valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-08 02:18:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
5,273 Commits 2 Branches 109 Tags 25 MiB
07afc4e2a7
Commit Graph

269 Commits

Author SHA1 Message Date
Nick Anderson
c494bc56ae windows: relax "safe" permissions for binary execution (#3727) 2017-10-13 11:54:43 -07:00
Teddy Reed
988afd0aa9 filesystem: Use fs::path for PlatformFile ctor (#3720) 2017-09-24 21:24:31 -07:00
Teddy Reed
061dfeecb2 tests: Improve permissions tests as root (#3665) 2017-09-08 04:08:57 -04:00
Teddy Reed
e86470c96b [Fix #3625] Use readlink and add test for listening_ports (#3661) 2017-09-08 02:08:27 -04:00
Teddy Reed
205da3c698 rocksdb: Implement a 'backup' and recover feature for RocksDB (#3635) 2017-09-01 22:31:03 -07:00
Mitchell Grenier
8a963e8d40 [Distributed] Moving to RapidJSON (#3265) 2017-08-07 16:34:44 -07:00
Seshu Pasam
9b3be1c02d Fixes from static code analysis (#3512) 2017-08-01 20:13:25 -07:00
Mitchell Grenier
ba35a92243 Expand Carver APIs and Add Compression (#3386) 2017-07-31 11:11:45 -07:00
Mitchell Grenier
0c7059ed0a APFS Globbing Order Change (#3473) 2017-07-19 13:14:50 -07:00
Teddy Reed
99675fdbb2 audit: Increase speed when using socket_events (#3449) 2017-07-02 17:18:40 -07:00
ryanheffernan
80acd105f5 IE Extensions table for Windows - Browser Helper Objects (#3436) 2017-06-27 10:50:36 -07:00
Teddy Reed
7844a8ea1b nits: Use char-overload for find (#3363) 2017-05-29 23:13:10 -07:00
Teddy Reed
df82f8c50e filesystem: Remove read_user_max flag (#3348) 2017-05-28 22:36:41 -07:00
Mitchell Grenier
e0f5de75b9 Fix crash caused by boost's unhandled exception (#3309) 2017-05-23 09:29:03 -07:00
Mitchell Grenier
7ddb959b0d Fix an reading past the end of buffer (#3307) 2017-05-23 09:16:27 -07:00
Nick Anderson
95d916e24b [Fix #3268] extensions autoload now correctly spawns extension processes (#3269) 2017-05-11 16:51:48 -07:00
Teddy Reed
4372785d5d Refactor build logic to allow optional: yara, tsk, lldpd (#3226) 2017-04-28 13:45:41 -07:00
Teddy Reed
67440ab101 tests: Rewrite and add filesystem tests (#3156) 2017-04-10 21:32:16 -07:00
Teddy Reed
345c511a61 hash: Only return hashes for files hashed (#3106) 2017-03-25 18:03:21 -07:00
Teddy Reed
952ddac9db tests: Reduce large file test to 20M (#2971) 2017-02-06 00:55:17 -08:00
Nick Anderson
11da0674e6 Converting fileops to support Windows 7 (#2952) 2017-02-01 10:08:48 -08:00
Teddy Reed
0e9733f94c Simplify Registry and plugin concepts (#2887) 2017-01-07 12:21:35 -08:00
Teddy Reed
3f827e50bd Fix plist NSString raw pointer string conversion (#2865) 2016-12-12 18:00:49 -08:00
Teddy Reed
555d59eff6 Remove fsuid permissions drop for OS X and Linux (#2805) 2016-11-28 22:05:08 -08:00
Jonathan Lee
10d61c71b8 [Fix #2175] New test: zero permission file operations (#2711) 2016-11-18 08:12:27 -08:00
yying
ef3de3d030 Improved platformAccess functionality and improved formatting in fileops (#2743) 2016-11-18 00:15:23 -08:00
Teddy Reed
4fdea34a9d [Fix #2446] Consolidate namedPipe into socketExists (#2712) 2016-11-16 19:32:22 -08:00
