery? diff --git a/docs/doxygen/osquery.css b/docs/doxygen/osquery.css index 32bd646c..6599f84c 100644 --- a/docs/doxygen/osquery.css +++ b/docs/doxygen/osquery.css @@ -181,7 +181,7 @@ pre.fragment { } div.fragment { - + padding: 6px 10px; margin: 15px 0px; border: solid 1px rgb(221, 221, 221); @@ -260,7 +260,7 @@ div.groupHeader { margin-left: 0px; margin-top: 9px; margin-bottom: 4.7px; - + font-size: 19px; font-weight: normal; } @@ -308,7 +308,7 @@ p.formulaDsp { } img.formulaDsp { - + } img.formulaInl { @@ -366,20 +366,20 @@ span.charliteral { color: #008080 } -span.vhdldigit { - color: #ff00ff +span.vhdldigit { + color: #ff00ff } -span.vhdlchar { - color: #000000 +span.vhdlchar { + color: #000000 } -span.vhdlkeyword { - color: #700070 +span.vhdlkeyword { + color: #700070 } -span.vhdllogic { - color: #ff0000 +span.vhdllogic { + color: #ff0000 } blockquote { @@ -475,7 +475,7 @@ table.memberdecls { .mdescLeft, .mdescRight { padding: 0px 8px 4px 24px; color: black; - + font-family: "Lucida Grande", "Lucida Sans Unicode", Helvetica, Arial, Verdana, sans-serif; font-style: normal; } @@ -633,7 +633,7 @@ dl.reflist dd { .params, .retval, .exception, .tparams { margin-left: 0px; padding-left: 0px; -} +} .params .paramname, .retval .paramname { font-family: Courier, Consolas, monospace; @@ -645,8 +645,8 @@ dl.reflist dd { .params .paramtype { font-style: italic; vertical-align: top; -} - +} + .params .paramdir { font-family: "courier new",courier,monospace; vertical-align: top; @@ -821,8 +821,8 @@ table.fieldtable { .fieldtable td.fielddoc p:first-child { margin-top: 0px; -} - +} + .fieldtable td.fielddoc p:last-child { margin-bottom: 2px; } @@ -896,7 +896,7 @@ table.fieldtable { color: #283A5D; font-family: 'Lucida Grande',Geneva,Helvetica,Arial,sans-serif; //text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.9); - text-decoration: none; + text-decoration: none; } .navpath li.navelem a:hover @@ -925,7 +925,7 @@ div.summary padding-right: 5px; width: 50%; text-align: right; -} +} div.summary a { @@ -982,7 +982,7 @@ dl.warning, dl.attention { margin-left: 0px; padding: 6px 0px 3px 8px; - + border-left: 6px solid; border-color: #FF0000; } @@ -1043,19 +1043,19 @@ dl.section dd { vertical-align: bottom; border-collapse: separate; } - + #projectlogo img -{ +{ border: 0px none; } - + #projectname { font: 300% Tahoma, Arial,sans-serif; margin: 0px; padding: 2px 0px; } - + #projectbrief { font: 120% Tahoma, Arial,sans-serif; @@ -1150,7 +1150,7 @@ div.toc ul { list-style: none outside none; border: medium none; padding: 0px; -} +} div.toc li.level1 { margin-left: 0px; diff --git a/docs/wiki/deployment/file-integrity-monitoring.md b/docs/wiki/deployment/file-integrity-monitoring.md index cc9284b2..d6a4fcab 100644 --- a/docs/wiki/deployment/file-integrity-monitoring.md +++ b/docs/wiki/deployment/file-integrity-monitoring.md @@ -10,7 +10,7 @@ a directory or filename filter to limit the selection of files to monitor. For example, you may want to monitor `/etc` along with other files on a linux system. After you identify your target files and directories you wish to monitor, -add them to a new section in the config *file_paths*. +add them to a new section in the config *file_paths*. ## Example FIM Config diff --git a/docs/wiki/deployment/kernel-linux.md b/docs/wiki/deployment/kernel-linux.md index e8f7cbe6..2c68ea5a 100644 --- a/docs/wiki/deployment/kernel-linux.md +++ b/docs/wiki/deployment/kernel-linux.md @@ -5,7 +5,7 @@ are three areas of work in the OS X and Linux kernels: * Introspection into kernel-level integrity and data structures * Userland process (osqueryd) protections -# Linux Kernel +# Linux Kernel osquery's first bit of linux kernel instrumentation consists of camb (pronounce CAM-bee), which is a kernel module that exposes via sysfs some kernel integrity information. It currently lives out-of-tree. The below guide has been tested on 64-bit Ubuntu, but "most likely works" with other distros with minor tweaking. diff --git a/docs/wiki/deployment/log-aggregation.md b/docs/wiki/deployment/log-aggregation.md index df403f6d..20695126 100644 --- a/docs/wiki/deployment/log-aggregation.md +++ b/docs/wiki/deployment/log-aggregation.md @@ -102,6 +102,6 @@ Splunk will automatically extract the relevant fields for analytics, as shown be ### Rsyslog, Fluentd, Scribe, etc -If you're using a log forwarder which has less requirements on how data is stored (ie: Splunk Forwarders require the use of Splunk, etc), then you have many options on how you can interact with osqueryd data. It is recommended that you use whatever log analytics platform that you're comfortable with. +If you're using a log forwarder which has less requirements on how data is stored (ie: Splunk Forwarders require the use of Splunk, etc), then you have many options on how you can interact with osqueryd data. It is recommended that you use whatever log analytics platform that you're comfortable with. -Many people are very comfortable with [Logstash](http://logstash.net/). If you already have an existing Logstash/Elasticsearch deployment, that is a great option to exercise. If your organization uses a different backend log management solution, osquery should tie into that with minimal effort. \ No newline at end of file +Many people are very comfortable with [Logstash](http://logstash.net/). If you