Teddy Reed
811d578739
Merge pull request #1599 from theopolis/socket_events
...
Refactor a bit of config and add socket_events table to Linux
2015-10-27 15:30:15 -07:00
Teddy Reed
b81b6de6ae
This refactors a bit of config/packs and adds a socket_events table to Linux.
...
The refactor of config/packs was initiated because event subscribers needed
a method for toggling `::init` based on some configurable option. In the case
of auditd, turning on the support with `--disable_audit=false` used to start
auditing the EXECVE syscall. It was understandable that this would cause
latency based on the number of processes executing per measure of time.
A new `socket_events` table will do the same but for `bind` and `connect`. These
are less-obvious and for now, require a scan of /proc for socket tuples. In the
future this file descriptor to socket tuple will be faster.
2015-10-27 15:13:02 -07:00
Teddy Reed
b8087a1b26
Fix readFile TOCTOU error
2015-10-26 01:21:05 -07:00
Teddy Reed
654830cf11
Merge pull request #1594 from rcseacord/additional-sign-fixes
...
eliminated some warnings from Clang 3.7 analyze mode
2015-10-23 13:03:54 -03:00
Robert C. Seacord
09481d0381
Fixed some type problems, casting away const, integer types, old style casts, etc.
2015-10-21 20:56:58 +00:00
Robert C. Seacord
1d9695ac31
eliminated some warnings from Clang 3.7 analyze mode
2015-10-21 06:02:58 +00:00
Robert C. Seacord
7a87be9ada
more sign coversion errors
2015-10-20 06:08:01 +00:00
Robert C. Seacord
1d7877d120
remmoved fanitize compiler option
2015-10-20 02:51:57 +00:00
Teddy Reed
c0257aa7d1
Merge pull request #1589 from theopolis/fix_1578
...
[Fix #1578 ] Support OPENSSL_NO_SSV3
2015-10-19 11:25:46 -07:00
Teddy Reed
7ba87a88bb
Merge pull request #1585 from rcseacord/additional-sign-fixes
...
Additional sign fixes
2015-10-19 11:25:18 -07:00
Teddy Reed
8214dd1309
Merge pull request #1584 from theopolis/fix_1580
...
[Fix #1580 ] Handle exceptions in linux process_memory_map
2015-10-19 09:28:16 -07:00
Teddy Reed
f891503cd9
Merge pull request #1577 from nemith/dpkg
...
Support for newer versions of libdpkg
2015-10-19 09:24:37 -07:00
Teddy Reed
00875988dc
Use native OS X version as min ABI
2015-10-18 20:47:09 -07:00
Teddy Reed
2bd6398b53
[ Fix #1578 ] Support OPENSSL_NO_SSV3
2015-10-18 20:47:06 -07:00
Teddy Reed
bc50c053fb
Remove boolean type-columns from file in favor of 'type'
2015-10-17 12:16:54 -07:00
Robert C. Seacord
e57828aac3
changes for integer sign problems
2015-10-17 00:18:35 +00:00
Teddy Reed
3cc7984cc2
[ Fix #1580 ] Handle exceptions in linux process_memory_map
2015-10-16 16:59:23 -07:00
Robert C. Seacord
acb2f6f628
eliminating diagnostics, mostly for comparisons between signed and unsigned operations
2015-10-16 16:10:37 +00:00
Robert C. Seacord
37b8e83a9e
fixes for problems related to unsigned to signed integer comparisons
2015-10-16 16:10:36 +00:00
Robert C. Seacord
0a6a36485c
redeclared i from int to size_t in two locatoins to eliminate several signed to unsigned comparisons
2015-10-16 16:10:36 +00:00
Teddy Reed
3f8cb14fbb
Merge pull request #1579 from nemith/segv
...
Fix segfault on interfaces tables
2015-10-15 17:58:04 -07:00
Brandon Bennett
f683871653
Fix segfault on interfaces tables
...
getifaddrs(3) states that ifa_addr can be null. Check to make sure they are not null before accessing them
2015-10-15 16:53:14 -06:00
Brandon Bennett
65738a73c1
Support for newer versions of libdpkg
...
Libdpkg has some breaking changes in newer versions which prevented
compiling the deb_packages table on Ubuntu 15.04. This change looks for
the libpkg version user pkg-config and adds some preprocessor magic to
support the newer versions.
2015-10-15 16:43:14 -06:00
Teddy Reed
3be0994933
[ Fix #1570 ] Check for invalid apt sources
...
This fixes a crash identified by @endrazine.
When apt sources data in /etc/apt/sources.list or /etc/apt/sources.list.d/{*}.list contain invalid data/lines the cache_file.GetPkgCache(); call will fail and cache will be nullptr. Subsequent usage results in a SIGSEV.
