Created mdls table which mimics the functionality of the mdls command in macOS. Table allows osquery to retrieve key/value pairs from spotlight metadata.
The windows documentation mentions that ExitThread should not be
used in C++ code. When debugging these exit flows I saw exceptions
when running dtors.
When reviewing the shutdown code for Windows and POSIX there was a
lot of complexity. This change allows any part of code to request
a shutdown and simplifies the response.
We should expect the main thread to call ::waitForShutdown.
The exception is the shell, which waits in a repl.
Implements the Community ID hash that will allow correlating network connections detected by osquery with other tools that support the standard (Zeek, Suricata, etc.).
Updated performance-safety.md to include details about profile.py and it's output. The changes also include information about how profile.py sets the thresholds that appear in the script output.
* Add sccache to the Windows job
Also fix debug symbols on googletest,
so that it doesn't try to create a separate pdb.
* Fix uploading the submodule cache
sccache needs its cache to be uploaded as normal files,
not with a tar, otherwise the cache when extracted
will contain extraneous files and folders (PaxHeader).
The Files mode though by default ignores the .git folder,
so we have to use the .artifactignore file to unignore it,
and we have to copy in the cached path for the cache task to see it.
sqlite3_result_error() third parameter is the length
of the string of the second parameter, not the error code.
We set that to -1, which means that the length of the string
will be taken using strlen().
Addresses https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18694
This will speed up the CMake configure phase since
it won't have to download the submodules data each time
through git, which is slower than downloading it
as an Azure Pipeline cache.
When using Boost.Process on Windows with Boost.Asio for async_pipe,
the build fails because Asio requires BOOST_ASIO_WINDOWS define
to enable access to async_pipe.
This only partially solves the issue since it's necessary that
Asio users will also include the "sdkddkver.h" header
before the "boost/asio.hpp" header to properly define
_WIN32_WINNT_WIN7, used by osquery.
This fixes the verbosity observed in #5371 (review):
A quick summary: FileReferenceNumber doesn't have an operator== for integers, but C++ gets clever and implicitly provides one because of the FileReferenceNumber(DWORDLONG) constructor. This ends up providing the wrong implicit comparison behavior, resulting in the branch below always being taken (and consequently erroring, since no old name record is actually present). This fix changes the comparison to drive_letter, which will always be compared correctly and will only be 0U in the case we want to test.
* utils/system: (Windows) Add expandEnvString
Wraps the ExpandEnvironmentStrings function.
* windows/startup_items: Expand environment variables in paths
* windows/env: Fix variable
windows/env: Fix function call
* windows/startup_items: Use assign instead of operator=
windows/startup_items: Make a copy of the path
* utils/system: Add command-line splitting function
* windows/startup_items: Refactor path parsing
windows/startup_items: Fix optional dereference
* utils/system: Fix include, parameter
* windows/env: Missing c_str()
* windows/startup_items: Remove const
windows/startup_items: Avoid splitting paths with spaces
windows/startup_items: Invert file check
Saves us an allocation in some cases.
* windows/startup_items: Add note
* windows/services: Expand env vars in module_path
* windows/env: Explicitly initialize argc
CommandLineToArgvW *should* set this in every case that matters,
but it doesn't hurt to be explicit.
* tables, utils: clang-format, CMake updates
system/env: clang-format
windows/env: Include shellapi
utils: Add Windows env tests
tests/windows: splitArgs test
tests/windows: Fix include
(buck) utils: Bring in WINDOWS constant
(build): Fix deps
(buck) utils: Use osquery_target
tests/env: Fix variable
tests/env: Don't try to compare a vector
tests/env: Use WINDIR instead of PATH
tests/env: More interesting split test
windows/env: Bugfix, use derefs
windows/env: clang-format
tests/env: Use optional::get()
tests/env: Check for optional truthyness
* utils/env: Add verbose logging to env expansion
* utils/system: Include logger instead of core
Fixup buck build.
* (build) utils/system: Specify errno dep
* (buck) utils/system: Also specify errno dep
* selinux_settings: New table that presents effective SELinux settings
* selinux_settings: Use the SELinux root path from the mounted fs
The code that was originally directly implemented inside the
`mounts` table has been moved outside so that it can be reused
by the selinux_settings table.
This also updates the code to use getmntent_r instead of getmntent.
- The output from the git subprocess has to be decoded from bytes
to str before passing it as an argument of a new subprocess.
- Use the python interpreter of the current script to run git-clang-format.py.
- Restore the ability of osquery to log to the Windows Event Log.
- Restore the information normally shown on the Details tab
of the Properties of the osquery executable.
- Add and refactor utility functions to parse and transform
the osquery version, needed by the Windows resource files
and packaging.
The move assignment operator of boost::basic_ipstream is bugged.
It has been fixed on upstream in commit
ca994c1972
which is not on any stable build, so we will patch boost with that commit.