already have an existing Logstash/Elasticsearch deployment, that is a great option to exercise. If your organization uses a different backend log management solution, osquery should tie into that with minimal effort. diff --git a/docs/wiki/deployment/performance-safety.md b/docs/wiki/deployment/performance-safety.md index 10956ad2..516862bb 100644 --- a/docs/wiki/deployment/performance-safety.md +++ b/docs/wiki/deployment/performance-safety.md @@ -1,4 +1,4 @@ -Performance is a core feature of osquery's visibility capability. However, the tool is very powerful and there are opportunities to ruin the performance guarantees with ill-formed queries. +Performance is a core feature of osquery's visibility capability. However, the tool is very powerful and there are opportunities to ruin the performance guarantees with ill-formed queries. This guide provides an overview and tutorial for assuring performance of the osquery scheduled queries, as well as performance-centric development practices/enforcements. @@ -34,29 +34,29 @@ Consider the following `osquery.conf`: "processes_not_on_disk": { "query": "select * from processes where on_disk != 1;", "interval": 60 - } + } } } ``` Each query provides useful information and will run every minute. But what sort of impact will this have on the client machines? -For this we can use `./tools/profile.py` to profile the queries by running them for a configured number of rounds and reporting the pre-defined performance category of each. A higher category result means higher impact. High impact queries should be avoided, but if the information is valuable consider running them less-often. +For this we can use `./tools/profile.py` to profile the queries by running them for a configured number of rounds and reporting the pre-defined performance category of each. A higher category result means higher impact. High impact queries should be avoided, but if the information is valuable consider running them less-often. ``` $ sudo -E python ./tools/profile.py --config osquery.conf Profiling query: select * from kernel_extensions where name not like 'com.apple.%' and name != '__kernel__'; - D:0 C:0 M:0 F:0 U:1 non_apple_kexts (1/1): duration: 0.519426107407 cpu_time: 0.096729864 memory: 6447104 fds: 5 utilization: 9.5 + D:0 C:0 M:0 F:0 U:1 non_apple_kexts (1/1): duration: 0.519426107407 cpu_time: 0.096729864 memory: 6447104 fds: 5 utilization: 9.5 Profiling query: select name, path, bundle_version, minimum_system_version, applescript_enabled, bundle_executable from apps; - D:0 C:0 M:0 F:0 U:1 installed_applications (1/1): duration: 0.507317066193 cpu_time: 0.113432314 memory: 7639040 fds: 6 utilization: 11.15 + D:0 C:0 M:0 F:0 U:1 installed_applications (1/1): duration: 0.507317066193 cpu_time: 0.113432314 memory: 7639040 fds: 6 utilization: 11.15 Profiling query: select service, process from alf_services where state != 0; - D:0 C:0 M:0 F:0 U:0 alf_services (1/1): duration: 0.525090932846 cpu_time: 0.021108868 memory: 5406720 fds: 5 utilization: 1.9 + D:0 C:0 M:0 F:0 U:0 alf_services (1/1): duration: 0.525090932846 cpu_time: 0.021108868 memory: 5406720 fds: 5 utilization: 1.9 Profiling query: select * from processes where on_disk != 1; - D:0 C:0 M:0 F:0 U:0 processes_not_on_disk (1/1): duration: 0.521270990372 cpu_time: 0.030440911 memory: 6148096 fds: 5 utilization: 2.8 + D:0 C:0 M:0 F:0 U:0 processes_not_on_disk (1/1): duration: 0.521270990372 cpu_time: 0.030440911 memory: 6148096 fds: 5 utilization: 2.8 Profiling query: select name, version from kernel_extensions; - D:0 C:0 M:0 F:0 U:1 all_kexts (1/1): duration: 0.522475004196 cpu_time: 0.089579066 memory: 6500352 fds: 5 utilization: 8.65 + D:0 C:0 M:0 F:0 U:1 all_kexts (1/1): duration: 0.522475004196 cpu_time: 0.089579066 memory: 6500352 fds: 5 utilization: 8.65 Profiling query: select distinct process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.on_disk, process.parent, process.start_time from processes as process join listening_ports as listening on process.pid = listening.pid; - D:2 C:1 M:0 F:0 U:2 processes_binding_to_ports (1/1): duration: 1.02116107941 cpu_time: 0.668809664 memory: 6340608 fds: 5 utilization: 44.3 + D:2 C:1 M:0 F:0 U:2 processes_binding_to_ports (1/1): duration: 1.02116107941 cpu_time: 0.668809664 memory: 6340608 fds: 5 utilization: 44.3 ``` The results (utilization=2) suggest running `processes_binding_to_ports` less often. @@ -65,7 +65,7 @@ To estimate how often these should run you should evaluate what a differential i ## Continuous Build -The continuous integration for osquery is currently under development. The previous CI solution was unreliably failing builds due to network and memory issues. +The continuous integration for osquery is currently under development. The previous CI solution was unreliably failing builds due to network and memory issues. The build will run each of the support operating system platform/versions and include the following phases: @@ -77,7 +77,7 @@ The build will run each of the support operating system platform/versions and in ## Virtual table blacklist -Performance impacting virtual tables are most likely the result of missing features/tooling in osquery. Because of their dependencies on core optimizations there's no hard including the table generation code in master as long as the table is blacklisted when a