Pablo S. Torralba
65c4ed4a7d
Fix boost split on linux to remove sscanf
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
2b32673445
Some fixes:
...
- clang-format on code
- NULL -> nullptr
- some (char *) changed in std::string favour
- Removed a memory leak.
- Moved struct inside the table namespace
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
778951d6a4
Remove osx dependency on system() call to get arp information
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
c7fc2cee22
rename vtable field arp->mac
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
4f524abbea
arp vtable different implementation in osx and linux
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
413d6f068b
Change fgetln (osx specific) in favour of getline (both osx and linux)
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
1843d80660
arp vtable with ip, arp and interface where it was seen
2014-11-16 19:49:40 -08:00
mike@arpaia.co
bfceaf8453
blacklisting port_inode and socket_inode
...
port_inode and socket_inode have caused a few issues lately and, as of
right now, they both have open issues against them. For the time being,
I'm going to blacklist them. When the tables are production-ready, we
can re-add them back in to the base linux build.
2014-11-16 09:42:57 -08:00
Teddy Reed
a1898ef03b
Check tables row vector size before access
2014-11-14 15:18:25 -08:00
Teddy Reed
02841f5e7f
Add kernel userland-API inet_diag header
2014-11-14 01:42:34 -08:00
Teddy Reed
565bce3c07
Fix unwind exception catching
2014-11-14 01:42:00 -08:00
Vincent Mauge
632151d56a
Set ouput_bit to 0 instead of cast error
2014-11-12 22:02:04 -08:00
Teddy Reed
0d8b9d3eaa
Use SQLite types
2014-11-12 11:07:24 -08:00
Teddy Reed
525a3b79a0
Tons of new build features
...
* The OS/DISTRO are available as defines when writing tables:
UBUNTU, UBUNTU_14_04, UBUNTU_12_04
CENTOS, CENTOS_6_6
DARWIN, DARWIN_10_10, DARWIN_10_9
* The table generation tooling now grabs virtual tables templates
from ./osquery/tables/templates/<name>.cpp.in.
* The table generation tooling will detect reserved column names.
* suid_bin uses the new UBUNTU to restrict calls to root (fix #362 ).
2014-11-12 00:57:47 -08:00
Teddy Reed
8e408f987e
Table spec documentation examples
2014-11-11 11:26:11 -08:00
Teddy Reed
050e942d11
Support USE_BLACKLIST=1 to remove tables from release
2014-11-10 13:30:38 -08:00
Abe Stanway
811d98c595
free(linkname) and no more 'self'
2014-11-10 15:02:31 -05:00
Abe Stanway
30149a70f9
Updated
2014-11-10 15:02:31 -05:00
Abe Stanway
322fde0121
Socket_inode and port_inode tables to map PIDs->ports via netlink inet_diag
...
Example query:
```
SELECT port.local_port,
port.remote_port,
port.local_ip,
port.remote_ip,
socket.pid,
process.name,
process.cmdline
process.path
FROM socket_inode AS socket
JOIN port_inode AS port
ON socket.inode = port.inode
INNER JOIN processes AS process
ON socket.pid = process.pid;
```
2014-11-10 15:02:31 -05:00
Teddy Reed
86d2ac208b
Use leaks for OSX memory leak profiling
2014-11-10 11:34:17 -08:00
Mike Arpaia
3245e5a6cd
Merge pull request #394 from wizzat/process_args
...
Add cmdline to darwin
2014-11-10 13:20:47 -05:00
Teddy Reed
19aa99583e
Linux processes vtable use freeproc
2014-11-10 10:12:47 -08:00
Mark Roberts
dc1684fca7
Add cmdline to darwin
2014-11-10 09:36:17 -08:00
Teddy Reed
b0ff403d3d
Fixing librpm API usage leaks
2014-11-10 01:48:07 -08:00
Teddy Reed
b77406b122
[ Fix #367 ] Check RPMTAG class before cast
2014-11-09 02:07:49 -08:00
Teddy Reed
078d4cf7d2
Refector shell flags/versioning
2014-11-08 20:27:28 -08:00
Veres Lajos
afc82c722f
typo fixes - https://github.com/vlajos/misspell_fixer
2014-11-07 22:18:02 +00:00
Alexander Polyakov
00dbf282a6
/ is not always readable
2014-11-07 01:00:58 +03:00
Alexander Polyakov
c0d827f534
Add euid / egid to process table
...
(not tested on darwin)
2014-11-06 01:35:52 +03:00
mike@arpaia.co
05cfff81c8
clang-format
2014-11-04 11:42:30 -08:00
mike@arpaia.co
896a4f2957
generic users function and some general cleanups
2014-11-04 11:40:54 -08:00
Zachary Wasserman
0b30b9f692
Add basic Mac startup items vtable
2014-11-04 11:40:54 -08:00
Alexander Polyakov
a60230af5e
linux/processes: fix infinite loop, throw away workaround
2014-11-04 15:31:35 +03:00
Teddy Reed
03034780f1
Add note about blocking process_env as non-su
2014-11-03 23:46:47 -08:00
Teddy Reed
ea3880eefb
Merge pull request #354 from wizzat/graceful_envs
...
Graceful envs
2014-11-03 23:43:04 -08:00
Mike Arpaia
37734bc5a4
Merge pull request #351 from LTD-Beget/blockdev_table
...
Blockdev table for linux
2014-11-03 22:29:35 -08:00
Mark Roberts
5780fffa22
Potential Linux fix, pending boost::filesystem::path fix on master. Issue #323
2014-11-03 20:39:51 -08:00
Alexander Polyakov
cbc2139047
block_devices: trim spaces around model and vendor
2014-11-04 05:00:24 +03:00
Teddy Reed
dc77df602e
[format] Cleanup various PRs not run through clang-format
2014-11-03 17:57:01 -08:00
Mark Roberts
176af65fb5
Remove logging of permissions error when running as non-root user on OSX
...
Issue #323
2014-11-03 17:29:22 -08:00
Mike Arpaia
01944a3bb7
Merge pull request #352 from LTD-Beget/pci_devices_crash
...
pci_devices: udev_device_get_property_values() can return NULL
2014-11-03 15:17:03 -08:00
Alexander Polyakov
95aeaba024
pci_devices: unref things after use
2014-11-04 01:48:42 +03:00
Alexander Polyakov
1ce1424d01
Add braces
2014-11-04 01:21:02 +03:00
Alexander Polyakov
e3364ac34c
Add braces
2014-11-04 01:13:49 +03:00
Mike Arpaia
a9e636af9f
Merge pull request #349 from facebook/329
...
Ensuring that listening_ports results are unique
2014-11-03 14:08:04 -08:00
Alexander Polyakov
f96180e926
pci_devices: udev_device_get_property_values() can return NULL
2014-11-03 23:56:59 +03:00
Alexander Polakov
274e037527
Blockdev table for linux
2014-11-03 23:39:14 +03:00
mike@arpaia.co
75ded8b881
Ensuring that listening_ports results are unique
2014-11-03 12:03:57 -08:00
Akshay Dixit
c99c08c607
changed comments to // from /* , char* to std::string consts, and ran clang-format on the file
2014-11-02 21:09:04 -07:00
Akshay Dixit
cb1bf1c305
cleaned up pci_devices.cpp
2014-11-02 21:09:04 -07:00
