Commit Graph

4426 Commits

Author SHA1 Message Date
Craig Cook
7a66202e5e
Fix make sync on centos7 (#4574)
* Add LIBRARY_PATH environment variable to sync.sh so that "make sync" works as expected to find libraries
needed to link.  Added 2nd parameter (libraries path) to CMakeList.txt when calling sync.sh

* Revert database CMakeLists.txt change - as was for testing

* Add indentation to sync.sh

* Fix indentation on tool/sync.sh
2018-06-19 12:41:02 +01:00
Chris Long
5ee495504f docs: Updating process auditing documentation (#4477) 2018-06-19 01:51:55 -04:00
Filipe Manco
4d580d0fa9 Implement make format_check (#4583) 2018-06-18 18:55:20 -07:00
Teddy Reed
e56b2124ba
deps: revert linuxbrew updates from #4561 (#4590) 2018-06-18 18:53:28 -07:00
M Amin
7623f5380f tables: Added NTFS ACL permissions virtual table (#4518) 2018-06-18 16:12:36 -04:00
Mitchell Grenier
c8133b2810 Remove linux undents (#4584) 2018-06-18 08:32:24 -07:00
M Amin
9910f13f0f update win64 openssl to 1.0.2o (#4564) 2018-06-18 08:12:00 -07:00
Max Kareta
4b8d7f0c53
moved from file(GLOB); added CMAKE_CURRENT_LIST_DIR to support include syntax (#4582) 2018-06-18 14:24:20 +01:00
Max Kareta
408c54565e
Removing macOS kernel module (#4572) 2018-06-17 19:21:07 +01:00
Nick Anderson
2e9b1e295f
tests: ensure service has been installed before starting (#4576) 2018-06-17 11:38:12 -04:00
Mitchell Grenier
19c0bedf19
Update brew and formulae for Mojave (#4561) 2018-06-15 13:44:02 -07:00
Giorgi Guliashvili
c7ad4350e1
dispatcher race conditions (#4570)
* dispatcher race conditions

dispatcher had 2 race condition.
In joinServices it was accessing service_threads_ with different lock(join_lock). However, if by that time new service was added baad things would happen :) .

Also dispatcher was accessing services_.size() without the lock. ( If by that time service was removed or joined bad things would happen)
2018-06-15 18:01:44 +01:00
Giorgi Guliashvili
ff1747347e
InterruptableRunnable RunnerInterruptPoint redesign (#4545)
* InterruptableRunnable RunnerInterruptPoint redesign

There were several inefficiencies in the old version of RunnerInterruptPoint and InterruptableRunnable.

1) RunnerInterruptPoint was throwing the exception when interrupted, however, the exception was always ignored.

2) InterruptableRunnable used the read-write lock, however only write lock was used.

3) InterruptableRunnable InterruptableRunnable, stored almost similar variable stop_, interrupted_.

4) std::atomic<bool> interrupted_ was used with locks, even though it was accessed by default safest access mode memory_order_seq_cst. So no additional cache invalidation was needed.

5) InterruptableRunnable contained code(in method interrupted() and variables bypass_check_, checked) just for testing. Which was slowing down method interrupted().

6) Some more confusing things. notify_all was not needed, as only one thread could be waiting for the conditional variable. RunnerInterruptPoint:: pause(void) looks ambiguous and that's why was not used anywhere.

I resolved all these problems by merging InterruptableRunnable and RunnerInterruptPoint into the InterruptableRunnable.

