Akshay Dixit
|
6c418507e6
|
renamed lspci to pci_devices and specified it linux only
|
2014-11-02 21:09:04 -07:00 |
|
Akshay Dixit
|
afd9d5e160
|
changed lspci to be a linux only virtual table, and added udev dependency to provisions.sh
|
2014-11-02 21:07:35 -07:00 |
|
Akshay Dixit
|
7896e7f78e
|
added lspci virtual table and libudev dependencies
|
2014-11-02 21:03:43 -07:00 |
|
Teddy Reed
|
1abbe7478a
|
Merge pull request #332 from vmauge/depends_gentable
Add dependency to gentable.py
|
2014-11-02 17:50:07 -08:00 |
|
Vincent Mauge
|
b18dcaa7cb
|
Add dependency to gentable.py
With this commit, a change to gentable.py will trigger
the regeneration of cpp code for each table.
|
2014-11-02 17:00:47 -08:00 |
|
Teddy Reed
|
24b7be320c
|
Fix #328, add gflags defines for shell-internal flags
|
2014-11-02 15:40:35 -08:00 |
|
Teddy Reed
|
37b8336a1f
|
Silence parentheses warnings in linux/mounts
|
2014-11-02 01:42:04 -08:00 |
|
Teddy Reed
|
287bbc06a8
|
Merge pull request #316 from LTD-Beget/mounts
Mounts table for linux
|
2014-11-02 01:37:00 -08:00 |
|
Larz Conwell
|
a0d7533c96
|
Closes #319, Install libraries and headers.
|
2014-11-02 00:08:11 -04:00 |
|
Alexander Polyakov apolyakov@beget.ru
|
fd5ed3bc19
|
Rename dir to path
|
2014-11-02 01:09:24 +03:00 |
|
Alexander Polyakov apolyakov@beget.ru
|
fa81e54e27
|
Fix indentation, no functional change
|
2014-11-02 00:36:56 +03:00 |
|
Alexander Polyakov
|
58716d6cfa
|
Mounts table for linux
|
2014-11-01 16:12:56 +03:00 |
|
Teddy Reed
|
eb240ac527
|
RPM table and more robust Linux building
|
2014-10-31 21:59:10 -07:00 |
|
castrapel
|
2557bac3d4
|
RPM Package listing is now working
|
2014-10-31 16:52:58 -07:00 |
|
castrapel
|
a51f97871f
|
Adding RPM functionality for CentOS packages (Not working in EL6 due to older rpm-devel)
|
2014-10-31 16:52:58 -07:00 |
|
Teddy Reed
|
fd8f5782ab
|
Merge pull request #308 from facebook/lsof
Darwin lsof
|
2014-10-31 16:32:30 -07:00 |
|
Mark Roberts
|
675dc308b9
|
Fix possible errors with getProcPath and getProcName
|
2014-10-31 16:07:09 -07:00 |
|
Mike Arpaia
|
fba9d1143b
|
Merge pull request #310 from facebook/quarantine
Add quarantine vtable for OSX
|
2014-10-31 15:35:47 -07:00 |
|
Pablo S. Torralba
|
42c73897bf
|
Some minor stetic changes to keep the code clean
|
2014-10-31 14:27:15 -07:00 |
|
Mark Roberts
|
534999b396
|
Whitespace
|
2014-10-31 13:49:25 -07:00 |
|
Pablo S. Torralba
|
366274504b
|
Feedback fixes to clean the code a bit
|
2014-10-31 13:44:00 -07:00 |
|
Mark Roberts
|
f38bcd390e
|
Add file_type to process_open_files
|
2014-10-31 11:13:35 -07:00 |
|
Teddy Reed
|
0604b3a5e0
|
Fix 301, pragma cols pretty print
|
2014-10-31 10:19:49 -07:00 |
|
Pablo S. Torralba
|
a6e04efdd7
|
Add quarantine vtable for OSX
The tables reports:
- path: The file in quarantine
- creator: The application that created the file
Example:
osquery> select * from quarantine limit 10;
+----------------------------------------------------------------------------+---------------+
| path | creator |
+----------------------------------------------------------------------------+---------------+
| /Applications/Adium.app | Google Chrome |
| /Applications/Adium.app/Contents | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature/CodeResources | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Adium | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Headers | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/PrivateHeaders | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Resources | Google Chrome |
+----------------------------------------------------------------------------+---------------+
Fixes issue #231
|
2014-10-31 06:10:51 -07:00 |
|
Mark Roberts
|
3cf5aa4bae
|
Add lsof for #28 functionality to Darwin, refactor to use shared infra for process_envs
|
2014-10-31 03:28:14 -07:00 |
|
Teddy Reed
|
bcca0824b0
|
Fix memset/memcpy for pretty print in osqueryi
|
2014-10-30 18:07:32 -07:00 |
|
Teddy Reed
|
1554bf3295
|
Fix #290, add permissions to osqueryd logging
|
2014-10-30 15:03:05 -07:00 |
|
yetanotherhacker
|
8cee7e0b3c
|
Spelling fixes in comments and output.