non-developer builds the tool suite. +Performance impacting virtual tables are most likely the result of missing features/tooling in osquery. Because of their dependencies on core optimizations there's no hard including the table generation code in master as long as the table is blacklisted when a non-developer builds the tool suite. If you are developing latent tables that would be blacklisted please make sure you are relying on a feature with a clear issue and traction. Then add your table name (as it appears in the `.table` spec) to `osquery/tables/specs/blacklist` and adopt: @@ -85,7 +85,7 @@ If you are developing latent tables that would be blacklisted please make sure y $ DISABLE_BLACKLIST=1 make ``` -For your build iteration. +For your build iteration. ## Deployment profiling diff --git a/docs/wiki/development/building.md b/docs/wiki/development/building.md index 3d9af827..fa24afcf 100644 --- a/docs/wiki/development/building.md +++ b/docs/wiki/development/building.md @@ -101,7 +101,7 @@ make sanitize # Run clean first, then rebuild with sanitations Generating the osquery SDK or sync: ``` -make sdk # Build only the osquery SDK (libosquery.a) +make sdk # Build only the osquery SDK (libosquery.a) make sync # Create a tarball for building the SDK externally ``` diff --git a/docs/wiki/development/contributing-code.md b/docs/wiki/development/contributing-code.md index 85f8ae51..b26c5e61 100644 --- a/docs/wiki/development/contributing-code.md +++ b/docs/wiki/development/contributing-code.md @@ -10,6 +10,6 @@ The format style used by osquery is defined by the configurations of osquery's [ ## Style guide -If you would really like a style guide to follow or refer to, please use the [LLVM Coding Standards](http://llvm.org/docs/CodingStandards.html). +If you would really like a style guide to follow or refer to, please use the [LLVM Coding Standards](http://llvm.org/docs/CodingStandards.html). -Keep in mind, osquery's style configurations are slightly different than vanilla LLVM coding standards, so be sure to still run `make format` before submitting any code. \ No newline at end of file +Keep in mind, osquery's style configurations are slightly different than vanilla LLVM coding standards, so be sure to still run `make format` before submitting any code. diff --git a/docs/wiki/development/pubsub-framework.md b/docs/wiki/development/pubsub-framework.md index f1e90ffd..5ab52b95 100644 --- a/docs/wiki/development/pubsub-framework.md +++ b/docs/wiki/development/pubsub-framework.md @@ -8,7 +8,7 @@ To solve for this osquery exposes a [pubsub framework](https://github.com/facebo An osquery event publisher is a combination of a threaded run loop and event storage abstraction. The publisher loops on some selected resource or uses operating system APIs to register callbacks. The loop or callback introspects on the event and sends it to every appropriate subscriber. An osquery event subscriber may instruct a publisher, save published data, and must react to a query by returning appropriate data. -The pubsub runflow is exposed as a publisher `setUp()`, a series of `addSubscription(const SubscriptionRef)` by subscribers, a publisher `configure()`, and finally a new thread scheduled with the publisher's `run()` static method as the entrypoint. For every event the publisher receives it will loop through every `Subscription` and call `fire(const EventContextRef, EventTime)` to send the event to the subscriber. +The pubsub runflow is exposed as a publisher `setUp()`, a series of `addSubscription(const SubscriptionRef)` by subscribers, a publisher `configure()`, and finally a new thread scheduled with the publisher's `run()` static method as the entrypoint. For every event the publisher receives it will loop through every `Subscription` and call `fire(const EventContextRef, EventTime)` to send the event to the subscriber. ## Example: inotify diff --git a/include/osquery/database.h b/include/osquery/database.h index f0a61096..d6a65ade 100644 --- a/include/osquery/database.h +++ b/include/osquery/database.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/database/db_handle.h b/include/osquery/database/db_handle.h index 6ef66e90..5b263cde 100644 --- a/include/osquery/database/db_handle.h +++ b/include/osquery/database/db_handle.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/database/query.h b/include/osquery/database/query.h index bd4183ac..eeb79cc4 100644 --- a/include/osquery/database/query.h +++ b/include/osquery/database/query.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/database/results.h b/include/osquery/database/results.h index aad3ebec..672b8a88 100644 --- a/include/osquery/database/results.h +++ b/include/osquery/database/results.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/events.h b/include/osquery/events.h index 5812e13d..41565423 100644 --- a/include/osquery/events.h +++ b/include/osquery/events.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ @@ -486,7 +486,7 @@ class EventSubscriberPlugin : public Plugin { * * @return List of 'index.step' index strings. */ - std::vector getIndexes(EventTime start, + std::vector getIndexes(EventTime start, EventTime stop, int list_key = 0); diff --git a/include/osquery/flags.h b/include/osquery/flags.h index 0eb9f8fe..c540ccc4 100644 --- a/include/osquery/flags.h +++ b/include/osquery/flags.