Commit Graph

4442 Commits

Author SHA1 Message Date
Alexander
6b7ff81ad8
Do not try to decode/encode utf-8 in python extensions (#4617)
osquery itself does not care about unicode validity in table columns,
just takes it "as is". It definetely makes sense, because it could be broken.
But thrift extensions interface for python do it.

If, for instance, shell history contains broken unicode test `python_test_example_queries`
will fail.

```bash
% sed -n '5277p' < ~/.zsh_history | xxd -b                                                                                                                          [146]
00000000: 11000011 10000011 10111111 01101100 01110011 00001010  ...ls.
```
2018-06-22 10:21:11 +01:00
Max Kareta
2084c74238
updated another set of cmake files (#4622) 2018-06-21 18:43:22 +01:00
Max Kareta
690f8f8672
do not strip everything for release build (#4623) 2018-06-21 18:29:37 +01:00
Max Kareta
bccc28dd98
xcode support (#4581) 2018-06-21 15:46:39 +01:00
Alexander
0ae3c0bcc1
Used proper names in registry macro instead of obfuscated names (#4589) 2018-06-20 13:46:06 +01:00
Sven Mueller
e6a6a12e15 Add some more features to the cpuid table. (#4192) 2018-06-20 11:49:24 +01:00
Giorgi Guliashvili
a87db9952f
memory leak resolve for dispatcher (#4597) 2018-06-19 23:46:56 +01:00
Giorgi Guliashvili
f9e60dbb74
toIndex simplification (#4586) 2018-06-19 23:16:18 +01:00
Mitchell Grenier
ed186e0961 Watcher: Never give up on extensions (#4585) 2018-06-19 14:22:38 -07:00
Filipe Manco
c302b8c800
Improve generated TARGETS formatting (#4603) 2018-06-19 22:04:37 +01:00
Filipe Manco
5bd4984f2a
Fix include path on status.h (#4605) 2018-06-19 22:02:50 +01:00
Filipe Manco
b67fc0eb28
Comment out unused parameter to make linter happy (#4606) 2018-06-19 22:02:32 +01:00
Filipe Manco
3c271d2b9b
Replace unsafe usages of 0 as nullptr (#4607) 2018-06-19 22:02:07 +01:00
jcai1
574061b5f9 add recovery behavior to osqueryd Windows service (#4565) 2018-06-19 16:58:33 -04:00
Filipe Manco
432c366f87 Revert homebrew changes introduced for Mojave (#4609) 2018-06-19 20:19:56 +01:00
iBigQ
0bce73c846 Parse structured options as string (#4567)
* Parse structured options as string

* Added option parsing test

* fix option json test

* fix formating
2018-06-19 17:11:51 +01:00
Craig Cook
7a66202e5e
Fix make sync on centos7 (#4574)
* Add LIBRARY_PATH environment variable to sync.sh so that "make sync" works as expected to find libraries
needed to link.  Added 2nd parameter (libraries path) to CMakeList.txt when calling sync.sh

* Revert database CMakeLists.txt change - as was for testing

* Add indentation to sync.sh

* Fix indentation on tool/sync.sh
2018-06-19 12:41:02 +01:00
Chris Long
5ee495504f docs: Updating process auditing documentation (#4477) 2018-06-19 01:51:55 -04:00
Filipe Manco
4d580d0fa9 Implement make format_check (#4583) 2018-06-18 18:55:20 -07:00
Teddy Reed
e56b2124ba
deps: revert linuxbrew updates from #4561 (#4590) 2018-06-18 18:53:28 -07:00
M Amin
7623f5380f tables: Added NTFS ACL permissions virtual table (#4518) 2018-06-18 16:12:36 -04:00
Mitchell Grenier
c8133b2810 Remove linux undents (#4584) 2018-06-18 08:32:24 -07:00
M Amin
9910f13f0f update win64 openssl to 1.0.2o (#4564) 2018-06-18 08:12:00 -07:00
Max Kareta
4b8d7f0c53
moved from file(GLOB); added CMAKE_CURRENT_LIST_DIR to support include syntax (#4582) 2018-06-18 14:24:20 +01:00
Max Kareta
408c54565e
Removing macOS kernel module (#4572) 2018-06-17 19:21:07 +01:00
Nick Anderson
2e9b1e295f
tests: ensure service has been installed before starting (#4576) 2018-06-17 11:38:12 -04:00
Mitchell Grenier
19c0bedf19
Update brew and formulae for Mojave (#4561) 2018-06-15 13:44:02 -07:00
Giorgi Guliashvili
c7ad4350e1
dispatcher race conditions (#4570)
* dispatcher race conditions

dispatcher had 2 race condition.
In joinServices it was accessing service_threads_ with different lock(join_lock). However, if by that time new service was added baad things would happen :) .

