Commit Graph

4456 Commits

Author SHA1 Message Date
Max Kareta
6344f58712
Improved xcode compatibility (#4643) 2018-06-26 17:13:48 +01:00
Max Kareta
6ab2a83a61
Refactor/cmake 5 (#4642) 2018-06-26 16:54:08 +01:00
Alexander
f9e9fdb962 Remove unused unused mutex 'config_valid_mutex_' from config (#4637) 2018-06-26 16:01:28 +01:00
Max Kareta
8f7ea728d2
reworked part of cmake files (#4638) 2018-06-26 12:03:35 +01:00
Jason Schroth
ec22af9fc8 Refactor before adding bash_sessions history files to shell_history (#4634) 2018-06-25 17:42:48 +01:00
Alexander
1179915350
The default timestamp was added for shell_history without timestamp (#4618)
If the shell history file does not contain a timestamps for the lines
osquery will miss the time in rows and will show an confusing error
about attempt to convert empty string to INTEGER.

```
% head -n 3 ~/.zsh_history
ls
cd source
ls
```

```
osquery> select * from shell_history limit 1;
I0621 11:56:37.804193 2629124992 virtual_table.cpp:292] Error casting time () to INTEGER
+------------+------+---------+-------------------------------+
| uid        | time | command | history_file                  |
+------------+------+---------+-------------------------------+
| 1868255265 |      | exit    | /home/akindyakov/.zsh_history |
+------------+------+---------+-------------------------------+
```
So, default value for the time in shell history can solve the problem.
2018-06-25 16:55:49 +01:00
Kolokotronis Panagiotis
4270f75b94 Kafka logging plugin is called kafka_producer (#4594) 2018-06-23 12:01:27 +01:00
mchaffe
191fc7df53 Fix regular files being tagged as symlinks (#4579) 2018-06-23 10:32:13 +01:00
Kyle Creyts
19843b8253 first pass at ssh_config table (#4380) 2018-06-22 19:37:29 -07:00
Giorgi Guliashvili
257bcfa546 events proof read (#4591) 2018-06-22 19:35:36 -07:00
Teddy Reed
a165a8f89a
deps: Use static libfl in thrift build (#4442) 2018-06-22 19:03:14 -07:00
Giorgi Guliashvili
6bb1f93fc2 udev resource protection (#4599) 2018-06-22 19:01:59 -07:00
Nick Anderson
f032cd7e83
tests: ensuring services have been cleared from the system before starting (#4625) 2018-06-22 12:28:04 -07:00
Max Kareta
d085f2dca1
added custom version of realpath function (#4416) 2018-06-22 15:02:22 +01:00
Alexander
6b7ff81ad8
Do not try to decode/encode utf-8 in python extensions (#4617)
osquery itself does not care about unicode validity in table columns,
just takes it "as is". It definetely makes sense, because it could be broken.
But thrift extensions interface for python do it.

If, for instance, shell history contains broken unicode test `python_test_example_queries`
will fail.

```bash
% sed -n '5277p' < ~/.zsh_history | xxd -b                                                                                                                          [146]
00000000: 11000011 10000011 10111111 01101100 01110011 00001010  ...ls.
```
2018-06-22 10:21:11 +01:00
Max Kareta
2084c74238
updated another set of cmake files (#4622) 2018-06-21 18:43:22 +01:00
Max Kareta
690f8f8672
do not strip everything for release build (#4623) 2018-06-21 18:29:37 +01:00
Max Kareta
bccc28dd98
xcode support (#4581) 2018-06-21 15:46:39 +01:00
Alexander
0ae3c0bcc1
Used proper names in registry macro instead of obfuscated names (#4589) 2018-06-20 13:46:06 +01:00
Sven Mueller
e6a6a12e15 Add some more features to the cpuid table. (#4192) 2018-06-20 11:49:24 +01:00
Giorgi Guliashvili
a87db9952f
memory leak resolve for dispatcher (#4597) 2018-06-19 23:46:56 +01:00
Giorgi Guliashvili
f9e60dbb74
toIndex simplification (#4586) 2018-06-19 23:16:18 +01:00
Mitchell Grenier
ed186e0961 Watcher: Never give up on extensions (#4585) 2018-06-19 14:22:38 -07:00
Filipe Manco
c302b8c800
Improve generated TARGETS formatting (#4603) 2018-06-19 22:04:37 +01:00
Filipe Manco
5bd4984f2a
Fix include path on status.h (#4605) 2018-06-19 22:02:50 +01:00
Filipe Manco
b67fc0eb28
Comment out unused parameter to make linter happy (#4606) 2018-06-19 22:02:32 +01:00
Filipe Manco
3c271d2b9b
Replace unsafe usages of 0 as nullptr (#4607) 2018-06-19 22:02:07 +01:00
jcai1
574061b5f9 add recovery behavior to osqueryd Windows service (#4565) 2018-06-19 16:58:33 -04:00
Filipe Manco
432c366f87 Revert homebrew changes introduced for Mojave (#4609) 2018-06-19 20:19:56 +01:00
iBigQ
0bce73c846 Parse structured options as string (#4567)
* Parse structured options as string

