Add support for processing KILL, TKILL and TGKILL syscalls. The first
message of the SYSCALL message type is handled in a similar way as
EXECVE as the structure is more or less the same.
Three additional fields are parsed from the message which are "ses"
(session of the process), "comm" (the command that was executed, eg: the
script name in case of a /bin/bash invoke) and "tty" (the controlling
terminal for the process). These fields will not be published though
since the table schema doesn't support it at the moment.
The above feature is activated using the
--audit_allow_kill_process_events=true
Sample columns:
```
"columns": {
"atime": "1589007635",
"auid": "4294967295",
"btime": "0",
"cmdline": "",
"ctime": "1587237608",
"cwd": "",
"egid": "1000",
"euid": "1000",
"fsgid": "1000",
"fsuid": "1000",
"gid": "1000",
"mode": "0755",
"mtime": "1586904788",
"owner_gid": "",
"owner_uid": "",
"parent": "4781",
"path": "/home/USERNAME/code-server-3.1.1-linux-x86_64/node",
"pid": "4795",
"sgid": "1000",
"suid": "1000",
"syscall": "kill",
"time": "1589052835",
"uid": "1000",
"uptime": "26902"
}
```
Note that the TGKILL syscall is recommended to not be used from the
linux manpages.
The goal is to have less inter-dependency within osquery components.
This is the first of several changes that take small steps towards a
simpler dependency graph.
Later we can revisit the directory structure to see if we can convey
what components are intended to be widely used and what components
are specialized.
Add a description to the function preparing the targets carrying the
main compiler and linker flags.
Convert CMake default flags to the ones we use, instead of overriding
them later via targets.
This can also avoid having us use the wrong CRT on Windows if we forget to link
against osquery_cxx_settings.
Reduce the "overriding <flagX> with <flagY>" messages on Windows by
removing the warning level from the default flags, and adding that
to the specific osquery_<c|cxx>_settings target, so that non internal
targets can choose their own level.
Minor cleanups
Fixosquery/osquery#6509
* Windows events: Complete rewrite, implementing tests
* Windows events: Convert the 'keywords' column to TEXT
Since SQLite does not support unsigned 64-bit integers, this changes
the 'keywords' column type to TEXT.
This is for consistency with the decisions taken
for PR osquery/osquery#6413 and osquery/osquery#6414.
We also update the integration test helper to accept custom constraints,
in the case the table has required columns.
This simple helper takes a table name and
an already prepared rows map to add the container
columns, which are normally hidden, and call validate_rows on it.
We use this function in deb_packages, rpm_packages, npm_packages,
os_version integration tests.
Fix a build error with newer LLVM/Clang (11), as found on
oss-fuzz.
The member function returns a member variable via std::move,
but the member function is marked as const.
Since that variable to be actually moved would require
the class instance to be non const, a copy is used instead;
the return type has its copy constructor deleted though,
so this is always incorrect and removing the const qualifier
is the solution.
