diff --git a/osquery/core/init.cpp b/osquery/core/init.cpp index 8b9e4bab..e099edef 100644 --- a/osquery/core/init.cpp +++ b/osquery/core/init.cpp @@ -8,10 +8,12 @@ * */ +#include #include #include #include +#include #include #include @@ -112,6 +114,28 @@ Initializer::Initializer(int argc, char* argv[], ToolType tool) FLAGS_logger_plugin = STR(OSQUERY_DEFAULT_LOGGER_PLUGIN); #endif + if (tool == OSQUERY_TOOL_SHELL) { + // The shell is transient, rewrite config-loaded paths. + osquery::FLAGS_disable_logging = true; + + // Get the caller's home dir for temporary storage/state management. + auto user = getpwuid(getuid()); + std::string homedir; + if (getenv("HOME") != nullptr) { + homedir = std::string(getenv("HOME")) + "/.osquery"; + } else if (user != nullptr || user->pw_dir != nullptr) { + homedir = std::string(user->pw_dir) + "/.osquery"; + } else { + homedir = "/tmp/osquery"; + } + + if (osquery::pathExists(homedir).ok() || + boost::filesystem::create_directory(homedir)) { + osquery::FLAGS_database_path = homedir + "/shell.db"; + osquery::FLAGS_extensions_socket = homedir + "/shell.em"; + } + } + // Set version string from CMake build GFLAGS_NAMESPACE::SetVersionString(OSQUERY_VERSION); diff --git a/osquery/main/daemon.cpp b/osquery/main/daemon.cpp index 863d4bcb..cd01a2d0 100644 --- a/osquery/main/daemon.cpp +++ b/osquery/main/daemon.cpp @@ -13,8 +13,6 @@ #include #include -#include "osquery/core/watcher.h" - const std::string kWatcherWorkerName = "osqueryd: worker"; int main(int argc, char* argv[]) { diff --git a/osquery/main/shell.cpp b/osquery/main/shell.cpp index e158e4f4..cc506e6c 100644 --- a/osquery/main/shell.cpp +++ b/osquery/main/shell.cpp @@ -8,26 +8,11 @@ * */ -#include #include -#include #include -#include -#include -#include - -const std::string kShellTemp = "/tmp/osquery"; int main(int argc, char *argv[]) { - // The shell is transient, rewrite config-loaded paths. - if (osquery::pathExists(kShellTemp).ok() || - boost::filesystem::create_directory(kShellTemp)) { - osquery::FLAGS_database_path = kShellTemp + "/shell.db"; - osquery::FLAGS_extensions_socket = kShellTemp + "/shell.em"; - osquery::FLAGS_disable_logging = true; - } - // Parse/apply flags, start registry, load logger/config plugins. osquery::Initializer runner(argc, argv, osquery::OSQUERY_TOOL_SHELL); runner.start();