Commit Graph

5523 Commits

Author SHA1 Message Date
Stefano Bonicatti
0654c20501
CMake: Fix and cleanup compile flags (#6521)
Add a description to the function preparing the targets carrying the
main compiler and linker flags.

Convert CMake default flags to the ones we use, instead of overriding
them later via targets.
This can also avoid having us use the wrong CRT on Windows if we forget to link
against osquery_cxx_settings.

Reduce the "overriding <flagX> with <flagY>" messages on Windows by
removing the warning level from the default flags, and adding that
to the specific osquery_<c|cxx>_settings target, so that non internal
targets can choose their own level.

Minor cleanups

Fix osquery/osquery#6509
2020-06-24 21:54:47 -04:00
Teddy Reed
5bc3d806e7
docs: Add note to bump the Homebrew cask (#6519) 2020-06-24 12:03:00 -04:00
Teddy Reed
8310159a7a
tests: Fix atom_packages, processes, rpm_packages flakiness (#6518) 2020-06-24 08:21:23 -04:00
Teddy Reed
0b085c36e9
bug: Do not use system proxy for AWS local authority (#6512) 2020-06-23 13:50:01 -04:00
Nick Anderson
d6e7b25706
packaging: updating docs on cpack usage to include Chocolatey (#6022) 2020-06-23 10:49:55 -07:00
Teddy Reed
e2e9e764e6
bug: Fix typed_row table caching (#6508) 2020-06-23 13:48:36 -04:00
Alessandro Gario
15448199f5
Implement event batching support for Windows tables (#6280)
* Windows events: Complete rewrite, implementing tests

* Windows events: Convert the 'keywords' column to TEXT

Since SQLite does not support unsigned 64-bit integers, this changes
the 'keywords' column type to TEXT.
2020-06-23 19:22:19 +02:00
Teddy Reed
c3bd427f4d
http: Use sync resolve (#6490) 2020-06-12 12:07:19 -04:00
James Jerger
d09ad2b1d7
Add support for basic chassis information (#5282) 2020-06-10 17:28:21 -04:00
Teddy Reed
2c453d7508
Only emit 'denylist' warning once (#6493) 2020-06-08 13:23:24 -04:00
Teddy Reed
429228d75e
docs: Remove references to brew in macOS install (#6494) 2020-06-08 13:22:52 -04:00
analyzeDFIR
c197af9716
Fix for #5890: Event Format Results and the Kafka Logger (#6449) 2020-06-06 21:44:26 -04:00
Nabil Schear
0533399039
make apt_sources table parsing much more resilient (#6482) 2020-06-06 21:28:03 -04:00
Stefano Bonicatti
411556b9a5
Make file and hash container columns hidden (#6486)
This is for consistency with the decisions taken
for PR osquery/osquery#6413 and osquery/osquery#6414.

We also update the integration test helper to accept custom constraints,
in the case the table has required columns.
2020-06-06 21:26:44 -04:00
Teddy Reed
08bcf66ef2
Update documentation to use 'allow list' and 'deny list' diction (#6489)
Update documentation to use 'allow list' and 'deny list' diction
2020-06-06 14:32:29 -04:00
Stefano Bonicatti
2085b175e1
Add validate_container_rows helper for integration tests (#6485)
This simple helper takes a table name and
an already prepared rows map to add the container
columns, which are normally hidden, and call validate_rows on it.

We use this function in deb_packages, rpm_packages, npm_packages,
os_version integration tests.
2020-06-05 21:22:44 -04:00
William Theaker
2ae56d368e
Add Auto Table Construction to docs (#6476) 2020-06-05 21:21:54 -04:00
Stefano Bonicatti
ad6b8fa24f
Change ErrorBase::takeUnderlyingError to non const (#6483)
Fix a build error with newer LLVM/Clang (11), as found on
oss-fuzz.

The member function returns a member variable via std::move,
but the member function is marked as const.
Since that variable to be actually moved would require
the class instance to be non const, a copy is used instead;
the return type has its copy constructor deleted though,
so this is always incorrect and removing the const qualifier
is the solution.
2020-06-05 21:20:56 -04:00
Zachary Wasserman
4e1d31c72a
Use 'denylist' instead of 'blacklist' in query scheduling (#6487) 2020-06-05 21:05:59 -04:00
Zachary Wasserman
86bc8bc8a3
Change compile time 'blacklist' to 'denylist' (#6488) 2020-06-05 21:03:04 -04:00
Teddy Reed
1e50815e7c
docs: Improve the new table tutorial (#6479)
Improve the new table tutorial
2020-06-05 14:24:17 -04:00
Stefano Bonicatti
e2d885b335
Add container access to the os_version table (#6413)
* Add container access to the os_version table

* Change new container columns to hidden
2020-06-05 20:22:34 +02:00
Stefano Bonicatti
dba5f1464e
Add container access to DEB, RPM, NPM packages tables (#6414)
* Add container access to DEB, RPM, NPM packages tables

