Teddy Reed
9a54af29ce
Bump sqlite to 3.11.0
2016-02-21 22:40:37 -08:00
Baraa Hamodi
21c2237eca
[osquery] Update copyright headers to new format.
2016-02-11 11:48:58 -08:00
Teddy Reed
8947dac232
[ Fix #1814 ] Various fixes for Linux inotify
2016-02-03 17:00:41 -08:00
Teddy Reed
5824b891d3
Only discovery SMBIOS tables once on Linux
2015-12-19 20:40:05 -08:00
Teddy Reed
63d12789b4
Fix regression in file content predicate refactor
2015-12-14 15:24:55 -08:00
Teddy Reed
a99b62a31d
Preserve atime and mtime by default for readFile
2015-12-11 22:18:45 -08:00
Teddy Reed
a72fa19536
Use a noexcept method of directory checking for hash
2015-11-20 13:32:56 -08:00
Teddy Reed
0d01a382b6
[ Fix #1634 ] Add sys/stat to filesystem
2015-11-09 01:33:17 -08:00
Teddy Reed
41ba637030
Linux inotify should accept non-glob dirs
2015-11-04 13:46:47 -08:00
Teddy Reed
2cf9e95fa1
Allow user-controlled FIFOs
2015-11-04 01:29:54 -08:00
Teddy Reed
d27a7ecc4c
Fix clang warnings, promote warnings to errors
2015-11-01 02:12:07 -08:00
Teddy Reed
97a6521445
Merge pull request #1614 from theopolis/drop_around_files
...
Expand the scope of permissions dropping
2015-10-30 17:07:04 -07:00
Teddy Reed
09e4e3c42e
Expand the scope of permissions dropping
2015-10-30 09:56:33 -07:00
Teddy Reed
2cf7543181
[ Fix #1611 ] Prevent fs links in inotify path search
2015-10-29 23:19:07 -07:00
Teddy Reed
b8087a1b26
Fix readFile TOCTOU error
2015-10-26 01:21:05 -07:00
Robert C. Seacord
1d9695ac31
eliminated some warnings from Clang 3.7 analyze mode
2015-10-21 06:02:58 +00:00
Robert C. Seacord
e57828aac3
changes for integer sign problems
2015-10-17 00:18:35 +00:00
Robert C. Seacord
acb2f6f628
eliminating diagnostics, mostly for comparisons between signed and unsigned operations
2015-10-16 16:10:37 +00:00
Teddy Reed
66888de80a
Fix potential hang with recursive globbing
2015-09-28 17:50:25 -07:00
Mike Arpaia
fb2f33d770
Removing the ptvalue typedef
...
Removing the ptvalue typedef in favor of just using `pt::ptree::value_type`
2015-09-02 12:50:24 -07:00
Teddy Reed
5f56490835
Add plist parsing benchmarks and refactor slightly for perf wins
2015-09-01 18:56:09 -07:00
Javier Marcos
74be3d1da0
Removing dots at the end of log entries
2015-08-28 16:50:44 -07:00
Teddy Reed
bdadc9753b
Additional OS X table performance improvements
2015-08-18 01:35:10 -07:00
Teddy Reed
5e3a86d2a8
Merge pull request #1376 from theopolis/fix_1367
...
[Fix #1367 ] Disable user-controlled FIFO reads
2015-07-23 18:25:52 -07:00
Teddy Reed
81aa36ecc7
[ Fix #1381 ] Add documentation/install for daemon+Homebrew
2015-07-23 16:05:59 -07:00
Teddy Reed
ad94eaf0b8
[ Fix #1367 ] Disable user-controlled FIFO reads
2015-07-22 10:15:39 -07:00
Mike Arpaia
5ccfe886ba
Merge pull request #1363 from theopolis/less_rows
...
[Fix #1303 ] Only emit rows when appropriate for processes/users.
2015-07-19 20:36:26 -07:00
Teddy Reed
5249e74146
[ Fix #1303 ] Only emit rows when appropriate for processes/users.
...
When optimizing a table using query constraints an implementation should not add unneeded rows.
A user experience bug exists when selecting with an explicit non-existing pid/uid.