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/logger.h b/include/osquery/logger.h index 0efb2881..806cd25d 100644 --- a/include/osquery/logger.h +++ b/include/osquery/logger.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/include/osquery/registry.h b/include/osquery/registry.h index 12c02f00..f5a31093 100644 --- a/include/osquery/registry.h +++ b/include/osquery/registry.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/config/plugins/filesystem.cpp b/osquery/config/plugins/filesystem.cpp index b90eb98b..5e25145f 100644 --- a/osquery/config/plugins/filesystem.cpp +++ b/osquery/config/plugins/filesystem.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/core/conversions.cpp b/osquery/core/conversions.cpp index 0d41f4e2..931cb781 100644 --- a/osquery/core/conversions.cpp +++ b/osquery/core/conversions.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/core/conversions.h b/osquery/core/conversions.h index 6d4b996b..83cb9ee2 100644 --- a/osquery/core/conversions.h +++ b/osquery/core/conversions.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/core/darwin/conversions.cpp b/osquery/core/darwin/conversions.cpp index 6a722e10..c7b07814 100644 --- a/osquery/core/darwin/conversions.cpp +++ b/osquery/core/darwin/conversions.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/core/text.cpp b/osquery/core/text.cpp index 2c0e7957..0d530b7a 100644 --- a/osquery/core/text.cpp +++ b/osquery/core/text.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/devtools/printer.cpp b/osquery/devtools/printer.cpp index c95f3381..4bd6a985 100644 --- a/osquery/devtools/printer.cpp +++ b/osquery/devtools/printer.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/devtools/shell.cpp b/osquery/devtools/shell.cpp index 9fded44a..df0d5aa4 100644 --- a/osquery/devtools/shell.cpp +++ b/osquery/devtools/shell.cpp @@ -413,7 +413,7 @@ static const char needCsvQuote[] = { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, - 1, 1, 1, 1, 1, 1, + 1, 1, 1, 1, 1, 1, }; // clang-format on diff --git a/osquery/dispatcher/dispatcher.cpp b/osquery/dispatcher/dispatcher.cpp index 4c7f10d3..3a5cbbbd 100644 --- a/osquery/dispatcher/dispatcher.cpp +++ b/osquery/dispatcher/dispatcher.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/dispatcher/scheduler.cpp b/osquery/dispatcher/scheduler.cpp index 215e03a4..3a9adb79 100644 --- a/osquery/dispatcher/scheduler.cpp +++ b/osquery/dispatcher/scheduler.cpp @@ -7,7 +7,7 @@ * of patent rights can be found in the PATENTS file in the same directory. * */ - + #include #include diff --git a/osquery/events/darwin/fsevents.h b/osquery/events/darwin/fsevents.h index 56e69c23..5471d4f8 100644 --- a/osquery/events/darwin/fsevents.h +++ b/osquery/events/darwin/fsevents.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/darwin/iokit_hid.cpp b/osquery/events/darwin/iokit_hid.cpp index 609bf8e5..c11b3ae9 100644 --- a/osquery/events/darwin/iokit_hid.cpp +++ b/osquery/events/darwin/iokit_hid.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/darwin/iokit_hid.h b/osquery/events/darwin/iokit_hid.h index e50abda5..5d3dae6d 100644 --- a/osquery/events/darwin/iokit_hid.h +++ b/osquery/events/darwin/iokit_hid.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/darwin/scnetwork.cpp b/osquery/events/darwin/scnetwork.cpp index 3076ddd8..638aaa18 100644 --- a/osquery/events/darwin/scnetwork.cpp +++ b/osquery/events/darwin/scnetwork.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/darwin/scnetwork.h b/osquery/events/darwin/scnetwork.h index c0dbf8a4..3103229c 100644 --- a/osquery/events/darwin/scnetwork.h +++ b/osquery/events/darwin/scnetwork.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/freebsd/fsevents.h b/osquery/events/freebsd/fsevents.h index 7245f063..144ffcdd 100644 --- a/osquery/events/freebsd/fsevents.h +++ b/osquery/events/freebsd/fsevents.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/linux/inotify.cpp b/osquery/events/linux/inotify.cpp index a28877d3..8fa6408a 100644 --- a/osquery/events/linux/inotify.cpp +++ b/osquery/events/linux/inotify.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/linux/inotify.h b/osquery/events/linux/inotify.h index 32da7b63..82e53805 100644 --- a/osquery/events/linux/inotify.h +++ b/osquery/events/linux/inotify.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/linux/udev.cpp b/osquery/events/linux/udev.cpp index 2696a0c2..260899a4 100644 --- a/osquery/events/linux/udev.cpp +++ b/osquery/events/linux/udev.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/events/linux/udev.h b/osquery/events/linux/udev.h index 7ce8deb0..2889b17b 100644 --- a/osquery/events/linux/udev.h +++ b/osquery/events/linux/udev.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/examples/example_test.cpp b/osquery/examples/example_test.cpp index 851e0b31..cc38ee2c 100644 --- a/osquery/examples/example_test.cpp +++ b/osquery/examples/example_test.