Nick Anderson
1a0aa988f1 Updating bytes written and read cursor index (#2767) 2016-11-16 17:04:17 -08:00
yying
d573cf8e16 Improvements to platformChmod for closer POSIX behavior on Windows (#2725) 2016-11-08 14:40:53 -08:00
Teddy Reed
59f0bad67c Additional compiler checks, including shadow (#2486) 2016-11-06 01:17:04 -08:00
Nick Anderson
7d3d726ca6 Reduced size of 'large' test file (#2722) 2016-11-04 16:11:22 -07:00
Nick Anderson
8e77cfe545 Fixing windows related warnings for linux builds (#2720) 2016-11-03 23:52:51 -07:00
Nick Anderson
afbde7641a Adding large file write/read test for fileops (#2706) 2016-11-02 18:27:03 -07:00
yying
e5ba82993a Fixes PlatformFile issue with sharing (#2640) 2016-10-19 11:11:10 -07:00
Nick Anderson
81d2794b26 platformGetUid returns 0 for Administrator user (#2643) 2016-10-19 10:25:32 -07:00
Nick Anderson
208d2324d5 Extending chrome browser extension table to Windows (#2619) 2016-10-14 10:23:37 -07:00
Nick Anderson
2048d17931 Fixed pidfile read error on server 2k12 (#2617) 2016-10-13 15:18:42 -07:00
Nick Anderson
616d9f5953 Adding support for Windows platform_info table (#2611) 2016-10-12 09:01:32 -07:00
Teddy Reed
665c4fb9bc [Fix #2599] Read from Linux SMI sysfs node for SMBIOS (#2612) 
This also fixes odd behavior in Linux when reading a 'regular' file
from /sys that only returns a max of a page-read in bytes.
 2016-10-11 09:55:01 -07:00
Nick Anderson
07a2a3c292 Updating processes table to include memory (#2573) 2016-10-02 22:41:05 -07:00
Teddy Reed
6842797bf5 Create temp directory and fail over to user home (#2529) 2016-09-26 23:44:50 -07:00
yying
a27d6567e4 Core and Additional Tests (#2441) 2016-09-12 09:46:52 -07:00
Teddy Reed
817cb7ebd4 Fix minor sandboxes performance issues and plist parsing exceptions (#2455) 2016-09-09 19:45:37 -07:00
yying
84e6a3401a Reducing compiler warnings and fails on warn in VS (#2433) 2016-09-02 15:04:03 -07:00
Nick Anderson
fe7b8d98f9 Adding getSystemRoot function (#2386) 
Adding a cross platform function for getting the OS root
and returning it as a boost::fs::path
 2016-08-18 09:32:34 -07:00
Teddy Reed
1b75972181 [Fix #2387] Attempt to create user's osquery homedir (#2395) 2016-08-17 17:27:46 -07:00
Teddy Reed
e969b92a2e Fix code auditing job and disable Homebrew auto-update (#2392) 2016-08-17 16:00:30 -07:00
yying
50487c6880 Changes to make pidfile work on Windows (#2297) 2016-07-28 16:04:34 -07:00
Teddy Reed
7f304a0934 Various fixups and best practices (#2237) 2016-07-11 09:45:57 -07:00
Teddy Reed
54557b16e7 [Fix #2196] Fix osquery home directory checking (#2232) 2016-07-07 17:33:52 -07:00
Teddy Reed
48cb4d555d Add systemLog API (#2229) 
This includes a minor SDK refactor as it move quite a few specialized
functions and facilities from core.h into system.h. There was a breaking point
for needing to frequently update core includes.

The new logger systemLog function allows a call site to bypass logging config
and write a line to the OS logger (aka syslog).
