Commit Graph

2634 Commits

Author SHA1 Message Date
Alexander
5ef576a99c
Create a success and failure static factory for Status (#4627)
Consider this PR as a cosmetic one.

Creating Status class object in the code is not so clear. It is not so obvious that defatult costructed Status is success. Also it is not obvious that status with zero code is success and non-zero is failure.

To fix it I created 2 static methods to make construction of some particular status clear to reader.

* Use assert to check code in Status::failure in debut mode

* Rename success_code constant to kSuccessCode
according to style guide
2018-06-26 17:36:26 +01:00
Max Kareta
6ab2a83a61
Refactor/cmake 5 (#4642) 2018-06-26 16:54:08 +01:00
Alexander
f9e9fdb962 Remove unused unused mutex 'config_valid_mutex_' from config (#4637) 2018-06-26 16:01:28 +01:00
Max Kareta
8f7ea728d2
reworked part of cmake files (#4638) 2018-06-26 12:03:35 +01:00
Jason Schroth
ec22af9fc8 Refactor before adding bash_sessions history files to shell_history (#4634) 2018-06-25 17:42:48 +01:00
Alexander
1179915350
The default timestamp was added for shell_history without timestamp (#4618)
If the shell history file does not contain a timestamps for the lines
osquery will miss the time in rows and will show an confusing error
about attempt to convert empty string to INTEGER.

```
% head -n 3 ~/.zsh_history
ls
cd source
ls
```

```
osquery> select * from shell_history limit 1;
I0621 11:56:37.804193 2629124992 virtual_table.cpp:292] Error casting time () to INTEGER
+------------+------+---------+-------------------------------+
| uid        | time | command | history_file                  |
+------------+------+---------+-------------------------------+
| 1868255265 |      | exit    | /home/akindyakov/.zsh_history |
+------------+------+---------+-------------------------------+
```
So, default value for the time in shell history can solve the problem.
2018-06-25 16:55:49 +01:00
mchaffe
191fc7df53 Fix regular files being tagged as symlinks (#4579) 2018-06-23 10:32:13 +01:00
Kyle Creyts
19843b8253 first pass at ssh_config table (#4380) 2018-06-22 19:37:29 -07:00
Giorgi Guliashvili
257bcfa546 events proof read (#4591) 2018-06-22 19:35:36 -07:00
Giorgi Guliashvili
6bb1f93fc2 udev resource protection (#4599) 2018-06-22 19:01:59 -07:00
Max Kareta
d085f2dca1
added custom version of realpath function (#4416) 2018-06-22 15:02:22 +01:00
Alexander
6b7ff81ad8
Do not try to decode/encode utf-8 in python extensions (#4617)
osquery itself does not care about unicode validity in table columns,
just takes it "as is". It definetely makes sense, because it could be broken.
But thrift extensions interface for python do it.

If, for instance, shell history contains broken unicode test `python_test_example_queries`
will fail.

```bash
% sed -n '5277p' < ~/.zsh_history | xxd -b                                                                                                                          [146]
00000000: 11000011 10000011 10111111 01101100 01110011 00001010  ...ls.
```
2018-06-22 10:21:11 +01:00
Max Kareta
2084c74238
updated another set of cmake files (#4622) 2018-06-21 18:43:22 +01:00
Max Kareta
bccc28dd98
xcode support (#4581) 2018-06-21 15:46:39 +01:00
Sven Mueller
e6a6a12e15 Add some more features to the cpuid table. (#4192) 2018-06-20 11:49:24 +01:00
Giorgi Guliashvili
a87db9952f
memory leak resolve for dispatcher (#4597) 2018-06-19 23:46:56 +01:00
Giorgi Guliashvili
f9e60dbb74
toIndex simplification (#4586) 2018-06-19 23:16:18 +01:00
Mitchell Grenier
ed186e0961 Watcher: Never give up on extensions (#4585) 2018-06-19 14:22:38 -07:00
Filipe Manco
b67fc0eb28
Comment out unused parameter to make linter happy (#4606) 2018-06-19 22:02:32 +01:00
Filipe Manco
3c271d2b9b
Replace unsafe usages of 0 as nullptr (#4607) 2018-06-19 22:02:07 +01:00
jcai1
574061b5f9 add recovery behavior to osqueryd Windows service (#4565) 2018-06-19 16:58:33 -04:00
iBigQ
0bce73c846 Parse structured options as string (#4567)
* Parse structured options as string

* Added option parsing test

* fix option json test

* fix formating
2018-06-19 17:11:51 +01:00
M Amin
7623f5380f tables: Added NTFS ACL permissions virtual table (#4518) 2018-06-18 16:12:36 -04:00
Max Kareta
4b8d7f0c53
moved from file(GLOB); added CMAKE_CURRENT_LIST_DIR to support include syntax (#4582) 2018-06-18 14:24:20 +01:00
Max Kareta
408c54565e
Removing macOS kernel module (#4572) 2018-06-17 19:21:07 +01:00
Giorgi Guliashvili
c7ad4350e1
dispatcher race conditions (#4570)
* dispatcher race conditions

dispatcher had 2 race condition.
In joinServices it was accessing service_threads_ with different lock(join_lock). However, if by that time new service was added baad things would happen :) .