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/extensions/CMakeLists.txt b/osquery/extensions/CMakeLists.txt index e2d37ffe..e846a4ec 100644 --- a/osquery/extensions/CMakeLists.txt +++ b/osquery/extensions/CMakeLists.txt @@ -4,7 +4,7 @@ add_custom_command( ${THRIFT_COMPILER} --gen cpp:dense --gen py:dense "${CMAKE_SOURCE_DIR}/osquery.thrift" DEPENDS "${CMAKE_SOURCE_DIR}/osquery.thrift" WORKING_DIRECTORY "${CMAKE_BINARY_DIR}/generated" - OUTPUT ${OSQUERY_THRIFT_GENERATED_FILES} + OUTPUT ${OSQUERY_THRIFT_GENERATED_FILES} ) ADD_OSQUERY_LIBRARY(TRUE osquery_extensions diff --git a/osquery/filesystem/darwin/plist.mm b/osquery/filesystem/darwin/plist.mm index 54cdd9b8..5313c145 100644 --- a/osquery/filesystem/darwin/plist.mm +++ b/osquery/filesystem/darwin/plist.mm @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/filesystem/linux/proc.cpp b/osquery/filesystem/linux/proc.cpp index c80fefa6..f5ec7230 100644 --- a/osquery/filesystem/linux/proc.cpp +++ b/osquery/filesystem/linux/proc.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/logger/logger.cpp b/osquery/logger/logger.cpp index 04c0dd87..879ab86c 100644 --- a/osquery/logger/logger.cpp +++ b/osquery/logger/logger.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/logger/plugins/filesystem.cpp b/osquery/logger/plugins/filesystem.cpp index 6dba366a..b64b66e6 100644 --- a/osquery/logger/plugins/filesystem.cpp +++ b/osquery/logger/plugins/filesystem.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/main/empty.cpp b/osquery/main/empty.cpp index ab9ead5c..6ebbffc8 100644 --- a/osquery/main/empty.cpp +++ b/osquery/main/empty.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/main/lib.cpp b/osquery/main/lib.cpp index 3c7c0818..827ac381 100644 --- a/osquery/main/lib.cpp +++ b/osquery/main/lib.cpp @@ -3,11 +3,11 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ - + #include #include diff --git a/osquery/main/shell.cpp b/osquery/main/shell.cpp index b6c1744e..17082aa8 100644 --- a/osquery/main/shell.cpp +++ b/osquery/main/shell.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/events/darwin/hardware_events.cpp b/osquery/tables/events/darwin/hardware_events.cpp index 973a3492..55353f7b 100644 --- a/osquery/tables/events/darwin/hardware_events.cpp +++ b/osquery/tables/events/darwin/hardware_events.cpp @@ -3,11 +3,11 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ - + #include #include #include diff --git a/osquery/tables/events/darwin/passwd_changes.cpp b/osquery/tables/events/darwin/passwd_changes.cpp index 55a64ac1..9f595317 100644 --- a/osquery/tables/events/darwin/passwd_changes.cpp +++ b/osquery/tables/events/darwin/passwd_changes.cpp @@ -3,11 +3,11 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ - + #include #include diff --git a/osquery/tables/events/freebsd/passwd_changes.cpp b/osquery/tables/events/freebsd/passwd_changes.cpp index f24a5476..979541bf 100644 --- a/osquery/tables/events/freebsd/passwd_changes.cpp +++ b/osquery/tables/events/freebsd/passwd_changes.cpp @@ -3,11 +3,11 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ - + #include #include #include "osquery/events/freebsd/fsevents.h" diff --git a/osquery/tables/events/linux/hardware_events.cpp b/osquery/tables/events/linux/hardware_events.cpp index 70301bb7..140df99c 100644 --- a/osquery/tables/events/linux/hardware_events.cpp +++ b/osquery/tables/events/linux/hardware_events.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/events/linux/passwd_changes.cpp b/osquery/tables/events/linux/passwd_changes.cpp index b03d251c..48915263 100644 --- a/osquery/tables/events/linux/passwd_changes.cpp +++ b/osquery/tables/events/linux/passwd_changes.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/darwin/routes.cpp b/osquery/tables/networking/darwin/routes.cpp index e7b10049..5a6dc31e 100644 --- a/osquery/tables/networking/darwin/routes.cpp +++ b/osquery/tables/networking/darwin/routes.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/etc_hosts.cpp b/osquery/tables/networking/etc_hosts.cpp index 52d07b0f..946937ca 100644 --- a/osquery/tables/networking/etc_hosts.cpp +++ b/osquery/tables/networking/etc_hosts.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/etc_services.cpp b/osquery/tables/networking/etc_services.cpp index 2873a5d3..ab6de435 100644 --- a/osquery/tables/networking/etc_services.cpp +++ b/osquery/tables/networking/etc_services.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/freebsd/routes.cpp b/osquery/tables/networking/freebsd/routes.cpp index 8fee50f4..2cb09c67 100644 --- a/osquery/tables/networking/freebsd/routes.cpp +++ b/osquery/tables/networking/freebsd/routes.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/interfaces.cpp b/osquery/tables/networking/interfaces.cpp index f22c9bd6..4ec361a6 100644 --- a/osquery/tables/networking/interfaces.cpp +++ b/osquery/tables/networking/interfaces.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ @@ -78,7 +78,7 @@ void genDetailsFromAddr(const struct ifaddrs *addr, QueryData &results) { r["oerrors"] = BIGINT_FROM_UINT32(ifd->tx_errors); // Get Linux physical properties for the AF_PACKET entry. - int fd = socket(AF_INET, SOCK_DGRAM, 0); + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd >= 0) { struct ifreq ifr; memcpy(ifr.ifr_name, addr->ifa_name, IFNAMSIZ); @@ -91,7 +91,7 @@ void genDetailsFromAddr(const struct ifaddrs *addr, QueryData &results) { } if (ioctl(fd, SIOCGIFHWADDR, &ifr) >= 0) { - r["type"] = INTEGER_FROM_UCHAR(ifr.ifr_hwaddr.sa_family); + r["type"] = INTEGER_FROM_UCHAR(ifr.ifr_hwaddr.sa_family); } } diff --git a/osquery/tables/networking/linux/arp_cache.cpp b/osquery/tables/networking/linux/arp_cache.cpp index e5a3a600..3141d4af 100644 --- a/osquery/tables/networking/linux/arp_cache.cpp +++ b/osquery/tables/networking/linux/arp_cache.