Commit Graph

165 Commits

Author SHA1 Message Date
Teddy Reed
47e1a5ba74 Use noexcept boost::filesystem overloads (#2195) 2016-06-27 16:39:04 -07:00
Nick Anderson
72df044ef5 Adding check for nullptr before dereferencing. This fixes #2185 (#2187) 2016-06-24 13:59:49 -07:00
yying
d2d9a27845 [Fix #2165] Use noexcept boost methods in PlatformFile (#2167) 2016-06-15 10:23:48 -07:00
Nick Anderson
cf30388705 Moved test_utils to it's own directory out of core. Updated references (#2154) 2016-06-09 10:49:26 -07:00
yying
9879733867 Filesystem Abstractions - Integrations (#2128)
* Integrated filesystem operation abstraction code into filesystem.cpp
* Modified filesystem unit tests to be more platform agnostic
* Added append mode for PlatformFile
* Minor bug fixes in filesystem operations
2016-06-07 14:08:50 -07:00
Nick Anderson
240958ea76 Fixed typing in FileOps tests (#2127)
Some of the types in fileops tests were causing warnings to be thrown
during build, due to type mismatch. I've added a few local variables to
quiet these warnings.
2016-06-02 15:46:55 -07:00
yying
5f81cd9e2b Filesystem Abstractions - Code and Unit Tests (#2119)
* Implemented filesystem operations abstraction code
* Added filesystem operations abstraction unit tests
* Modified CMake configurations to support the building of the abstraction code and unit tests
2016-05-31 12:20:38 -07:00
yying
26ad131c38 Building osquery unit tests on Windows 10 (#2100)
Integrated process abstraction code into more locations
Defined new macros for abstracting across various platforms
Added GLOG_NO_ABBREVIATED_SEVERITIES for glog to support Windows
Fixed some minor CMake issues involving thrift
Updated gflags package; reflecting change in provision script
Preparing CMake config files for WIN32 support
2016-05-17 12:39:11 -07:00
Teddy Reed
3de52846d0 Remove boost::thread 2016-03-11 11:50:44 -08:00
Teddy Reed
26c8b5640f Fix various lint issues 2016-03-09 19:55:39 -08:00
Teddy Reed
9a54af29ce Bump sqlite to 3.11.0 2016-02-21 22:40:37 -08:00
Baraa Hamodi
21c2237eca [osquery] Update copyright headers to new format. 2016-02-11 11:48:58 -08:00
Teddy Reed
8947dac232 [Fix #1814] Various fixes for Linux inotify 2016-02-03 17:00:41 -08:00
Teddy Reed
5824b891d3 Only discovery SMBIOS tables once on Linux 2015-12-19 20:40:05 -08:00
Teddy Reed
63d12789b4 Fix regression in file content predicate refactor 2015-12-14 15:24:55 -08:00
Teddy Reed
a99b62a31d Preserve atime and mtime by default for readFile 2015-12-11 22:18:45 -08:00
Teddy Reed
a72fa19536 Use a noexcept method of directory checking for hash 2015-11-20 13:32:56 -08:00
Teddy Reed
0d01a382b6 [Fix #1634] Add sys/stat to filesystem 2015-11-09 01:33:17 -08:00
Teddy Reed
41ba637030 Linux inotify should accept non-glob dirs 2015-11-04 13:46:47 -08:00
Teddy Reed
2cf9e95fa1 Allow user-controlled FIFOs 2015-11-04 01:29:54 -08:00
Teddy Reed
d27a7ecc4c Fix clang warnings, promote warnings to errors 2015-11-01 02:12:07 -08:00
Teddy Reed
97a6521445 Merge pull request #1614 from theopolis/drop_around_files
Expand the scope of permissions dropping
2015-10-30 17:07:04 -07:00
Teddy Reed
09e4e3c42e Expand the scope of permissions dropping 2015-10-30 09:56:33 -07:00
Teddy Reed
2cf7543181 [Fix #1611] Prevent fs links in inotify path search 2015-10-29 23:19:07 -07:00
Teddy Reed
b8087a1b26 Fix readFile TOCTOU error 2015-10-26 01:21:05 -07:00
Robert C. Seacord
1d9695ac31 eliminated some warnings from Clang 3.7 analyze mode 2015-10-21 06:02:58 +00:00
Robert C. Seacord
e57828aac3 changes for integer sign problems 2015-10-17 00:18:35 +00:00
Robert C. Seacord
acb2f6f628 eliminating diagnostics, mostly for comparisons between signed and unsigned operations 2015-10-16 16:10:37 +00:00
Teddy Reed
66888de80a Fix potential hang with recursive globbing 2015-09-28 17:50:25 -07:00
Mike Arpaia