|
2014-10-30 04:27:00 -04:00 |
|
Teddy Reed
|
4ed61ff868
|
Merge pull request #288 from vmauge/NewLongType
Add new long type and migrate some vtables
|
2014-10-29 23:12:52 -07:00 |
|
Vincent Mauge
|
07bd114107
|
Change users table to used new long long int type for uid and gid
It is now possible to do a proper order on uid or gid, ie:
SELECT * FROM users ORDER BY uid;
|
2014-10-29 18:57:12 -07:00 |
|
Vincent Mauge
|
755d8c198e
|
Change groups table to used new long long int type for gid
It is now possible to do a proper order on gid, ie:
SELECT * FROM groups ORDER BY gid;
|
2014-10-29 18:57:00 -07:00 |
|
Mike Arpaia
|
0f037d4082
|
Merge pull request #283 from facebook/fix_sockaddr_inc
Fix #277, add socket.h to interfaces on darwin
|
2014-10-29 17:41:36 -07:00 |
|
Teddy Reed
|
cd74544208
|
Fix #277, add socket.h to interfaces on darwin
|
2014-10-29 16:44:17 -07:00 |
|
Scott Robinson
|
e57bfac5fb
|
Fix a small typo.
|
2014-10-30 08:25:25 +11:00 |
|
Mark Roberts
|
3b90184da3
|
Fix clang format error
|
2014-10-29 10:43:32 -07:00 |
|
Mark Roberts
|
0867c2b547
|
Add process_envs table for OSX and Linux for issue #99
|
2014-10-29 03:45:26 -07:00 |
|
Teddy Reed
|
39f866387f
|
[vtables] CPUID asm call feature information
|
2014-10-29 03:09:34 -07:00 |
|
Teddy Reed
|
1f1b38976a
|
Merge pull request #261 from facebook/crontab
[vtables] Crontab parsing for system/users
|
2014-10-29 02:52:11 -07:00 |
|
Teddy Reed
|
6db0c67555
|
Merge pull request #269 from vmauge/suidbin
Add suid_bin vtable
|
2014-10-29 02:30:29 -07:00 |
|
Teddy Reed
|
8a9374d6e3
|
[vtables] Support linux crontab vars
|
2014-10-29 02:24:00 -07:00 |
|
Teddy Reed
|
94c64d80ce
|
Merge pull request #267 from facebook/kernel_modules
[vtables] Linux kernel modules from procfs
|
2014-10-29 02:03:46 -07:00 |
|
Vincent Mauge
|
471d5faaa0
|
Add suid_bin vtable
The vtabel report :
- path: full path of the file
- unix_user: name of the owner (if not available display the uid)
- unix_group: name of the groupe (if not available display the gid)
- permissions: report suid or guid
* S for suid bin
* G for guid bin
Example :
osquery> select * from suid_bin;
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| path | unix_user | unix_group | permissions |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| "/bin/ps" | root | wheel | S |
| "/bin/rcp" | root | wheel | S |
| "/Users/vmauge/suid_test" | vmauge | 999 | SG |
| "/usr/bin/at" | root | wheel | S |
| "/usr/bin/atq" | root | wheel | S |
| "/usr/bin/atrm" | root | wheel | S |
| "/usr/bin/batch" | root | wheel | S |
| "/usr/bin/crontab" | root | wheel | S |
| "/usr/bin/ipcs" | root | wheel | S |
| "/usr/bin/lockfile" | root | mail | G |
| "/usr/bin/login" | root | wheel | S |
| "/usr/bin/newgrp" | root | wheel | S |
| "/usr/bin/procmail" | root | mail | G |
| "/usr/bin/quota" | root | wheel | S |
| "/usr/bin/rlogin" | root | wheel | S |
| "/usr/bin/rsh" | root | wheel | S |
| "/usr/bin/su" | root | wheel | S |
| "/usr/bin/sudo" | root | wheel | S |
| "/usr/bin/top" | root | wheel | S |
| "/usr/bin/wall" | root | tty | G |
| "/usr/bin/write" | root | tty | G |
| "/usr/sbin/postdrop" | root | _postdrop | G |
| "/usr/sbin/postqueue" | root | _postdrop | G |
| "/usr/sbin/rpc.net" | root | wheel | S |
| "/usr/sbin/rpcset" | root | wheel | S |
| "/usr/sbin/traceroute" | root | wheel | S |
| "/usr/sbin/traceroute6" | root | wheel | S |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
This commit fixes issue #253.
|
2014-10-29 01:33:58 -07:00 |
|
Teddy Reed
|
339b63677e
|
[vtables] Rename homebrew files, some cleanup
|
2014-10-29 00:34:55 -07:00 |
|
Teddy Reed
|
c1991e94e5
|
[vtables] Add user crons and use files
|
2014-10-29 00:28:19 -07:00 |
|
Martin Majlis
|
d645dfc257
|
Initial implementation for the homebrew table.
|
2014-10-28 21:03:56 -07:00 |
|
Teddy Reed
|
9abcbcd485
|
[vtables] Linux kernel modules from procfs
|
2014-10-28 21:01:51 -07:00 |
|
Martin Majlis
|
e8eb1e222f
|
Reformating the code with clang-formatter.
|
2014-10-28 19:43:13 -07:00 |
|
Martin Majlis
|
8b8ec7c644
|
Added initial implementation for crontab.
|
2014-10-28 17:52:03 -07:00 |
|
Teddy Reed
|
47d1f13966
|
Using Cpp03 to remove double right angle brackets
|
2014-10-27 17:56:55 -07:00 |
|
Teddy Reed
|
6e60612520
|
Using clang-format 3.5
|
2014-10-27 17:37:36 -07:00 |
|