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/linux/inet_diag.h b/osquery/tables/networking/linux/inet_diag.h index 65b5d9e2..82532455 100644 --- a/osquery/tables/networking/linux/inet_diag.h +++ b/osquery/tables/networking/linux/inet_diag.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/linux/routes.cpp b/osquery/tables/networking/linux/routes.cpp index 30b84021..2bcb8154 100644 --- a/osquery/tables/networking/linux/routes.cpp +++ b/osquery/tables/networking/linux/routes.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/utils.cpp b/osquery/tables/networking/utils.cpp index 630fc519..e1cae07b 100644 --- a/osquery/tables/networking/utils.cpp +++ b/osquery/tables/networking/utils.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/networking/utils.h b/osquery/tables/networking/utils.h index 657c8af1..aec74309 100644 --- a/osquery/tables/networking/utils.h +++ b/osquery/tables/networking/utils.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/cpuid.cpp b/osquery/tables/system/cpuid.cpp index c4754cd1..4a518701 100644 --- a/osquery/tables/system/cpuid.cpp +++ b/osquery/tables/system/cpuid.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/crontab.cpp b/osquery/tables/system/crontab.cpp index 60cd6248..401fa924 100644 --- a/osquery/tables/system/crontab.cpp +++ b/osquery/tables/system/crontab.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/acpi_tables.cpp b/osquery/tables/system/darwin/acpi_tables.cpp index 671c8e8e..db7cc42a 100644 --- a/osquery/tables/system/darwin/acpi_tables.cpp +++ b/osquery/tables/system/darwin/acpi_tables.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/ad_config.cpp b/osquery/tables/system/darwin/ad_config.cpp index 28b9a47d..ea10d02e 100644 --- a/osquery/tables/system/darwin/ad_config.cpp +++ b/osquery/tables/system/darwin/ad_config.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/apps.cpp b/osquery/tables/system/darwin/apps.cpp index 7652d352..8d87db25 100644 --- a/osquery/tables/system/darwin/apps.cpp +++ b/osquery/tables/system/darwin/apps.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/extended_attributes.cpp b/osquery/tables/system/darwin/extended_attributes.cpp index 3e7e69d5..e23ce3d1 100644 --- a/osquery/tables/system/darwin/extended_attributes.cpp +++ b/osquery/tables/system/darwin/extended_attributes.cpp @@ -222,7 +222,7 @@ void getFileData(QueryData &results, if (isPrintable(x_att.attribute_data)) { r["base64"] = INTEGER(0); - r["value"] = x_att.attribute_data; + r["value"] = x_att.attribute_data; } else { r["base64"] = INTEGER(1); r["value"] = base64Encode(x_att.attribute_data); diff --git a/osquery/tables/system/darwin/firewall.cpp b/osquery/tables/system/darwin/firewall.cpp index 7a065457..c9a4311a 100644 --- a/osquery/tables/system/darwin/firewall.cpp +++ b/osquery/tables/system/darwin/firewall.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/firewall.h b/osquery/tables/system/darwin/firewall.h index fadcc064..c0e96a50 100644 --- a/osquery/tables/system/darwin/firewall.h +++ b/osquery/tables/system/darwin/firewall.h @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/groups.mm b/osquery/tables/system/darwin/groups.mm index 2c348ed7..59d4b993 100644 --- a/osquery/tables/system/darwin/groups.mm +++ b/osquery/tables/system/darwin/groups.mm @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/homebrew_packages.cpp b/osquery/tables/system/darwin/homebrew_packages.cpp index 59bf8541..53306fd9 100644 --- a/osquery/tables/system/darwin/homebrew_packages.cpp +++ b/osquery/tables/system/darwin/homebrew_packages.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/kernel_extensions.cpp b/osquery/tables/system/darwin/kernel_extensions.cpp index 71f78503..5eda28dd 100644 --- a/osquery/tables/system/darwin/kernel_extensions.cpp +++ b/osquery/tables/system/darwin/kernel_extensions.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/mounts.cpp b/osquery/tables/system/darwin/mounts.cpp index 2ad02903..c5478a70 100644 --- a/osquery/tables/system/darwin/mounts.cpp +++ b/osquery/tables/system/darwin/mounts.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/pci_devices.cpp b/osquery/tables/system/darwin/pci_devices.cpp index fb228e38..13ce3643 100644 --- a/osquery/tables/system/darwin/pci_devices.cpp +++ b/osquery/tables/system/darwin/pci_devices.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/startup_items.cpp b/osquery/tables/system/darwin/startup_items.cpp index 9792d866..3026d592 100644 --- a/osquery/tables/system/darwin/startup_items.cpp +++ b/osquery/tables/system/darwin/startup_items.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/usb_devices.cpp b/osquery/tables/system/darwin/usb_devices.cpp index 9d1f182c..13107c13 100644 --- a/osquery/tables/system/darwin/usb_devices.cpp +++ b/osquery/tables/system/darwin/usb_devices.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/users.mm b/osquery/tables/system/darwin/users.mm index 41217f14..5894e699 100644 --- a/osquery/tables/system/darwin/users.mm +++ b/osquery/tables/system/darwin/users.mm @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/darwin/xprotect.cpp b/osquery/tables/system/darwin/xprotect.cpp index e9846dae..cb6fd381 100644 --- a/osquery/tables/system/darwin/xprotect.cpp +++ b/osquery/tables/system/darwin/xprotect.