To reproduce the fault try:
$ zzuf -I /etc/ -r 0.01:0.1 -s 0:1000 -v \
./build/trusty/osquery/osqueryi --registry_exceptions=true --verbose \
"select count(*) from apt_sources"
Signed-off-by: Jonathan Brossard
2015-10-15 15:20:26 -07:00
Teddy Reed
201fbabb28
[ Fix #1559 ] Allow boost.filesystem incorrect LC_CTYPE
2015-10-13 09:55:44 -07:00
Teddy Reed
4852e3525f
Merge pull request #1550 from theopolis/ext_clean
...
Extension managers should clean extension sockets when starting
2015-10-12 13:36:10 -07:00
Teddy Reed
171bfecd20
Merge pull request #1552 from theopolis/glog_benchmark
...
Build Glog with OS X ABI, add SKIP_BENCHMARK
2015-10-12 13:35:45 -07:00
Teddy Reed
34717fda29
Merge pull request #1554 from mlw/fix-lingering-socket-fds
...
Close socket fds when finished with them
2015-10-12 13:32:52 -07:00
Matthew White
2446b22a5f
Close socket fds when finished with them
2015-10-12 09:59:09 -07:00
Teddy Reed
b7a2d861bf
Build Glog with OS X ABI, add SKIP_BENCHMARK
2015-10-11 14:37:49 -07:00
Teddy Reed
c7ff3dfb4f
Merge pull request #1549 from theopolis/more_11
...
Bumb RocksDB to ERROR, fix OS X kernel_info, silence compile warnings
2015-10-11 20:39:56 +01:00
Teddy Reed
6b16720039
Fix kernel_info on OS X, remove md5
2015-10-11 11:43:42 -07:00
Teddy Reed
fb56646623
Restrict RocksDB log level to ERROR
2015-10-11 10:50:56 -07:00
Mike Arpaia
4d0cd46f42
Merge pull request #1539 from theopolis/nit_101
...
Minor nits around distributed CLIs
2015-10-09 14:55:05 -07:00
Teddy Reed
dbdf64ed6e
Use better defines for 10.11
2015-10-08 07:22:48 -07:00
Teddy Reed
d5a7498881
Extension managers should clean extension sockets when starting
2015-10-08 06:47:23 -07:00
Teddy Reed
689ae4c865
Minor nits around distributed CLIs
2015-10-02 11:33:50 -07:00
Mike Arpaia
5789d889f4
Merge pull request #1538 from marpaia/discovery_queries
...
[fix #1536 ] Schedule iteration pass-by-reference
2015-09-30 15:50:05 -07:00
Mike Arpaia
65df593d33
[ fix #1536 ] Schedule iteration pass-by-reference
...
There was a bug in the `osquery::Schedule` container object such that,
when the iteration through the schedule occured, pack objects were being
passed by value (copied) instead of passed by reference. Thus, the
discovery query would be executed, the object's cache would be updated,
and then the object would go out of scope and be destructed, thus
leaving the original object without ever having ran the discovery query.
This caused discovery queries to thrash. Bad times.
I added a new test so that we don't regress here as well as const'd a
few functions that should have been const in `osquery::Pack`.
2015-09-30 15:41:43 -07:00
Matthew White
25dbd33e1e
Fixed bug when checking if config is valid
2015-09-30 10:50:28 -07:00
Teddy Reed
2a71162b0c
Merge pull request #1534 from theopolis/glob_fix
...
Fix potential hang with recursive globbing
2015-09-28 18:06:53 -07:00
Teddy Reed
66888de80a
Fix potential hang with recursive globbing
2015-09-28 17:50:25 -07:00
Teddy Reed
31b7966088
[ Fix #1531 ] Use libarchive finish for safari_extension parsing
2015-09-28 17:33:42 -07:00
Teddy Reed
bbac2cf07f
[ #1529 ] Allow DB Readonly with RocksDB lite
2015-09-28 01:50:32 -07:00
Teddy Reed
64c18a70a9
Merge pull request #1525 from theopolis/process_adds
...
Add state, group, and nice to processes
2015-09-24 14:43:17 -07:00
Teddy Reed
5890901c00
Add state, group, and nice to processes
2015-09-24 13:11:46 -07:00
Teddy Reed
2d4150499a
Merge pull request #1526 from theopolis/linux_sigs
...
[#1488 ] Shutdown Linux event publishers responsibly
2015-09-24 11:08:41 -07:00
Teddy Reed
bb65ec49ac
[ #1488 ] Shutdown Linux event publishers responsibly
2015-09-22 23:06:23 -07:00
Mike Arpaia
327a9bcdb1
Merge pull request #1522 from marpaia/startup_items
...
Include system startup items
2015-09-22 16:06:20 -07:00
Mike Arpaia
b09031adda
Include system startup items
...
We were not parsing system startup items.
2015-09-22 15:50:55 -07:00