* Added option parsing test

* fix option json test

* fix formating
2018-06-19 17:11:51 +01:00
Craig Cook
7a66202e5e
Fix make sync on centos7 (#4574)
* Add LIBRARY_PATH environment variable to sync.sh so that "make sync" works as expected to find libraries
needed to link.  Added 2nd parameter (libraries path) to CMakeList.txt when calling sync.sh

* Revert database CMakeLists.txt change - as was for testing

* Add indentation to sync.sh

* Fix indentation on tool/sync.sh
2018-06-19 12:41:02 +01:00
Chris Long
5ee495504f docs: Updating process auditing documentation (#4477) 2018-06-19 01:51:55 -04:00
Filipe Manco
4d580d0fa9 Implement make format_check (#4583) 2018-06-18 18:55:20 -07:00
Teddy Reed
e56b2124ba
deps: revert linuxbrew updates from #4561 (#4590) 2018-06-18 18:53:28 -07:00
M Amin
7623f5380f tables: Added NTFS ACL permissions virtual table (#4518) 2018-06-18 16:12:36 -04:00
Mitchell Grenier
c8133b2810 Remove linux undents (#4584) 2018-06-18 08:32:24 -07:00
M Amin
9910f13f0f update win64 openssl to 1.0.2o (#4564) 2018-06-18 08:12:00 -07:00
Max Kareta
4b8d7f0c53
moved from file(GLOB); added CMAKE_CURRENT_LIST_DIR to support include syntax (#4582) 2018-06-18 14:24:20 +01:00
Max Kareta
408c54565e
Removing macOS kernel module (#4572) 2018-06-17 19:21:07 +01:00
Nick Anderson
2e9b1e295f
tests: ensure service has been installed before starting (#4576) 2018-06-17 11:38:12 -04:00
Mitchell Grenier
19c0bedf19
Update brew and formulae for Mojave (#4561) 2018-06-15 13:44:02 -07:00
Giorgi Guliashvili
c7ad4350e1
dispatcher race conditions (#4570)
* dispatcher race conditions

dispatcher had 2 race condition.
In joinServices it was accessing service_threads_ with different lock(join_lock). However, if by that time new service was added baad things would happen :) .

Also dispatcher was accessing services_.size() without the lock. ( If by that time service was removed or joined bad things would happen)
2018-06-15 18:01:44 +01:00
Giorgi Guliashvili
ff1747347e
InterruptableRunnable RunnerInterruptPoint redesign (#4545)
* InterruptableRunnable RunnerInterruptPoint redesign

There were several inefficiencies in the old version of RunnerInterruptPoint and InterruptableRunnable.

1) RunnerInterruptPoint was throwing the exception when interrupted, however, the exception was always ignored.

2) InterruptableRunnable used the read-write lock, however only write lock was used.

3) InterruptableRunnable InterruptableRunnable, stored almost similar variable stop_, interrupted_.

4) std::atomic<bool> interrupted_ was used with locks, even though it was accessed by default safest access mode memory_order_seq_cst. So no additional cache invalidation was needed.

5) InterruptableRunnable contained code(in method interrupted() and variables bypass_check_, checked) just for testing. Which was slowing down method interrupted().

6) Some more confusing things. notify_all was not needed, as only one thread could be waiting for the conditional variable. RunnerInterruptPoint:: pause(void) looks ambiguous and that's why was not used anywhere.

I resolved all these problems by merging InterruptableRunnable and RunnerInterruptPoint into the InterruptableRunnable.

1) No use of the exception.
2) 4) Simple mutex, which is only used for pauseMilli. InterruptableRunnable::interrupted and InterruptableRunnable::interrupt function lock-free.
3) Single variable interrupted_.
5) Made InterruptableRunnable::interrupt virtual. Tests override interrupt to make things testable.
6) change to notify_one and removed pause without the specific time.
2018-06-15 16:15:43 +01:00
Nick Anderson
9259da6cc9
deploy: set default flagfile to utf-8 for MSI package (#4559) 2018-06-15 10:18:49 -04:00
Teddy Reed
17922f49bf
deps: Update openssl to version 1.0.2o (#4555) 2018-06-15 06:02:38 -07:00
Alexander
18f46707fe
actualize names for *base64* family functions (#4568)
Issue: #4563
2018-06-15 11:37:01 +01:00
Filipe Manco
b522e7422b
Build posix with -fno-limit-debug-info (#4558) 2018-06-15 10:12:28 +01:00
Mitchell Grenier
ff528fc2c7
WEL format change (#4562) 2018-06-14 14:50:19 -07:00
Teddy Reed
dad9fa6018
deps: Update yara to version 3.7.1 (#4557) 2018-06-14 07:13:17 -07:00
Alexander
9fb6a604dd
Force osqueryi to not use osquery extensions from system env in tests. (#4524)
To prevent any affects from system env.
2018-06-14 13:12:26 +01:00