 2016-07-07 15:16:28 -07:00
artemdinaburg
e6fbde820e Windows Daemon/Shell: Make osquery code more Windows-friendly (#2188) 2016-07-01 14:56:07 -07:00
artemdinaburg
5292100c22 Use vector.data() to get internal vector buffers (#2204) 2016-06-30 12:32:26 -07:00
Teddy Reed
9756713e36 Adds -fpermissive and fixes 'using' for anon struct (#2200) 2016-06-29 20:15:58 -07:00
Teddy Reed
47e1a5ba74 Use noexcept boost::filesystem overloads (#2195) 2016-06-27 16:39:04 -07:00
Nick Anderson
72df044ef5 Adding check for nullptr before dereferencing. This fixes #2185 (#2187) 2016-06-24 13:59:49 -07:00
yying
d2d9a27845 [Fix #2165] Use noexcept boost methods in PlatformFile (#2167) 2016-06-15 10:23:48 -07:00
Nick Anderson
cf30388705 Moved test_utils to it's own directory out of core. Updated references (#2154) 2016-06-09 10:49:26 -07:00
yying
9879733867 Filesystem Abstractions - Integrations (#2128) 
* Integrated filesystem operation abstraction code into filesystem.cpp
* Modified filesystem unit tests to be more platform agnostic
* Added append mode for PlatformFile
* Minor bug fixes in filesystem operations
 2016-06-07 14:08:50 -07:00
Nick Anderson
240958ea76 Fixed typing in FileOps tests (#2127) 
Some of the types in fileops tests were causing warnings to be thrown
during build, due to type mismatch. I've added a few local variables to
quiet these warnings.
 2016-06-02 15:46:55 -07:00
yying
5f81cd9e2b Filesystem Abstractions - Code and Unit Tests (#2119) 
* Implemented filesystem operations abstraction code
* Added filesystem operations abstraction unit tests
* Modified CMake configurations to support the building of the abstraction code and unit tests
 2016-05-31 12:20:38 -07:00
yying
26ad131c38 Building osquery unit tests on Windows 10 (#2100) 
Integrated process abstraction code into more locations
Defined new macros for abstracting across various platforms
Added GLOG_NO_ABBREVIATED_SEVERITIES for glog to support Windows
Fixed some minor CMake issues involving thrift
Updated gflags package; reflecting change in provision script
Preparing CMake config files for WIN32 support
 2016-05-17 12:39:11 -07:00
Teddy Reed
3de52846d0 Remove boost::thread 2016-03-11 11:50:44 -08:00
Teddy Reed
26c8b5640f Fix various lint issues 2016-03-09 19:55:39 -08:00
Teddy Reed
9a54af29ce Bump sqlite to 3.11.0 2016-02-21 22:40:37 -08:00
Baraa Hamodi
21c2237eca [osquery] Update copyright headers to new format. 2016-02-11 11:48:58 -08:00
Teddy Reed
8947dac232 [Fix #1814] Various fixes for Linux inotify 2016-02-03 17:00:41 -08:00
Teddy Reed
5824b891d3 Only discovery SMBIOS tables once on Linux 2015-12-19 20:40:05 -08:00
Teddy Reed
63d12789b4 Fix regression in file content predicate refactor 2015-12-14 15:24:55 -08:00
Teddy Reed
a99b62a31d Preserve atime and mtime by default for readFile 2015-12-11 22:18:45 -08:00
Teddy Reed
a72fa19536 Use a noexcept method of directory checking for hash 2015-11-20 13:32:56 -08:00
Teddy Reed
0d01a382b6 [Fix #1634] Add sys/stat to filesystem 2015-11-09 01:33:17 -08:00
Teddy Reed
41ba637030 Linux inotify should accept non-glob dirs 2015-11-04 13:46:47 -08:00
Teddy Reed
2cf9e95fa1 Allow user-controlled FIFOs 2015-11-04 01:29:54 -08:00
Teddy Reed
d27a7ecc4c Fix clang warnings, promote warnings to errors 2015-11-01 02:12:07 -08:00
Teddy Reed
97a6521445 Merge pull request #1614 from theopolis/drop_around_files 
Expand the scope of permissions dropping
 2015-10-30 17:07:04 -07:00
Teddy Reed
09e4e3c42e Expand the scope of permissions dropping 2015-10-30 09:56:33 -07:00
Teddy Reed
2cf7543181 [Fix #1611] Prevent fs links in inotify path search 2015-10-29 23:19:07 -07:00
Teddy Reed
b8087a1b26 Fix readFile TOCTOU error 2015-10-26 01:21:05 -07:00
Robert C. Seacord
