Commit Graph

5547 Commits

Author SHA1 Message Date
puffyCid
336e6b075f
Shimcache Table (#6463) 2020-07-12 21:54:37 -04:00
Teddy Reed
e8ef7b56bd
events: Only fire if publisher exists (#6553) 2020-07-12 19:28:28 -04:00
Teddy Reed
ae3d40a7c6
fsevents: Improve testing assumptions and flush fsevents when stopping (#6552) 2020-07-12 12:12:41 -04:00
Garret Reece
1f2564f532
Add windows support to test python utility (#6550) 2020-07-10 00:57:35 -04:00
Breakwell
543dcc3087
Fix: Leak in psidToString on windows 2020-07-10 00:55:10 -04:00
Teddy Reed
59a7840f5c
rpm: Fix rare memory leak in rpm_package_files (#6544) 2020-07-09 10:39:49 -04:00
Ted Reed
5c084ec231 detangle: Move init and watcher into distinct CMake lib 2020-07-09 10:38:53 -04:00
Ted Reed
2949a3e618 detangle: Remove dependency on watcher from extensions 2020-07-09 10:38:53 -04:00
Ted Reed
5cd2d6cbd3 detangle: Move platform setup and teardown out of Initializer 2020-07-09 10:38:53 -04:00
Ted Reed
89953d3340 detangle: Move start time getter and setter out of Config 2020-07-09 10:38:53 -04:00
Ted Reed
3fbe55a108 detangle: Move tooltype setter and getters out of Initializer 2020-07-09 10:38:53 -04:00
Ted Reed
96c74a99e1 detangle: Move osquery shutdown logic outside of Initializer
The goal is to have less inter-dependency within osquery components.
This is the first of several changes that take small steps towards a
simpler dependency graph.

Later we can revisit the directory structure to see if we can convey
what components are intended to be widely used and what components
are specialized.
2020-07-09 10:38:53 -04:00
Nick Anderson
b60ac312b3
wmi: adding utility function to convert datetime to FILETIME (#5901) 2020-07-07 21:33:17 -07:00
seph
40897bb29c
Change "Symlink loop" message from warning to verbose (#6545)
Change Symlink loop message to verbose from warning
2020-07-07 13:45:26 -04:00
seph
5b959e91ab
Fix logging of GLOG_WARNING (#6547)
Add missing GLOG_WARNING type
2020-07-07 08:47:37 -04:00
Teddy Reed
c250dac2e7
build: Support ASAN for boost coroutine2 using ucontext (#6531) 2020-07-01 15:45:57 -04:00
Stefano Bonicatti
8636dca164
CPack: Update and uniform instructions to build a package (#6529) 2020-06-28 17:15:23 -04:00
Stefano Bonicatti
4a03194ba3
CPack: Use specific RPM variables to set the package name (#6527) 2020-06-27 10:31:29 -04:00
Stefano Bonicatti
e17e3b659b
Azure Pipelines: Update compiler version used to v142 (#6528)
Also update the Windows Server version used from 2016 to 2019,
update Ninja to the latest stable and update the docs.
2020-06-27 10:17:23 -04:00
seph
4734cd44f4
Add additional changelog items (#6523)
Additional changelog items
2020-06-25 15:05:02 -04:00
seph
5cd213c092
Changelog for 4.4.0 (#6492) 2020-06-25 09:12:24 -04:00
Teddy Reed
6710dbd5a6
build: Add Azure tables to specs CMakeLists (#6507) 2020-06-25 09:10:17 -04:00
Stefano Bonicatti
efe9a98290
CMake: Correct macOS framework linking (#6522)
target_link_libraries correctly consider "-framework <library>"
as a library, instead of a flag; lets use that instead of
target_link_options.
2020-06-25 09:08:14 -04:00
Teddy Reed
25eb7b3aae
tables: Only populate table cache with star-like selects (#6513) 2020-06-24 22:00:34 -04:00
Stefano Bonicatti
0654c20501
CMake: Fix and cleanup compile flags (#6521)
Add a description to the function preparing the targets carrying the
main compiler and linker flags.

Convert CMake default flags to the ones we use, instead of overriding
them later via targets.
This can also avoid having us use the wrong CRT on Windows if we forget to link
against osquery_cxx_settings.

Reduce the "overriding <flagX> with <flagY>" messages on Windows by
removing the warning level from the default flags, and adding that
to the specific osquery_<c|cxx>_settings target, so that non internal
targets can choose their own level.