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ @@ -27,7 +27,7 @@ namespace osquery { namespace tables { /// Path to XProtect.meta.plist and XProtect.plist -const std::string kXProtectPath = +const std::string kXProtectPath = "/System/Library/CoreServices/" "CoreTypes.bundle/Contents/Resources/"; diff --git a/osquery/tables/system/freebsd/groups.cpp b/osquery/tables/system/freebsd/groups.cpp index b9fe606c..acfff831 100644 --- a/osquery/tables/system/freebsd/groups.cpp +++ b/osquery/tables/system/freebsd/groups.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/freebsd/processes.cpp b/osquery/tables/system/freebsd/processes.cpp index 50832a6d..fcb068f5 100644 --- a/osquery/tables/system/freebsd/processes.cpp +++ b/osquery/tables/system/freebsd/processes.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/freebsd/users.cpp b/osquery/tables/system/freebsd/users.cpp index 1482b6c6..f4cac9c3 100644 --- a/osquery/tables/system/freebsd/users.cpp +++ b/osquery/tables/system/freebsd/users.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/last.cpp b/osquery/tables/system/last.cpp index 349e23cd..78406e3e 100644 --- a/osquery/tables/system/last.cpp +++ b/osquery/tables/system/last.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/disk_encryption.cpp b/osquery/tables/system/linux/disk_encryption.cpp index 5ae12b70..2e033515 100644 --- a/osquery/tables/system/linux/disk_encryption.cpp +++ b/osquery/tables/system/linux/disk_encryption.cpp @@ -45,7 +45,7 @@ void genFDEStatusForBlockDevice(const std::string &name, crypt_free(cd); break; } - + type = crypt_get_type(cd); if (crypt_get_active_device(cd, name.c_str(), &cad) < 0) { VLOG(1) << "Unable to get active device for " << name; diff --git a/osquery/tables/system/linux/groups.cpp b/osquery/tables/system/linux/groups.cpp index b537db9b..6b6d134a 100644 --- a/osquery/tables/system/linux/groups.cpp +++ b/osquery/tables/system/linux/groups.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/kernel_integrity.cpp b/osquery/tables/system/linux/kernel_integrity.cpp index c1d46aca..94bdde55 100644 --- a/osquery/tables/system/linux/kernel_integrity.cpp +++ b/osquery/tables/system/linux/kernel_integrity.cpp @@ -24,7 +24,7 @@ QueryData genKernelIntegrity(QueryContext &context) { std::string text_segment_hash; std::string syscall_addr_modified; - // Get an integral value, 0 or 1, for whether a syscall table pointer is modified. + // Get an integral value, 0 or 1, for whether a syscall table pointer is modified. auto f1 = osquery::readFile(kKernelSyscallAddrModifiedPath, content); if (f1.ok()) { boost::trim(content); diff --git a/osquery/tables/system/linux/kernel_modules.cpp b/osquery/tables/system/linux/kernel_modules.cpp index f3fadada..d6223ef0 100644 --- a/osquery/tables/system/linux/kernel_modules.cpp +++ b/osquery/tables/system/linux/kernel_modules.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/mounts.cpp b/osquery/tables/system/linux/mounts.cpp index d4b804c3..46879dba 100644 --- a/osquery/tables/system/linux/mounts.cpp +++ b/osquery/tables/system/linux/mounts.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/pci_devices.cpp b/osquery/tables/system/linux/pci_devices.cpp index 8a07587c..6af40231 100644 --- a/osquery/tables/system/linux/pci_devices.cpp +++ b/osquery/tables/system/linux/pci_devices.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/sysctl_utils.cpp b/osquery/tables/system/linux/sysctl_utils.cpp index a7764183..10a6de5c 100644 --- a/osquery/tables/system/linux/sysctl_utils.cpp +++ b/osquery/tables/system/linux/sysctl_utils.cpp @@ -99,7 +99,7 @@ void genAllControls(QueryData& results, fs::path(sub).filename().string() != subsystem) { // Request is limiting subsystem. continue; - } + } genControlInfo(sub, results, config); } } diff --git a/osquery/tables/system/linux/usb_devices.cpp b/osquery/tables/system/linux/usb_devices.cpp index 476e87bc..936a264d 100644 --- a/osquery/tables/system/linux/usb_devices.cpp +++ b/osquery/tables/system/linux/usb_devices.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/linux/users.cpp b/osquery/tables/system/linux/users.cpp index a816bacb..33cf79cc 100644 --- a/osquery/tables/system/linux/users.cpp +++ b/osquery/tables/system/linux/users.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/logged_in_users.cpp b/osquery/tables/system/logged_in_users.cpp index ae24a332..09c9b7f2 100644 --- a/osquery/tables/system/logged_in_users.cpp +++ b/osquery/tables/system/logged_in_users.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/shell_history.cpp b/osquery/tables/system/shell_history.cpp index b868a342..b32215bb 100644 --- a/osquery/tables/system/shell_history.cpp +++ b/osquery/tables/system/shell_history.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/system/suid_bin.cpp b/osquery/tables/system/suid_bin.cpp index 43811e68..42706e55 100644 --- a/osquery/tables/system/suid_bin.cpp +++ b/osquery/tables/system/suid_bin.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/templates/blacklist.cpp.in b/osquery/tables/templates/blacklist.cpp.in index ab071d7a..3a5a40b4 100644 --- a/osquery/tables/templates/blacklist.cpp.in +++ b/osquery/tables/templates/blacklist.cpp.in @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/utility/hash.cpp b/osquery/tables/utility/hash.cpp index 6b152d7d..831e4853 100644 --- a/osquery/tables/utility/hash.cpp +++ b/osquery/tables/utility/hash.