1d9695ac31 eliminated some warnings from Clang 3.7 analyze mode 2015-10-21 06:02:58 +00:00
Robert C. Seacord
e57828aac3 changes for integer sign problems 2015-10-17 00:18:35 +00:00
Robert C. Seacord
acb2f6f628 eliminating diagnostics, mostly for comparisons between signed and unsigned operations 2015-10-16 16:10:37 +00:00
Teddy Reed
66888de80a Fix potential hang with recursive globbing 2015-09-28 17:50:25 -07:00
Mike Arpaia
fb2f33d770 Removing the ptvalue typedef 
Removing the ptvalue typedef in favor of just using `pt::ptree::value_type`
 2015-09-02 12:50:24 -07:00
Teddy Reed
5f56490835 Add plist parsing benchmarks and refactor slightly for perf wins 2015-09-01 18:56:09 -07:00
Javier Marcos
74be3d1da0 Removing dots at the end of log entries 2015-08-28 16:50:44 -07:00
Teddy Reed
bdadc9753b Additional OS X table performance improvements 2015-08-18 01:35:10 -07:00
Teddy Reed
5e3a86d2a8 Merge pull request #1376 from theopolis/fix_1367 
[Fix #1367] Disable user-controlled FIFO reads
 2015-07-23 18:25:52 -07:00
Teddy Reed
81aa36ecc7 [Fix #1381] Add documentation/install for daemon+Homebrew 2015-07-23 16:05:59 -07:00
Teddy Reed
ad94eaf0b8 [Fix #1367] Disable user-controlled FIFO reads 2015-07-22 10:15:39 -07:00
Mike Arpaia
5ccfe886ba Merge pull request #1363 from theopolis/less_rows 
[Fix #1303] Only emit rows when appropriate for processes/users.
 2015-07-19 20:36:26 -07:00
Teddy Reed
5249e74146 [Fix #1303] Only emit rows when appropriate for processes/users. 
When optimizing a table using query constraints an implementation should not add unneeded rows.
A user experience bug exists when selecting with an explicit non-existing pid/uid.
 2015-07-19 20:20:04 -07:00
Teddy Reed
95775be1d9 [Fix #1355] Allow plist keys with '.' 
Boost property trees are level delimited using '.' characters.
An Apple property list may contain keys with '.' characters, so the plist conversion must use iterators and raw node appends.
 2015-07-19 16:24:43 -07:00
Teddy Reed
c36fbda274 Merge pull request #1349 from theopolis/centos_version 
[Fix #1319] CentOS version reporting and file read error
 2015-07-17 09:07:29 -07:00
Teddy Reed
f06820f578 [Fix #1319] CentOS version reporting and file read error 
1. Redhat-based distributions were not reporting their version correct.
2. The file read API assumed stat would return an accurate file size.
This has been replaced with an attempt to seek to the end of the file.
 2015-07-16 14:16:51 -07:00
Artur Chmiel
ac9a320218 Updated the readFile function to correctly handle symbolic links 2015-07-16 07:55:12 +02:00
Teddy Reed
263090e8f2 [Fix #1332] Check mode for links in readFile 
1. "really" check for links in readFile
2. Apply the same restrictions and flag ACLs to file hashing.
 2015-07-14 14:24:52 -07:00
Teddy Reed
f48619ed28 [#1285, #1276] Faster, optimized subscriber results 2015-07-07 00:59:28 -07:00
Teddy Reed
d2685cfa41 [#1142] Move path resolution into publisher logic 2015-07-07 00:45:55 -07:00
Teddy Reed
dd9fa25d78 [Fix #1171, #1089] Add configurable max reads 
There are 3 new options that control how files are read:
--read_max: controls the maximum size, in bytes, for file reads. If a file is larger than `read_max` the read will fail.
--read_user_max: similar to `read_max` but applies additional limitations to user-controlled files.
--read_user_links: a boolean control to enable/disable following symlinks for user-controlled files.

Important highlights:
If files exceed the configured max, those reads will fail.
The `read_max` will override `read_user_max` if it is set lower.
A default integer value of `0` will disable the limitations.

The default `read_max` is set to 50M and the default `read_user_max` is 10M.
 2015-07-06 00:49:43 -07:00