Also dispatcher was accessing services_.size() without the lock. ( If by that time service was removed or joined bad things would happen)
2018-06-15 18:01:44 +01:00
Giorgi Guliashvili
ff1747347e
InterruptableRunnable RunnerInterruptPoint redesign (#4545)
* InterruptableRunnable RunnerInterruptPoint redesign

There were several inefficiencies in the old version of RunnerInterruptPoint and InterruptableRunnable.

1) RunnerInterruptPoint was throwing the exception when interrupted, however, the exception was always ignored.

2) InterruptableRunnable used the read-write lock, however only write lock was used.

3) InterruptableRunnable InterruptableRunnable, stored almost similar variable stop_, interrupted_.

4) std::atomic<bool> interrupted_ was used with locks, even though it was accessed by default safest access mode memory_order_seq_cst. So no additional cache invalidation was needed.

5) InterruptableRunnable contained code(in method interrupted() and variables bypass_check_, checked) just for testing. Which was slowing down method interrupted().

6) Some more confusing things. notify_all was not needed, as only one thread could be waiting for the conditional variable. RunnerInterruptPoint:: pause(void) looks ambiguous and that's why was not used anywhere.

I resolved all these problems by merging InterruptableRunnable and RunnerInterruptPoint into the InterruptableRunnable.

1) No use of the exception.
2) 4) Simple mutex, which is only used for pauseMilli. InterruptableRunnable::interrupted and InterruptableRunnable::interrupt function lock-free.
3) Single variable interrupted_.
5) Made InterruptableRunnable::interrupt virtual. Tests override interrupt to make things testable.
6) change to notify_one and removed pause without the specific time.
2018-06-15 16:15:43 +01:00
Nick Anderson
9259da6cc9
deploy: set default flagfile to utf-8 for MSI package (#4559) 2018-06-15 10:18:49 -04:00
Teddy Reed
17922f49bf
deps: Update openssl to version 1.0.2o (#4555) 2018-06-15 06:02:38 -07:00
Alexander
18f46707fe
actualize names for *base64* family functions (#4568)
Issue: #4563
2018-06-15 11:37:01 +01:00
Filipe Manco
b522e7422b
Build posix with -fno-limit-debug-info (#4558) 2018-06-15 10:12:28 +01:00
Mitchell Grenier
ff528fc2c7
WEL format change (#4562) 2018-06-14 14:50:19 -07:00
Teddy Reed
dad9fa6018
deps: Update yara to version 3.7.1 (#4557) 2018-06-14 07:13:17 -07:00
Alexander
9fb6a604dd
Force osqueryi to not use osquery extensions from system env in tests. (#4524)
To prevent any affects from system env.
2018-06-14 13:12:26 +01:00
Teddy Reed
9eae0bcffd
deps: Update libxml2 to version 2.9.7 (#4553) 2018-06-14 04:13:54 -07:00
Nick Anderson
428094ef72 bug: correctly check windows event log channels for firing (#4550) 2018-06-13 21:40:50 +01:00
Filipe Manco
366141fda2
Catch exceptions by ref on windows processes (#4541) 2018-06-13 21:06:38 +01:00
Filipe Manco
98ccbcc250
Remove /dev/null monitoring from fsevents (#4549) 2018-06-13 20:33:32 +01:00
Alexandru Stefanica
674efda216 Fix autoloaded extension processes outliving the main process (#4359) 2018-06-13 20:33:02 +01:00
Filipe Manco
08300c13e8 Git pre-commit hook handle already formatted files (#4539) 2018-06-13 17:28:17 +01:00
Filipe Manco
b512f4be6d
ATCPlugin fix ctor initialization order (#4540) 2018-06-13 17:17:28 +01:00
Alessandro Gario
ea95870bc8 AuditdNetlink: Only start the netlink services once (#4535) 2018-06-13 14:57:57 +01:00
Filipe Manco
bb57c489de
Removed extra empty line at top of file (#4543) 2018-06-13 14:51:44 +01:00
Filipe Manco
92dbd15a89
Fix comment typos (#4542) 2018-06-13 14:51:27 +01:00
Filipe Manco
98f00bea4f
SQL::selectFrom() pass columns as ref (#4544) 2018-06-13 14:32:10 +01:00
Filipe Manco
0a08620b65
Move process namespaces to separate table (#4534) 2018-06-13 14:28:16 +01:00
Alexander
d22146beac Fix up flaky fileops_tests (#4529) 2018-06-13 10:18:27 +01:00
Alessandro Gario
b64dbb0f53 auditdnetlink: Do not reset the handle when poll() returns EINTR (#4531) 2018-06-13 10:06:53 +01:00