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/osquery/tables/utility/time.cpp b/osquery/tables/utility/time.cpp index fbd84dc4..63dc790a 100644 --- a/osquery/tables/utility/time.cpp +++ b/osquery/tables/utility/time.cpp @@ -3,7 +3,7 @@ * All rights reserved. * * This source code is licensed under the BSD-style license found in the - * LICENSE file in the root directory of this source tree. An additional grant + * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ diff --git a/tools/codegen/amalgamate.py b/tools/codegen/amalgamate.py index d5d269c7..eff5f732 100755 --- a/tools/codegen/amalgamate.py +++ b/tools/codegen/amalgamate.py @@ -4,7 +4,7 @@ # All rights reserved. # # This source code is licensed under the BSD-style license found in the -# LICENSE file in the root directory of this source tree. An additional grant +# LICENSE file in the root directory of this source tree. An additional grant # of patent rights can be found in the PATENTS file in the same directory. from __future__ import absolute_import diff --git a/tools/codegen/genapi.py b/tools/codegen/genapi.py index 37c53ca4..bc5cc2a9 100755 --- a/tools/codegen/genapi.py +++ b/tools/codegen/genapi.py @@ -4,7 +4,7 @@ # All rights reserved. # # This source code is licensed under the BSD-style license found in the -# LICENSE file in the root directory of this source tree. An additional grant +# LICENSE file in the root directory of this source tree. An additional grant # of patent rights can be found in the PATENTS file in the same directory. from __future__ import absolute_import diff --git a/tools/codegen/gentable.py b/tools/codegen/gentable.py index abcc980b..a4b1c124 100755 --- a/tools/codegen/gentable.py +++ b/tools/codegen/gentable.py @@ -268,7 +268,7 @@ def description(text): table.description = text -def attributes(**kwargs): +def attributes(**kwargs): for attr in kwargs: table.attributes[attr] = kwargs[attr] diff --git a/tools/deployment/osquery.example.conf b/tools/deployment/osquery.example.conf index 3c5c246e..43246341 100644 --- a/tools/deployment/osquery.example.conf +++ b/tools/deployment/osquery.example.conf @@ -11,7 +11,7 @@ // If the daemon uses the 'filesystem' logging retriever then the log_dir // will also contain the query results. //"logger_path": "/var/log/osquery", - + // Set 'disable_logging' to true to prevent writing any info, warning, error // logs. If a logging plugin is selected it will still write query results. //"disable_logging": "false", @@ -28,7 +28,7 @@ // Write the pid of the osqueryd process to a pidfile/mutex. //"pidfile": "/var/osquery/osquery.pidfile", - + // Clear events from the osquery backing store after a number of seconds. "event_pubsub_expiry": "86000", @@ -50,7 +50,7 @@ /* Define a schedule of queries */ "schedule": { - // This is a simple example query that outputs information about osquery. + // This is a simple example query that outputs information about osquery. "info": { // The exact query to run. "query": "SELECT * FROM osquery_info", diff --git a/tools/formatting/git-clang-format.py b/tools/formatting/git-clang-format.py index 50137c99..7113d250 100644 --- a/tools/formatting/git-clang-format.py +++ b/tools/formatting/git-clang-format.py @@ -9,19 +9,19 @@ # #===------------------------------------------------------------------------===# -r""" -clang-format git integration -============================ - -This file provides a clang-format integration for git. Put it somewhere in your -path and ensure that it is executable. Then, "git clang-format" will invoke -clang-format on the changes in current files or a specific commit. - -For further details, run: -git clang-format -h - -Requires Python 2.7 -""" +r""" +clang-format git integration +============================ + +This file provides a clang-format integration for git. Put it somewhere in your +path and ensure that it is executable. Then, "git clang-format" will invoke +clang-format on the changes in current files or a specific commit. + +For further details, run: +git clang-format -h + +Requires Python 2.7 +""" import argparse import collections diff --git a/tools/profile.py b/tools/profile.py index 41fd954e..c04ee3d8 100755 --- a/tools/profile.py +++ b/tools/profile.py @@ -4,7 +4,7 @@ # All rights reserved. # # This source code is licensed under the BSD-style license found in the -# LICENSE file in the root directory of this source tree. An additional grant +# LICENSE file in the root directory of this source tree. An additional grant # of patent rights can be found in the PATENTS file in the same directory. from __future__ import absolute_import diff --git a/tools/provision/rhel.sh b/tools/provision/rhel.sh index da8f3619..1264614b 100755 --- a/tools/provision/rhel.sh +++ b/tools/provision/rhel.sh @@ -79,7 +79,7 @@ function main_rhel() { set_cc gcc set_cxx g++ - + package bzip2 package bzip2-devel package openssl-devel diff --git a/tools/tests/stress.py b/tools/tests/stress.py index d09e6546..2a97579e 100755 --- a/tools/tests/stress.py +++ b/tools/tests/stress.py @@ -4,7 +4,7 @@ # All rights reserved. # # This source code is licensed under the BSD-style license found in the -# LICENSE file in the root directory of this source tree. An additional grant +# LICENSE file in the root directory of this source tree. An additional grant # of patent rights can be found in the PATENTS file in the same directory. from __future__ import absolute_import