Minor cleanups

Fix osquery/osquery#6509
2020-06-24 21:54:47 -04:00
Teddy Reed
5bc3d806e7
docs: Add note to bump the Homebrew cask (#6519) 2020-06-24 12:03:00 -04:00
Teddy Reed
8310159a7a
tests: Fix atom_packages, processes, rpm_packages flakiness (#6518) 2020-06-24 08:21:23 -04:00
Teddy Reed
0b085c36e9
bug: Do not use system proxy for AWS local authority (#6512) 2020-06-23 13:50:01 -04:00
Nick Anderson
d6e7b25706
packaging: updating docs on cpack usage to include Chocolatey (#6022) 2020-06-23 10:49:55 -07:00
Teddy Reed
e2e9e764e6
bug: Fix typed_row table caching (#6508) 2020-06-23 13:48:36 -04:00
Alessandro Gario
15448199f5
Implement event batching support for Windows tables (#6280)
* Windows events: Complete rewrite, implementing tests

* Windows events: Convert the 'keywords' column to TEXT

Since SQLite does not support unsigned 64-bit integers, this changes
the 'keywords' column type to TEXT.
2020-06-23 19:22:19 +02:00
Teddy Reed
c3bd427f4d
http: Use sync resolve (#6490) 2020-06-12 12:07:19 -04:00
James Jerger
d09ad2b1d7
Add support for basic chassis information (#5282) 2020-06-10 17:28:21 -04:00
Teddy Reed
2c453d7508
Only emit 'denylist' warning once (#6493) 2020-06-08 13:23:24 -04:00
Teddy Reed
429228d75e
docs: Remove references to brew in macOS install (#6494) 2020-06-08 13:22:52 -04:00
analyzeDFIR
c197af9716
Fix for #5890: Event Format Results and the Kafka Logger (#6449) 2020-06-06 21:44:26 -04:00
Nabil Schear
0533399039
make apt_sources table parsing much more resilient (#6482) 2020-06-06 21:28:03 -04:00
Stefano Bonicatti
411556b9a5
Make file and hash container columns hidden (#6486)
This is for consistency with the decisions taken
for PR osquery/osquery#6413 and osquery/osquery#6414.

We also update the integration test helper to accept custom constraints,
in the case the table has required columns.
2020-06-06 21:26:44 -04:00
Teddy Reed
08bcf66ef2
Update documentation to use 'allow list' and 'deny list' diction (#6489)
Update documentation to use 'allow list' and 'deny list' diction
2020-06-06 14:32:29 -04:00
Stefano Bonicatti
2085b175e1
Add validate_container_rows helper for integration tests (#6485)
This simple helper takes a table name and
an already prepared rows map to add the container
columns, which are normally hidden, and call validate_rows on it.

We use this function in deb_packages, rpm_packages, npm_packages,
os_version integration tests.
2020-06-05 21:22:44 -04:00
William Theaker
2ae56d368e
Add Auto Table Construction to docs (#6476) 2020-06-05 21:21:54 -04:00
Stefano Bonicatti
ad6b8fa24f
Change ErrorBase::takeUnderlyingError to non const (#6483)
Fix a build error with newer LLVM/Clang (11), as found on
oss-fuzz.

The member function returns a member variable via std::move,
but the member function is marked as const.
Since that variable to be actually moved would require
the class instance to be non const, a copy is used instead;
the return type has its copy constructor deleted though,
so this is always incorrect and removing the const qualifier
is the solution.
2020-06-05 21:20:56 -04:00
Zachary Wasserman
4e1d31c72a
Use 'denylist' instead of 'blacklist' in query scheduling (#6487) 2020-06-05 21:05:59 -04:00
Zachary Wasserman
86bc8bc8a3
Change compile time 'blacklist' to 'denylist' (#6488) 2020-06-05 21:03:04 -04:00
Teddy Reed
1e50815e7c
docs: Improve the new table tutorial (#6479)
Improve the new table tutorial
2020-06-05 14:24:17 -04:00
Stefano Bonicatti
e2d885b335
Add container access to the os_version table (#6413)
* Add container access to the os_version table

* Change new container columns to hidden
2020-06-05 20:22:34 +02:00
Stefano Bonicatti
dba5f1464e
Add container access to DEB, RPM, NPM packages tables (#6414)
* Add container access to DEB, RPM, NPM packages tables

* Change new container columns to hidden
2020-06-05 20:22:03 +02:00
Stefano Bonicatti
c691ac64cd
Actually use the patched libelfin version (#6480)
This is a followup of PR osquery/osquery#6472,
while the code was patched we were still using the unpatched version.
This should finally fix ossfuzz build failure.
2020-06-04 21:16:28 -04:00
herbmaster
ef65c779b1
Link librdkafka on windows (#6454) 2020-06-01 15:53:01 -04:00
Breakwell
3a63e344f3
Only explode registry key if it can be tokenized (#6474) 2020-06-01 13:58:37 -04:00