2015-07-19 20:20:04 -07:00
Teddy Reed
95775be1d9
[ Fix #1355 ] Allow plist keys with '.'
...
Boost property trees are level delimited using '.' characters.
An Apple property list may contain keys with '.' characters, so the plist conversion must use iterators and raw node appends.
2015-07-19 16:24:43 -07:00
Teddy Reed
c36fbda274
Merge pull request #1349 from theopolis/centos_version
...
[Fix #1319 ] CentOS version reporting and file read error
2015-07-17 09:07:29 -07:00
Teddy Reed
f06820f578
[ Fix #1319 ] CentOS version reporting and file read error
...
1. Redhat-based distributions were not reporting their version correct.
2. The file read API assumed stat would return an accurate file size.
This has been replaced with an attempt to seek to the end of the file.
2015-07-16 14:16:51 -07:00
Artur Chmiel
ac9a320218
Updated the readFile function to correctly handle symbolic links
2015-07-16 07:55:12 +02:00
Teddy Reed
263090e8f2
[ Fix #1332 ] Check mode for links in readFile
...
1. "really" check for links in readFile
2. Apply the same restrictions and flag ACLs to file hashing.
2015-07-14 14:24:52 -07:00
Teddy Reed
f48619ed28
[ #1285 , #1276 ] Faster, optimized subscriber results
2015-07-07 00:59:28 -07:00
Teddy Reed
d2685cfa41
[ #1142 ] Move path resolution into publisher logic
2015-07-07 00:45:55 -07:00
Teddy Reed
dd9fa25d78
[ Fix #1171 , #1089 ] Add configurable max reads
...
There are 3 new options that control how files are read:
--read_max: controls the maximum size, in bytes, for file reads. If a file is larger than `read_max` the read will fail.
--read_user_max: similar to `read_max` but applies additional limitations to user-controlled files.
--read_user_links: a boolean control to enable/disable following symlinks for user-controlled files.
Important highlights:
If files exceed the configured max, those reads will fail.
The `read_max` will override `read_user_max` if it is set lower.
A default integer value of `0` will disable the limitations.
The default `read_max` is set to 50M and the default `read_user_max` is 10M.
2015-07-06 00:49:43 -07:00
Teddy Reed
7aac5fd358
Replace custom wildcarding with POSIX-glob
...
POSIX-globbing will allow event publishers/subscribers to post-check
results against glob-syntax, fnpath matching, and POSIX C-regex.
These checks are anecdotally speedy.
2015-07-02 13:53:16 -07:00
Teddy Reed
e7ab2fc47b
Limit scope of git/tag version defines.
...
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Mike Arpaia
fff36af0af
Removing trailing whitespace
2015-05-11 23:31:13 -07:00
Teddy Reed
70e3c190bb
Easier build host-based sync
2015-05-05 15:15:45 -07:00
Teddy Reed
c63bf0451a
Various exception hardening
2015-05-03 14:18:20 -07:00
Teddy Reed
d0bbb0bc4f
Towards safer and shuffled unittests
2015-04-29 14:43:27 -07:00
Teddy Reed
be65922569
Fast tests
2015-04-27 09:40:31 -07:00
Teddy Reed
c9e07ec2ba
Add launchd_overrides table
2015-04-15 23:19:23 -07:00
Teddy Reed
54af369702
[ Fix #968 ] Refactor launchd
2015-04-10 18:04:26 -07:00
Teddy Reed
d30455893f
Merge pull request #941 from theopolis/rhel_fun
...
[Implement #926 ] RHEL6 provisioning
2015-04-08 14:37:48 -07:00
Teddy Reed
41ce00e573
RHEL6 provisioning
2015-04-06 23:43:01 -07:00
Mitchell Grenier
a6a8cc596b
Fixed a bug that would prevent single files from showing up in wildcard resolutions
2015-04-06 15:21:17 -07:00
Teddy Reed
692c1b1751
Add package_receipts/package_bom OS X tables
2015-03-27 23:12:09 -07:00
Teddy Reed
38bfed3414
Remove libprocps(ng) in favor of parsing proc manually
2015-03-27 12:37:16 -07:00