Also dispatcher was accessing services_.size() without the lock. ( If by that time service was removed or joined bad things would happen)
2018-06-15 18:01:44 +01:00
Giorgi Guliashvili
ff1747347e
InterruptableRunnable RunnerInterruptPoint redesign (#4545)
* InterruptableRunnable RunnerInterruptPoint redesign

There were several inefficiencies in the old version of RunnerInterruptPoint and InterruptableRunnable.

1) RunnerInterruptPoint was throwing the exception when interrupted, however, the exception was always ignored.

2) InterruptableRunnable used the read-write lock, however only write lock was used.

3) InterruptableRunnable InterruptableRunnable, stored almost similar variable stop_, interrupted_.

4) std::atomic<bool> interrupted_ was used with locks, even though it was accessed by default safest access mode memory_order_seq_cst. So no additional cache invalidation was needed.

5) InterruptableRunnable contained code(in method interrupted() and variables bypass_check_, checked) just for testing. Which was slowing down method interrupted().

6) Some more confusing things. notify_all was not needed, as only one thread could be waiting for the conditional variable. RunnerInterruptPoint:: pause(void) looks ambiguous and that's why was not used anywhere.

I resolved all these problems by merging InterruptableRunnable and RunnerInterruptPoint into the InterruptableRunnable.

1) No use of the exception.
2) 4) Simple mutex, which is only used for pauseMilli. InterruptableRunnable::interrupted and InterruptableRunnable::interrupt function lock-free.
3) Single variable interrupted_.
5) Made InterruptableRunnable::interrupt virtual. Tests override interrupt to make things testable.
6) change to notify_one and removed pause without the specific time.
2018-06-15 16:15:43 +01:00
Nick Anderson
428094ef72 bug: correctly check windows event log channels for firing (#4550) 2018-06-13 21:40:50 +01:00
Filipe Manco
366141fda2
Catch exceptions by ref on windows processes (#4541) 2018-06-13 21:06:38 +01:00
Filipe Manco
98ccbcc250
Remove /dev/null monitoring from fsevents (#4549) 2018-06-13 20:33:32 +01:00
Alexandru Stefanica
674efda216 Fix autoloaded extension processes outliving the main process (#4359) 2018-06-13 20:33:02 +01:00
Filipe Manco
b512f4be6d
ATCPlugin fix ctor initialization order (#4540) 2018-06-13 17:17:28 +01:00
Alessandro Gario
ea95870bc8 AuditdNetlink: Only start the netlink services once (#4535) 2018-06-13 14:57:57 +01:00
Filipe Manco
bb57c489de
Removed extra empty line at top of file (#4543) 2018-06-13 14:51:44 +01:00
Filipe Manco
92dbd15a89
Fix comment typos (#4542) 2018-06-13 14:51:27 +01:00
Filipe Manco
98f00bea4f
SQL::selectFrom() pass columns as ref (#4544) 2018-06-13 14:32:10 +01:00
Filipe Manco
0a08620b65
Move process namespaces to separate table (#4534) 2018-06-13 14:28:16 +01:00
Alexander
d22146beac Fix up flaky fileops_tests (#4529) 2018-06-13 10:18:27 +01:00
Alessandro Gario
b64dbb0f53 auditdnetlink: Do not reset the handle when poll() returns EINTR (#4531) 2018-06-13 10:06:53 +01:00
Nick Anderson
6ff5aded99
bug: correctly check for failed process open (#4532) 2018-06-12 14:56:22 -04:00
Giorgi Guliashvili
698846fda4
base64 encoding and decoding optimized (#4507)
base64 encoding and decoding optimized
2018-06-12 18:37:04 +01:00
Giorgi Guliashvili
5e9332aea4
bug split(string,string,size_t) (#4515)
split(string,string,size_t) contained bug, it was joining on every delimiter, which would result to unusual outcome. However, test could not detect this problem as delim.size() was 1. It turned out, that this split is not used anywhere having delim.size() > 1, so completely fixing bug by changing signature of the method to split(string,char,size_t)
2018-06-12 18:34:09 +01:00
Mitchell Grenier
46e38e1c4a
Add decode back to cmdline pieces (#4521) 2018-06-12 10:30:54 -07:00
Alexander
343971caae
Do not continue FileOpsTests.* after file opening faulure (#4530)
Without ASSERT_* tests try to work with invalid file pointer - it doesn't make any sense
2018-06-12 18:20:08 +01:00
Filipe Manco
adedd50c9a
Registry: don't call external code holding lock (#4528) 2018-06-12 15:55:51 +01:00
Teddy Reed
e1676c9ef5 Make macOS signatures table architecture aware (#4525) 2018-06-11 14:03:57 -07:00
Nick Anderson
e860e8e794
[Fix 4488] Ensure that corrupted DB entries are processed gracefully (#4508) 2018-06-08 20:56:16 -07:00
Filipe Manco
0f66afff6e Set parent to -1 on process_events (#4511) 2018-06-08 15:15:54 -07:00
Babatunde Micheal Okutubo
ffe025e0a3 tables: Report process limits on darwin and linux (#4219) 2018-06-08 10:53:17 -07:00
Alexander
4c2925743e If config update call from extension failed, do not go further (#4517) 2018-06-08 10:15:46 -07:00