fb2f33d770 Removing the ptvalue typedef
Removing the ptvalue typedef in favor of just using `pt::ptree::value_type`
2015-09-02 12:50:24 -07:00
Teddy Reed
5f56490835 Add plist parsing benchmarks and refactor slightly for perf wins 2015-09-01 18:56:09 -07:00
Javier Marcos
74be3d1da0 Removing dots at the end of log entries 2015-08-28 16:50:44 -07:00
Teddy Reed
bdadc9753b Additional OS X table performance improvements 2015-08-18 01:35:10 -07:00
Teddy Reed
5e3a86d2a8 Merge pull request #1376 from theopolis/fix_1367
[Fix #1367] Disable user-controlled FIFO reads
2015-07-23 18:25:52 -07:00
Teddy Reed
81aa36ecc7 [Fix #1381] Add documentation/install for daemon+Homebrew 2015-07-23 16:05:59 -07:00
Teddy Reed
ad94eaf0b8 [Fix #1367] Disable user-controlled FIFO reads 2015-07-22 10:15:39 -07:00
Mike Arpaia
5ccfe886ba Merge pull request #1363 from theopolis/less_rows
[Fix #1303] Only emit rows when appropriate for processes/users.
2015-07-19 20:36:26 -07:00
Teddy Reed
5249e74146 [Fix #1303] Only emit rows when appropriate for processes/users.
When optimizing a table using query constraints an implementation should not add unneeded rows.
A user experience bug exists when selecting with an explicit non-existing pid/uid.
2015-07-19 20:20:04 -07:00
Teddy Reed
95775be1d9 [Fix #1355] Allow plist keys with '.'
Boost property trees are level delimited using '.' characters.
An Apple property list may contain keys with '.' characters, so the plist conversion must use iterators and raw node appends.
2015-07-19 16:24:43 -07:00
Teddy Reed
c36fbda274 Merge pull request #1349 from theopolis/centos_version
[Fix #1319] CentOS version reporting and file read error
2015-07-17 09:07:29 -07:00
Teddy Reed
f06820f578 [Fix #1319] CentOS version reporting and file read error
1. Redhat-based distributions were not reporting their version correct.
2. The file read API assumed stat would return an accurate file size.
This has been replaced with an attempt to seek to the end of the file.
2015-07-16 14:16:51 -07:00
Artur Chmiel
ac9a320218 Updated the readFile function to correctly handle symbolic links 2015-07-16 07:55:12 +02:00
Teddy Reed
263090e8f2 [Fix #1332] Check mode for links in readFile
1. "really" check for links in readFile
2. Apply the same restrictions and flag ACLs to file hashing.
2015-07-14 14:24:52 -07:00
Teddy Reed
f48619ed28 [#1285, #1276] Faster, optimized subscriber results 2015-07-07 00:59:28 -07:00
Teddy Reed
d2685cfa41 [#1142] Move path resolution into publisher logic 2015-07-07 00:45:55 -07:00
Teddy Reed
dd9fa25d78 [Fix #1171, #1089] Add configurable max reads
There are 3 new options that control how files are read:
--read_max: controls the maximum size, in bytes, for file reads. If a file is larger than `read_max` the read will fail.
--read_user_max: similar to `read_max` but applies additional limitations to user-controlled files.
--read_user_links: a boolean control to enable/disable following symlinks for user-controlled files.

Important highlights:
If files exceed the configured max, those reads will fail.
The `read_max` will override `read_user_max` if it is set lower.
A default integer value of `0` will disable the limitations.

The default `read_max` is set to 50M and the default `read_user_max` is 10M.
2015-07-06 00:49:43 -07:00
Teddy Reed
7aac5fd358 Replace custom wildcarding with POSIX-glob
POSIX-globbing will allow event publishers/subscribers to post-check
results against glob-syntax, fnpath matching, and POSIX C-regex.
These checks are anecdotally speedy.
2015-07-02 13:53:16 -07:00
Teddy Reed
e7ab2fc47b Limit scope of git/tag version defines.
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Mike Arpaia
fff36af0af Removing trailing whitespace 2015-05-11 23:31:13 -07:00
Teddy Reed
70e3c190bb Easier build host-based sync 2015-05-05 15:15:45 -07:00