Pablo S. Torralba
778951d6a4
Remove osx dependency on system() call to get arp information
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
c7fc2cee22
rename vtable field arp->mac
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
4f524abbea
arp vtable different implementation in osx and linux
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
413d6f068b
Change fgetln (osx specific) in favour of getline (both osx and linux)
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
1843d80660
arp vtable with ip, arp and interface where it was seen
2014-11-16 19:49:40 -08:00
mike@arpaia.co
bfceaf8453
blacklisting port_inode and socket_inode
...
port_inode and socket_inode have caused a few issues lately and, as of
right now, they both have open issues against them. For the time being,
I'm going to blacklist them. When the tables are production-ready, we
can re-add them back in to the base linux build.
2014-11-16 09:42:57 -08:00
Teddy Reed
a1898ef03b
Check tables row vector size before access
2014-11-14 15:18:25 -08:00
Teddy Reed
02841f5e7f
Add kernel userland-API inet_diag header
2014-11-14 01:42:34 -08:00
Teddy Reed
565bce3c07
Fix unwind exception catching
2014-11-14 01:42:00 -08:00
Teddy Reed
0c675b23f2
Fix testing (only requireInstance) for DBHandle once
2014-11-13 09:33:13 -08:00
Vincent Mauge
632151d56a
Set ouput_bit to 0 instead of cast error
2014-11-12 22:02:04 -08:00
Teddy Reed
153cc7208f
More control over logging
2014-11-12 18:19:22 -07:00
Teddy Reed
aa933491d2
Merge pull request #416 from theopolis/hack_fix_386
...
[Fix #386 ] This is a hack to fix Ubuntu unwinding
2014-11-12 16:43:18 -08:00
Teddy Reed
b419c79791
[ Fix #386 ] This is a hack to fix Ubuntu unwinding
2014-11-12 17:12:37 -07:00
mike@arpaia.co
a8832482b3
implementation for #360
2014-11-12 16:51:14 -05:00
mike@arpaia.co
b423286297
failing test
2014-11-12 16:30:18 -05:00
Teddy Reed
0d8b9d3eaa
Use SQLite types
2014-11-12 11:07:24 -08:00
Teddy Reed
525a3b79a0
Tons of new build features
...
* The OS/DISTRO are available as defines when writing tables:
UBUNTU, UBUNTU_14_04, UBUNTU_12_04
CENTOS, CENTOS_6_6
DARWIN, DARWIN_10_10, DARWIN_10_9
* The table generation tooling now grabs virtual tables templates
from ./osquery/tables/templates/<name>.cpp.in.
* The table generation tooling will detect reserved column names.
* suid_bin uses the new UBUNTU to restrict calls to root (fix #362 ).
2014-11-12 00:57:47 -08:00
Teddy Reed
8e408f987e
Table spec documentation examples
2014-11-11 11:26:11 -08:00
mike@arpaia.co
88bec43d8a
removing superfluous nullptr checks. close #404
2014-11-11 11:17:28 -05:00
Bryan Eastes
ec081c9a54
Added --host_identifier option
...
Conflicts:
osquery/core/system.cpp
2014-11-10 16:41:13 -05:00
Teddy Reed
8b1af689db
Blacklist is now on by default
2014-11-10 13:30:38 -08:00
Teddy Reed
050e942d11
Support USE_BLACKLIST=1 to remove tables from release
2014-11-10 13:30:38 -08:00
Abe Stanway
811d98c595
free(linkname) and no more 'self'
2014-11-10 15:02:31 -05:00
Abe Stanway
30149a70f9
Updated
2014-11-10 15:02:31 -05:00
Abe Stanway
322fde0121
Socket_inode and port_inode tables to map PIDs->ports via netlink inet_diag
...
Example query:
```
SELECT port.local_port,
port.remote_port,
port.local_ip,
port.remote_ip,
socket.pid,
process.name,
process.cmdline
process.path
FROM socket_inode AS socket
JOIN port_inode AS port
ON socket.inode = port.inode
INNER JOIN processes AS process
ON socket.pid = process.pid;
```
2014-11-10 15:02:31 -05:00
Teddy Reed
86d2ac208b
Use leaks for OSX memory leak profiling
2014-11-10 11:34:17 -08:00
Mike Arpaia
3245e5a6cd
Merge pull request #394 from wizzat/process_args
...
Add cmdline to darwin
2014-11-10 13:20:47 -05:00
Teddy Reed
19aa99583e
Linux processes vtable use freeproc
2014-11-10 10:12:47 -08:00
Mark Roberts
dc1684fca7
Add cmdline to darwin
2014-11-10 09:36:17 -08:00
mike@arpaia.co
bd4d1dfc0f
Removing superfluous logging from DBHandle. close #387
2014-11-10 12:15:35 -05:00
Teddy Reed
bc05f5de78
Merge pull request #383 from theopolis/fix_rpm_packages
...
[Fix #367 ] Check RPMTAG class before cast
2014-11-10 01:59:13 -08:00
Teddy Reed
b0ff403d3d
Fixing librpm API usage leaks
2014-11-10 01:48:07 -08:00
Teddy Reed
b2e806e453
Merge pull request #384 from ga2arch/stringstream
...
read the file directly into a stringstream buffer
2014-11-09 13:30:22 -08:00
Gabriele Carrettoni
77b521ce7b
read the file directly into a stringstream buffer
2014-11-09 16:57:35 +01:00
Teddy Reed
b77406b122
[ Fix #367 ] Check RPMTAG class before cast
2014-11-09 02:07:49 -08:00
Teddy Reed
84cc45a366
SQLite DBfile not needed
2014-11-09 01:01:17 -08:00
Teddy Reed
f7667ec440
Remove Threads requirement, cleanup flags
2014-11-09 00:00:57 -08:00
Teddy Reed
078d4cf7d2
Refector shell flags/versioning
2014-11-08 20:27:28 -08:00
Teddy Reed
62d6472cfe
Rethinking some build improvements
2014-11-08 19:28:35 -08:00
Gabriele Carrettoni
848bd4d96e
use unique_ptr instead of raw pointer
2014-11-09 02:23:19 +01:00
Veres Lajos
afc82c722f
typo fixes - https://github.com/vlajos/misspell_fixer
2014-11-07 22:18:02 +00:00
Alexander Polyakov
00dbf282a6
/ is not always readable
2014-11-07 01:00:58 +03:00
Alexander Polyakov
78af7dd885
Catch exception in pathExists
...
boost::filesystem::exists() throws
2014-11-07 00:20:22 +03:00
Alexander Polyakov
c0d827f534
Add euid / egid to process table
...
(not tested on darwin)
2014-11-06 01:35:52 +03:00
mike@arpaia.co
05cfff81c8
clang-format
2014-11-04 11:42:30 -08:00
mike@arpaia.co
896a4f2957
generic users function and some general cleanups
2014-11-04 11:40:54 -08:00
Zachary Wasserman
0b30b9f692
Add basic Mac startup items vtable
2014-11-04 11:40:54 -08:00
Alexander Polyakov
a60230af5e
linux/processes: fix infinite loop, throw away workaround
2014-11-04 15:31:35 +03:00
Teddy Reed
03034780f1
Add note about blocking process_env as non-su
2014-11-03 23:46:47 -08:00