1) No use of the exception.
2) 4) Simple mutex, which is only used for pauseMilli. InterruptableRunnable::interrupted and InterruptableRunnable::interrupt function lock-free.
3) Single variable interrupted_.
5) Made InterruptableRunnable::interrupt virtual. Tests override interrupt to make things testable.
6) change to notify_one and removed pause without the specific time.
2018-06-15 16:15:43 +01:00
Nick Anderson
9259da6cc9
deploy: set default flagfile to utf-8 for MSI package (#4559) 2018-06-15 10:18:49 -04:00
Teddy Reed
17922f49bf
deps: Update openssl to version 1.0.2o (#4555) 2018-06-15 06:02:38 -07:00
Alexander
18f46707fe
actualize names for *base64* family functions (#4568)
Issue: #4563
2018-06-15 11:37:01 +01:00
Filipe Manco
b522e7422b
Build posix with -fno-limit-debug-info (#4558) 2018-06-15 10:12:28 +01:00
Mitchell Grenier
ff528fc2c7
WEL format change (#4562) 2018-06-14 14:50:19 -07:00
Teddy Reed
dad9fa6018
deps: Update yara to version 3.7.1 (#4557) 2018-06-14 07:13:17 -07:00
Alexander
9fb6a604dd
Force osqueryi to not use osquery extensions from system env in tests. (#4524)
To prevent any affects from system env.
2018-06-14 13:12:26 +01:00
Teddy Reed
9eae0bcffd
deps: Update libxml2 to version 2.9.7 (#4553) 2018-06-14 04:13:54 -07:00
Nick Anderson
428094ef72 bug: correctly check windows event log channels for firing (#4550) 2018-06-13 21:40:50 +01:00
Filipe Manco
366141fda2
Catch exceptions by ref on windows processes (#4541) 2018-06-13 21:06:38 +01:00
Filipe Manco
98ccbcc250
Remove /dev/null monitoring from fsevents (#4549) 2018-06-13 20:33:32 +01:00
Alexandru Stefanica
674efda216 Fix autoloaded extension processes outliving the main process (#4359) 2018-06-13 20:33:02 +01:00
Filipe Manco
08300c13e8 Git pre-commit hook handle already formatted files (#4539) 2018-06-13 17:28:17 +01:00
Filipe Manco
b512f4be6d
ATCPlugin fix ctor initialization order (#4540) 2018-06-13 17:17:28 +01:00
Alessandro Gario
ea95870bc8 AuditdNetlink: Only start the netlink services once (#4535) 2018-06-13 14:57:57 +01:00
Filipe Manco
bb57c489de
Removed extra empty line at top of file (#4543) 2018-06-13 14:51:44 +01:00
Filipe Manco
92dbd15a89
Fix comment typos (#4542) 2018-06-13 14:51:27 +01:00
Filipe Manco
98f00bea4f
SQL::selectFrom() pass columns as ref (#4544) 2018-06-13 14:32:10 +01:00
Filipe Manco
0a08620b65
Move process namespaces to separate table (#4534) 2018-06-13 14:28:16 +01:00
Alexander
d22146beac Fix up flaky fileops_tests (#4529) 2018-06-13 10:18:27 +01:00
Alessandro Gario
b64dbb0f53 auditdnetlink: Do not reset the handle when poll() returns EINTR (#4531) 2018-06-13 10:06:53 +01:00
Nick Anderson
6ff5aded99
bug: correctly check for failed process open (#4532) 2018-06-12 14:56:22 -04:00
Giorgi Guliashvili
698846fda4
base64 encoding and decoding optimized (#4507)
base64 encoding and decoding optimized
2018-06-12 18:37:04 +01:00
Giorgi Guliashvili
5e9332aea4
bug split(string,string,size_t) (#4515)
split(string,string,size_t) contained bug, it was joining on every delimiter, which would result to unusual outcome. However, test could not detect this problem as delim.size() was 1. It turned out, that this split is not used anywhere having delim.size() > 1, so completely fixing bug by changing signature of the method to split(string,char,size_t)
2018-06-12 18:34:09 +01:00
Mitchell Grenier
46e38e1c4a
Add decode back to cmdline pieces (#4521) 2018-06-12 10:30:54 -07:00
Alexander
343971caae
Do not continue FileOpsTests.* after file opening faulure (#4530)
Without ASSERT_* tests try to work with invalid file pointer - it doesn't make any sense
2018-06-12 18:20:08 +01:00
Filipe Manco
adedd50c9a
Registry: don't call external code holding lock (#4528) 2018-06-12 15:55:51 +01:00
Teddy Reed
e1676c9ef5 Make macOS signatures table architecture aware (#4525) 2018-06-11 14:03:57 -07:00
M Amin
bdd2c47551 build: Update provisioning and build scripts to VS2017 (as per #4151) (#4496) 2018-06-08 21:05:40 -07:00
Nick Anderson
e860e8e794
[Fix 4488] Ensure that corrupted DB entries are processed gracefully (#4508) 2018-06-08 20:56:16 -07:00
Filipe Manco
0f66afff6e Set parent to -1 on process_events (#4511) 2018-06-08 15:15:54 -07:00
Babatunde Micheal Okutubo
ffe025e0a3 tables: Report process limits on darwin and linux (#4219) 2018-06-08 10:53:17 -07:00
Alexander
4c2925743e If config update call from extension failed, do not go further (#4517) 2018-06-08 10:15:46 -07:00
Filipe Manco
94c9142ec6
Make gentable.py ignore non *.in template files (#4512) 2018-06-07 19:28:13 -07:00
Filipe Manco
516b0147f0 Move process_event's status to extended schema (#4509) 2018-06-07 16:12:15 -07:00
Max Kareta
0885f86e38
added git clang format pre-commit hook (#4510) 2018-06-07 16:05:46 -07:00
Jason Meller
8456b34993 Add battery virtual table for Darwin (#4168) 2018-06-07 09:47:45 -07:00