Commit Graph

4629 Commits

Author SHA1 Message Date
Alessandro Gario
9497df67cc Add a new audit-based table to collect SELinux events (#4224) 2018-07-08 11:22:03 -04:00
uptycs-nishant
1cf5cb7dbc Fixing user_time, system_time bug and changing the cpu utilization logic (#4431) 2018-07-08 11:20:45 -04:00
Jonathan Keljo
f088f26c61 Add documentation for conditional column gen (#4673) 2018-07-08 10:10:42 -04:00
Javier Marcos
53dc36d735 Adding OSX Dummy malware to osx-attacks query pack (#4668) 2018-07-06 11:06:29 -04:00
Alexander
af647a4251
Add get_or, take_or shortcuts to Expected class (#4662)
* Add get_or, take_or shortcuts to Expected class
* Make take_or more strict with accept types
2018-07-06 14:27:06 +01:00
Alexander
5fa1ebad13
Output stream like operator << for Error (#4670)
To create an error human readable message should be provided among other argmunts.
Which is good to better understanding what happend by log records.
To make it more informative user in most cases should put in those message some data (numbers, strings etc.).
This operator will help us to avoid using verbose constructions like boost::format or std::ostringstream or something similar to format a proper error message.
We will be able just to "stream" in a created error any "printable" variables from the context.

Additionaly we will be able to use "fancy" tools for streams like boost::io::quoted or std::hex to format messages.

Example:
```c++
createError(SystemErorr::NoSuchFile, "Could not read pidfile: ")
  << boost::io::quoted(pidfile_path)
  << " " << read_status.toString();
```
2018-07-05 16:12:18 +01:00
Jason Schroth
b75821658b adding bash_session logging (#4640)
* adding bash_session logging

* adding genShellHistoryFromBashSessions

updated to include new function for adding bash_sessions

* adding genShellHistoryFromBashSessions and tests and header
updated test use canonical for filepath

updated to include new function for adding bash_sessions
2018-07-04 15:25:38 +01:00
Giorgi Guliashvili
159d893655
Confusing excepted comment correction (#4669) 2018-07-04 14:55:57 +01:00
Teddy Reed
ab5442d26d
deps: reinstall for portable gcc and mojave support (#4664) 2018-07-03 12:44:26 -04:00
Alexander
4051b0fc79
Create a template implementation of tryTo<> for the one type (#4665) 2018-07-03 17:12:17 +01:00
Chris
f0ed24d826 Initd script (#4661) 2018-07-03 12:00:56 -04:00
M Amin
9075d7265c deps: Update win64 openssl provisioning script (#4636) 2018-07-02 19:56:44 +01:00
Alessandro Gario
e622f62d8a macOS signature: Add a hash_resources parameter to the table (#4246) 2018-07-02 19:47:18 +01:00
Alexander
02e29c48a1
Remove container specific join implementation from conversions.h (#4656)
using templates generic version for any iterable container could be done
Also, realisation for std::set were using a useless copy of data.
2018-07-02 14:14:36 +01:00
Vova Mishatkin
29b596dc85 Add ssdeep table for posix (#4629) 2018-06-29 19:50:47 +01:00
Alexander
9f69a0f8c8 Explicit use ValueType and EnumErrorType in Expected full type definition (#4650) 2018-06-28 14:46:48 +01:00
Rich5
50f66f8baa Using TOKEN_USER instead of TOKEN_OWNER struct (#4651) 2018-06-28 11:22:24 +01:00
Alexander
13081420ae
Remove platformStrncpy function from osquery/core/utils.h (#4645)
On the one heand there is no place of use for it. And on the other, if code rely on all this checks it must be pretty unsafe and messy.
2018-06-27 19:18:35 +01:00
Alexander
ed7c5ca69d
Connecte expected.h and error.h tests to build system (#4648)
* Connecte expected.h and error.h tests to build system

% ./build/darwin/osquery/osquery_tests --gtest_filter='Expected*'
Note: Google Test filter = Expected*
[==========] Running 0 tests from 0 test cases.
[==========] 0 tests from 0 test cases ran. (0 ms total)
[  PASSED  ] 0 tests.

% ./build/darwin/osquery/osquery_tests --gtest_filter='Expected*'
Note: Google Test filter = Expected*
[==========] Running 2 tests from 2 test cases.
[----------] Global test environment set-up.
[----------] 1 test from ExpectedValueTest
[ RUN      ] ExpectedValueTest.initialization
[       OK ] ExpectedValueTest.initialization (0 ms)
[----------] 1 test from ExpectedValueTest (0 ms total)
[----------] 1 test from ExpectedPointerTest
[ RUN      ] ExpectedPointerTest.initialization
[       OK ] ExpectedPointerTest.initialization (0 ms)
[----------] 1 test from ExpectedPointerTest (0 ms total)
[----------] Global test environment tear-down
[==========] 2 tests from 2 test cases ran. (0 ms total)
[  PASSED  ] 2 tests.

* Check error message and name of error enum separatelly

Different compilers produce different names for C++ classes
2018-06-27 18:42:17 +01:00
Max Kareta
c382a8a739
Refactor/cmake (#4646) 2018-06-27 18:08:52 +01:00
Teddy Reed
e2a53388b8
deps: Small changes for Ubuntu18 build (#4630) 2018-06-26 19:02:29 -04:00
Max Kareta
a2e1e37219
Refactor/cmake (#4644) 2018-06-26 18:27:24 +01:00
Alexander
5ef576a99c
Create a success and failure static factory for Status (#4627)
Consider this PR as a cosmetic one.

