Teddy Reed
dd9fa25d78
[ Fix #1171 , #1089 ] Add configurable max reads
...
There are 3 new options that control how files are read:
--read_max: controls the maximum size, in bytes, for file reads. If a file is larger than `read_max` the read will fail.
--read_user_max: similar to `read_max` but applies additional limitations to user-controlled files.
--read_user_links: a boolean control to enable/disable following symlinks for user-controlled files.
Important highlights:
If files exceed the configured max, those reads will fail.
The `read_max` will override `read_user_max` if it is set lower.
A default integer value of `0` will disable the limitations.
The default `read_max` is set to 50M and the default `read_user_max` is 10M.
2015-07-06 00:49:43 -07:00
Teddy Reed
4a6c002f62
Allow unit tests execs from project root
2015-05-23 13:12:31 -07:00
Teddy Reed
b66a350526
Allow snapshot scheduled items
2015-04-29 15:55:00 -07:00
Teddy Reed
d0bbb0bc4f
Towards safer and shuffled unittests
2015-04-29 14:43:27 -07:00
Teddy Reed
be65922569
Fast tests
2015-04-27 09:40:31 -07:00
Javier Marcos
ddb41ae84a
Adding tests to the prototocols table
2015-04-22 17:49:27 -07:00
Sharvil Shah
e7a3d24ece
Fix etc_hosts hostname parsing so that inline comments are now ignored; update tests
2015-04-06 23:32:56 -07:00
Teddy Reed
14a09cc6f2
Change schedule to a map, splay on config update
2015-03-24 16:28:49 -07:00
Mitchell Grenier
544615ef57
Bug fix for REC_LIST_FOLDERS
...
Fixed a bug where when using REC_LIST_FOLDERS, the root resolution directory
would not be returned.
2015-03-01 18:26:37 -08:00
Teddy Reed
451ef686ed
Building example extension with SDK
2015-02-18 20:11:00 -08:00
Mitchell Grenier
de5ac74fab
All changes addressed
2015-02-13 16:52:11 -08:00
Teddy Reed
ed9bae29b7
Organizing headers/build for SDK
2015-02-03 14:59:32 -08:00
Zachary Wasserman
5a2296b91b
Add useful operator implementations to Status
2015-01-29 17:33:41 -08:00
Teddy Reed
9c1faec090
Isolate glog include and depend on libglog for #652
2015-01-21 13:37:06 -08:00
mike@arpaia.co
b9f732c31f
Updating the license comment to be the correct open source header
...
As per t5494224, all of the license headers in osquery needed to be updated
to reflect the correct open source header style.
2014-12-18 10:52:55 -08:00
Teddy Reed
fefe6de824
OSX XProtect siganture DB as virtual table
2014-12-16 21:35:26 -08:00
Teddy Reed
7c738c8497
Codemod to improve include search paths
2014-12-03 15:14:02 -08:00
Bryan Eastes
ec081c9a54
Added --host_identifier option
...
Conflicts:
osquery/core/system.cpp
2014-11-10 16:41:13 -05:00
Teddy Reed
47d1f13966
Using Cpp03 to remove double right angle brackets
2014-10-27 17:56:55 -07:00
Teddy Reed
6e60612520
Using clang-format 3.5
2014-10-27 17:37:36 -07:00
mike@arpaia.co
627821abc1
Periodic clang-format
2014-09-21 14:29:28 -07:00
mike@arpaia.co
b5ee19f49f
Removing the osquery::db namespace
2014-09-21 14:27:09 -07:00
mike@arpaia.co
fb2591d82a
#143
2014-09-15 11:09:33 -07:00
Teddy Reed
4ffd184eaf
Changes for Linux (Ubuntu 14.04) build
2014-09-05 10:58:58 -07:00
mike@arpaia.co
66a2a6fdec
Fix performance issue with the disk serializer
...
This is the issue noted in #76 . Keeping all historical results of
queries in the HistoricalQueryResults struct makes serializing and
deserializing those structs very, very slow as time goes on. By only
storing the last execution of the query, we keep the performance
constant, but we kill the feature where osquery can rebuild timelines
without accessing logs. After talking it over, we decided that this
isn't actually that big of a deal because, if you really wanted to
rebuild the old data, you should be able to process the logs, similarly
to bin log replication in MySQL.
2014-09-02 13:13:12 -07:00
mike@arpaia.co
15519b348e
Adding LaunchDaemon and flagfile to the repo/package
2014-08-26 11:26:52 -07:00
Teddy Reed
444cea0649
[vtable_cacerts] New CA certificates table.
2014-08-19 13:47:09 -07:00
mike@arpaia.co
3760e4cce5
Apple virtual table for LaunchAgents and LaunchDaemons
2014-08-15 13:46:09 -07:00
mike@arpaia.co
9973335e49
OS X virtual tables for currently installed applications
2014-08-15 12:58:19 -07:00
mike@arpaia.co
e723306c13
Ran clang-format across the codebase
2014-08-15 12:29:51 -07:00
mike@arpaia.co
1a381e0feb
Virtual tables for Apple's application level firewall
2014-08-14 11:33:20 -07:00
mike@arpaia.co
3b85618ae0
property list parsing with native C++ data types
2014-08-13 11:00:28 -07:00
mike@arpaia.co
21afc0b75b
raw string literals in etc_hosts test content
2014-08-06 16:08:16 -07:00
mike@arpaia.co
1a114c4f18
bug fixes
2014-08-05 17:42:24 -07:00
mike@arpaia.co
7b3de7a3eb
implementation for /etc/hosts vtable
2014-08-05 17:42:24 -07:00
mike@arpaia.co
0c1e7de598
virtual table structure for #25 , the /etc/hosts vtable
2014-08-05 17:42:24 -07:00
mike@arpaia.co
ec30260f37
core/status to status and header cleanup
2014-08-05 16:13:55 -07:00
mike@arpaia.co
73a32b7294
Initial commit
2014-07-30 17:35:19 -07:00