* Change new container columns to hidden
2020-06-05 20:22:03 +02:00
Stefano Bonicatti
c691ac64cd
Actually use the patched libelfin version (#6480)
This is a followup of PR osquery/osquery#6472,
while the code was patched we were still using the unpatched version.
This should finally fix ossfuzz build failure.
2020-06-04 21:16:28 -04:00
herbmaster
ef65c779b1
Link librdkafka on windows (#6454) 2020-06-01 15:53:01 -04:00
Breakwell
3a63e344f3
Only explode registry key if it can be tokenized (#6474) 2020-06-01 13:58:37 -04:00
Stefano Bonicatti
7f21ccfe67
Drop the facebook and source_migration layers (#6473)
We have ported all platforms to use the source layer.
The facebook layer is not needed anymore since we build everything from source now,
the same is for the transitional source_migration layer.

Minor cleanups about the recently removed python modules.
2020-06-01 09:58:56 -04:00
Stefano Bonicatti
ada1692417
Fix libelfin build on ossfuzz and LLVM/Clang 10 (#6472)
The set_binding function is incorrectly marked as const,
since it actually modifies one of the struct members.
This was somehow not caught by older compilers,
but is failing on LLVM/Clang 10, so we create a patch to fix this.
2020-06-01 09:57:55 -04:00
Teddy Reed
c34bdf6214
codegen: Port Jinja2 to Templite (#6470) 2020-05-31 18:36:47 -04:00
Teddy Reed
34cc6f1411
libraries: Move ssdeep-cpp to source_migration (#6464) 2020-05-30 10:21:51 +02:00
Teddy Reed
9d371124f8
libraries: Move smartmontools to source_migration (#6465) 2020-05-30 10:21:33 +02:00
Stefano Bonicatti
d7c43e61db
Pass the minimum macOS SDK version to openssl only if explicitly set (#6471) 2020-05-29 22:19:18 -04:00
Ted Reed
a8469d63f1 macos: Add locks around auditpipe and event ID accesses 2020-05-28 23:02:09 -04:00
Ted Reed
ca87a35121 macos: Add small optimizations to OpenBSM 2020-05-28 23:02:09 -04:00
Ted Reed
11d8f3e7d1 macos: Switch OpenBSM to block while waiting for data 2020-05-28 23:02:09 -04:00
Ted Reed
ba5c1522fe Do not allow EventPublishers to check for interrupted 2020-05-28 23:02:09 -04:00
Ted Reed
b1940e45c7 macos: Add polling to OpenBSM publisher 2020-05-28 23:02:09 -04:00
Stefano Bonicatti
03cf73367b
Build openssl with the macOS SDK version taken from CMake (#6469) 2020-05-28 12:09:08 -04:00
Stefano Bonicatti
11bdf32188
Fix rpm and deb package name format (#6468)
By using RPM-DEFAULT and DEB-DEFAULT as package names,
CPack leaves the naming of the packages to the underlying
packaging tools which will use the standard naming format.
2020-05-28 12:06:21 -04:00
Mike Myers
8a9fb0558e
Correct the 'cwd' and 'root' columns of processes table on Windows (#6459)
Correct the 'cwd' and 'root' columns of processes table on Windows
2020-05-26 14:29:49 -04:00
Nick Anderson
d1feab7bf2
release: adding nupkg cpack build option, updating win deployment script (#6262) 2020-05-25 12:42:06 -04:00
Breakwell
a154e45026
Add additional logging in the watcher for windows (#6376)
Co-authored-by: Teddy Reed <teddy@casualhacking.io>
2020-05-25 12:33:21 -04:00
Teddy Reed
25e0088e9f
Use LOAD_LIBRARY_SEARCH_SYSTEM32 for LoadLibrary (#6458) 2020-05-25 12:30:17 -04:00
Teddy Reed
247f8d644b
Fix potential overread bug in package_bom (#6461) 2020-05-25 12:27:46 -04:00
srikwit
ff1227f4d3
Fixing the description of failed_login_count from account_policy_data (#6415) 2020-05-25 12:21:40 -04:00
Oleg Dolgov
2bf31f3311
build sleuthkit under windows (#6445) 2020-05-25 12:17:11 -04:00
Mike Myers
c75ae5bfd2
Fix the handling of empty args strings, on Windows (#6460) 2020-05-25 12:05:56 -04:00
uptycs-nishant
6c75b041dd
macos: automating audit rules install (#6447) 2020-05-25 12:05:27 -04:00
Stefano Bonicatti
b64a63f6e3
Do not install openssl docs (#6441)
This is meant to reduce the noise in the installation output of openssl,
since docs would easily fill the scrollback of most terminals.
Since we don't care about the docs, only install binaries.
2020-05-23 09:01:44 -04:00
Teddy Reed
d8e4d5e98a
Fix package_bom table (#6457) 2020-05-22 16:30:20 -04:00