Teddy Reed
55f270ff97
OS X application duti/scheme listing table
2015-06-21 14:08:21 -04:00
Mike Arpaia
be85046d32
typo in keychain_acls table where path was being returned as app_path
2015-06-21 13:52:01 -04:00
Mike Arpaia
0a83572f08
Table to enumerate keychain ACLs
2015-06-20 14:59:07 -04:00
Teddy Reed
09ea12a2a7
Add application sandbox container metadata
2015-06-19 01:53:09 -04:00
Teddy Reed
e7ab2fc47b
Limit scope of git/tag version defines.
...
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Teddy Reed
b56e9efd47
Merge pull request #1199 from theopolis/fix_open_sockets
...
Process open sockets on Linux needs '['
2015-06-07 14:04:45 -07:00
Teddy Reed
49eb22ef44
Process open sockets on Linux was added '['
2015-06-07 13:28:17 -07:00
Teddy Reed
727f5b091f
Various table perf improvements and TLS docs
2015-06-05 22:03:15 -07:00
Mike Arpaia
ea70781f25
Merge pull request #1188 from marpaia/msr_format
...
Formatting the callback function in the model_specific_register table
2015-06-04 12:17:19 -07:00
Teddy Reed
a70828c2a4
Merge pull request #1187 from sharvilshah/xattr_update
...
Extended Attributes: Use LaunchServices API for quarantine data
2015-06-03 22:38:17 -07:00
Sharvil Shah
065fe6412d
Use LaunchServices (part of CoreServices) to grab quarantine properties instead of manually parsing the colon separated attribute data.
...
Fall back to deprecated LaunchService API for OS X 10.9 Mavericks.
Added tests for extended_attributes
Better error handling and cleanup
2015-06-03 22:18:45 -07:00
Teddy Reed
8e2b7e1281
Merge pull request #1189 from theopolis/tooling
...
Update tooling/profiling paths and use a better random seed
2015-06-03 22:15:22 -07:00
Teddy Reed
c934ad0df3
Update tooling/profiling paths
2015-06-03 21:22:12 -07:00
Mike Arpaia
657731b11c
Formatting the callback function in the model_specific_register table
...
`int osquery::filter(const struct dirent*)` seemed like a pretty generic
symbol to have in our symbol table, so I changed it to
`int msrScandirFilter(const struct dirent*)`
2015-06-03 20:56:16 -07:00
Michael O'Farrell
5e9383a16b
Created a table for information in the model specific register.
...
This infomation is primarily related to the performance of processor
cores. The information given constitutes only a small portion of
the information in the model specific register, but this table
has been designed so that more information may easily be added.
The table requires osquery be run as the root, and that the msr
kernel module is loaded. The table reads the msr data from /dev
2015-06-03 15:55:57 -07:00
Teddy Reed
8aacaca7eb
Query pack platform binds should match any/all
2015-06-03 13:56:39 -07:00
Teddy Reed
a105924804
Move specs to a top-level path, add query examples
...
1. Example queries will run with an (optional) integration test.
2. Fix bad accesses with OS X package BOMs
3. Move spec files from ./osquery/tables/specs to ./specs
4. Remove server parsers (netlib) from client builds.
2015-06-03 10:39:05 -07:00
Sharvil Shah
4ab79a8bd6
deallocate array with delete[] instead of delete
2015-06-02 15:09:22 -07:00
Wesley Shields
80749c3531
Chase constraint changes introduced in #1170 .
...
The changes done in #1170 broke some of the tables on FreeBSD.
2015-05-30 01:42:44 +00:00
Wesley Shields
571fd65796
Fix build on FreeBSD.
...
Missing osquery/tables.h include in routes.cpp and need to add gen_users
to blacklist on FreeBSD.
2015-05-30 01:14:08 +00:00
Teddy Reed
f954e2c7e8
Merge pull request #1170 from mofarrell/exists-all
...
Constraint existence now check for constraints using specific operator types.
2015-05-29 16:10:30 -07:00
Michael O'Farrell
77aa36fa0b
Constraint existence now check for constraints using specific operator types.
...
This change allows QueryContext constraints to be checked for based on
operator type. This makes checks for the existence of an equality
operator allow enumeration.
Example:
if (context.constraints["pid"].exists(EQUALS)) {
pids = context.constraints["pid"].getAll(EQUALS);
} else {
osquery::procProcesses(pids);
}
2015-05-29 13:47:04 -07:00
Wesley Shields
6558f605ff
Implement process related tables on FreeBSD.
...