Creating Status class object in the code is not so clear. It is not so obvious that defatult costructed Status is success. Also it is not obvious that status with zero code is success and non-zero is failure.

To fix it I created 2 static methods to make construction of some particular status clear to reader.

* Use assert to check code in Status::failure in debut mode

* Rename success_code constant to kSuccessCode
according to style guide
2018-06-26 17:36:26 +01:00
Max Kareta
6344f58712
Improved xcode compatibility (#4643) 2018-06-26 17:13:48 +01:00
Max Kareta
6ab2a83a61
Refactor/cmake 5 (#4642) 2018-06-26 16:54:08 +01:00
Alexander
f9e9fdb962 Remove unused unused mutex 'config_valid_mutex_' from config (#4637) 2018-06-26 16:01:28 +01:00
Max Kareta
8f7ea728d2
reworked part of cmake files (#4638) 2018-06-26 12:03:35 +01:00
Jason Schroth
ec22af9fc8 Refactor before adding bash_sessions history files to shell_history (#4634) 2018-06-25 17:42:48 +01:00
Alexander
1179915350
The default timestamp was added for shell_history without timestamp (#4618)
If the shell history file does not contain a timestamps for the lines
osquery will miss the time in rows and will show an confusing error
about attempt to convert empty string to INTEGER.

```
% head -n 3 ~/.zsh_history
ls
cd source
ls
```

```
osquery> select * from shell_history limit 1;
I0621 11:56:37.804193 2629124992 virtual_table.cpp:292] Error casting time () to INTEGER
+------------+------+---------+-------------------------------+
| uid        | time | command | history_file                  |
+------------+------+---------+-------------------------------+
| 1868255265 |      | exit    | /home/akindyakov/.zsh_history |
+------------+------+---------+-------------------------------+
```
So, default value for the time in shell history can solve the problem.
2018-06-25 16:55:49 +01:00
Kolokotronis Panagiotis
4270f75b94 Kafka logging plugin is called kafka_producer (#4594) 2018-06-23 12:01:27 +01:00
mchaffe
191fc7df53 Fix regular files being tagged as symlinks (#4579) 2018-06-23 10:32:13 +01:00
Kyle Creyts
19843b8253 first pass at ssh_config table (#4380) 2018-06-22 19:37:29 -07:00
Giorgi Guliashvili
257bcfa546 events proof read (#4591) 2018-06-22 19:35:36 -07:00
Teddy Reed
a165a8f89a
deps: Use static libfl in thrift build (#4442) 2018-06-22 19:03:14 -07:00
Giorgi Guliashvili
6bb1f93fc2 udev resource protection (#4599) 2018-06-22 19:01:59 -07:00
Nick Anderson
f032cd7e83
tests: ensuring services have been cleared from the system before starting (#4625) 2018-06-22 12:28:04 -07:00
Max Kareta
d085f2dca1
added custom version of realpath function (#4416) 2018-06-22 15:02:22 +01:00
Alexander
6b7ff81ad8
Do not try to decode/encode utf-8 in python extensions (#4617)
osquery itself does not care about unicode validity in table columns,
just takes it "as is". It definetely makes sense, because it could be broken.
But thrift extensions interface for python do it.

If, for instance, shell history contains broken unicode test `python_test_example_queries`
will fail.

```bash
% sed -n '5277p' < ~/.zsh_history | xxd -b                                                                                                                          [146]
00000000: 11000011 10000011 10111111 01101100 01110011 00001010  ...ls.
```
2018-06-22 10:21:11 +01:00
Max Kareta
2084c74238
updated another set of cmake files (#4622) 2018-06-21 18:43:22 +01:00
Max Kareta
690f8f8672
do not strip everything for release build (#4623) 2018-06-21 18:29:37 +01:00
Max Kareta
bccc28dd98
xcode support (#4581) 2018-06-21 15:46:39 +01:00
Alexander
0ae3c0bcc1
Used proper names in registry macro instead of obfuscated names (#4589) 2018-06-20 13:46:06 +01:00
Sven Mueller
e6a6a12e15 Add some more features to the cpuid table. (#4192) 2018-06-20 11:49:24 +01:00
Giorgi Guliashvili
a87db9952f
memory leak resolve for dispatcher (#4597) 2018-06-19 23:46:56 +01:00
Giorgi Guliashvili
f9e60dbb74
toIndex simplification (#4586) 2018-06-19 23:16:18 +01:00
Mitchell Grenier
ed186e0961 Watcher: Never give up on extensions (#4585) 2018-06-19 14:22:38 -07:00
Filipe Manco
c302b8c800
Improve generated TARGETS formatting (#4603) 2018-06-19 22:04:37 +01:00
Filipe Manco
5bd4984f2a
Fix include path on status.h (#4605) 2018-06-19 22:02:50 +01:00
Filipe Manco
b67fc0eb28
Comment out unused parameter to make linter happy (#4606) 2018-06-19 22:02:32 +01:00
Filipe Manco
3c271d2b9b
Replace unsafe usages of 0 as nullptr (#4607) 2018-06-19 22:02:07 +01:00