This implements the following tables on FreeBSD:
process_envs
process_memory_map
process_open_files
process_open_sockets
processes
All the heavy lifting is done with libprocstat(3). All the tables follow
the same general principle. Use the common function, getProcesses() in
procstat.cpp, to get the processes and then generate the rows for each
process returned. There is also a procstatCleanup() function commonly
used across all the tables.
The one thing I am not able to test is the process_open_sockets table on
an IPv6 machine.
2015-05-29 19:17:49 +00:00
Teddy Reed
ce3ac8a7e3
Merge pull request #1164 from theopolis/packs
...
Pack and testing fixups
2015-05-28 16:47:35 -07:00
Teddy Reed
4064fa6eb5
Pack and testing fixups
2015-05-28 12:17:27 -07:00
Mark Ignacio
84f8203dfd
Converted CFAbsoluteTime in X509 certificates to UNIX time
2015-05-27 15:23:46 -07:00
Teddy Reed
ff9243bce1
Merge pull request #1159 from mofarrell/user-groups-table
...
Wrote a user_groups table for darwin and linux based system.
2015-05-27 11:38:06 -07:00
Michael O'Farrell
80356b26f0
Wrote a user_groups table for darwin and linux based system.
...
The user_groups table represents the association between user ids and group ids.
Darwin Issue:
Issues arise in darwin systems with users that are members of many groups due
to a bug in Apple's implementation of getgrouplist. If the number of groups a
user is a member of is greater than 64 a truncated association table may
be returned.
2015-05-27 10:32:46 -07:00
Teddy Reed
8b3686a58a
TLS plugin workflow tests
2015-05-26 19:55:00 -07:00
Teddy Reed
5969ae4fbf
Clean up TLS-version from OpenSSL detection
2015-05-23 13:04:36 -07:00
Teddy Reed
700384dedc
Minify tables namespace, extra CMake macros
2015-05-22 10:29:04 -07:00
Javier Marcos
9a4f611baf
Merge pull request #1155 from javuto/osquery_packs_table
...
Osquery packs table
2015-05-21 20:32:45 -07:00
Javier Marcos
f86b2bc6f3
Adding checks to avoid duplicated queries in the schedule
2015-05-21 19:23:38 -07:00
Mike Arpaia
6f30c40041
Merge pull request #1152 from sharvilshah/xattr_parse_where_from
...
More thorough where_from parsing in extended_attributes
2015-05-21 16:32:32 -07:00
Javier Marcos
2b834a401a
Fixing problem with extensions test, utility tables were added to core
2015-05-21 14:10:20 -07:00
Javier Marcos
886ad6e928
Added table for the packs and check for already scheduled queries
2015-05-21 13:42:45 -07:00
Sharvil Shah
a216ef2886
Use CoreServices Metadata API to parse kMDItemWhereFroms for file xattrs and now includes non-browser values too
2015-05-20 10:50:25 -07:00
Teddy Reed
4ff2fc1db2
Merge pull request #1151 from theopolis/crontab-fix
...
Include several search paths for user contabs
2015-05-20 10:47:32 -07:00
Javier Marcos
c6855fab43
Table for osquery packs
2015-05-19 18:44:28 -07:00
Teddy Reed
983d107fe6
Search for cronstabs in /cron and /cron/crontabs
2015-05-19 15:51:03 -07:00
Ryan Steinmetz
949f84f3a8
Add mounts table support under FreeBSD
...
Cleanup blacklist entries for FreeBSD (mounts/users/groups)
2015-05-19 15:33:06 -07:00
Teddy Reed
525c584a0b
Merge pull request #1141 from theopolis/static_cryptsetup
...
Build libcryptsetup statically
2015-05-14 22:33:56 -07:00
Teddy Reed
9ee839b265
Build libcryptsetup statically
2015-05-14 19:36:00 -07:00
Blake Frantz
3a49fc46c8
Merge remote-tracking branch 'upstream/master'
2015-05-13 07:38:41 -07:00
Ryan Steinmetz
0777fa5fe2
- Add users/groups support for FreeBSD
2015-05-12 23:47:20 -07:00
Mike Arpaia
fff36af0af
Removing trailing whitespace
2015-05-11 23:31:13 -07:00
Blake Frantz
2e865a69d6
Merge remote-tracking branch 'upstream/master'
2015-05-10 14:38:33 -07:00
Blake Frantz
2c4ae6758a
initial commit for adding support for amazon linux 2015.03
2015-05-10 11:42:30 -07:00
Teddy Reed
98b52c39a1
elaxing iptables, EL-deps
2015-05-09 18:16:13 -07:00
Teddy Reed
b5be0212e2
Merge pull request #1120 from theopolis/iptables_best
...
Adding new table to display iptables filters, chains and rules
2015-05-08 20:10:34 -07:00
