Commit Graph

5810 Commits

Author SHA1 Message Date
Stefano Bonicatti
7455824c43
CMake: Do not attempt to dllimport Thrift symbols (#6856)
The THRIFT_STATIC_DEFINE define should be publicly used,
because it's used in a header that will be included by osquery.
2020-12-27 19:39:33 -05:00
Stefano Bonicatti
14ee87479c
CI: Move cppcheck step after the tests (#6845)
Since cppcheck is a non-blocking check,
prefer running the tests first to have a quicker result
if something is wrong.
2020-12-27 11:22:47 -05:00
Mike Myers
1a91db92d6
Docs: fix all broken or redirected URLs and references (#6835) 2020-12-27 11:22:16 -05:00
Stefano Bonicatti
948a570c51
CMake: Fix platformtablecontaineripc include namespace generation (#6853)
The public header is only present on non Linux platforms.
2020-12-27 11:20:42 -05:00
Stefano Bonicatti
d8c3938d1c
Improve fuzzing speed and stack trace accuracy (#6851)
Add a special define when osquery is built for fuzzing.

With that is possible to enable code that ignores
changing log levels.
With the config fuzzer, even if the fuzzer code was settings
the minloglevel to 4, that was immediately changed by the osquery logic.

Do not run queries parsed from the config to improve
the config fuzzer performance and avoid oom issues.

When built for fuzzing, compile osquery and libraries
without optimizing the frame pointer away.
This in some cases improves the accuracy of the stack trace
presented when a bug is found.
2020-12-26 16:10:34 -05:00
Stefano Bonicatti
2f8e7d9725
Fix leaks when a query fails from the shell (#6849) 2020-12-26 16:09:53 -05:00
Teddy Reed
2c0791276e
CMake: Add an option to disable building libdpkg tables and library (#6848) 2020-12-26 16:09:16 -05:00
Teddy Reed
6eb9392cb1
Do not call unconfigured subscribers errors (#6847) 2020-12-26 16:08:08 -05:00
Stefano Bonicatti
a3109e65a7
Doc: Fix incorrect Slack urls (#6844) 2020-12-23 13:31:06 -05:00
Stefano Bonicatti
f33818e2c3
CI: Add a RelWithDebInfo Linux job to generate packages (#6838)
The job will output packages that will be used for the release.
We skip formatting checks and building tests,
so that more disk space is left for debug symbols.
2020-12-23 13:30:13 -05:00
Teddy Reed
253ac2c893
Update thrift to version 0.13.0 (#6822)
Code generation with:

$ thrift --gen cpp:moveable_types ./osquery.thrift
$ make format
2020-12-22 15:41:22 -05:00
Sharvil Shah
fb2bb9521f
[CI] Update macOS agent to 10.15 Catalina (#6680) 2020-12-22 10:11:25 -05:00
Stefano Bonicatti
704d75abed
CMake: Add an option to disable building AWS tables and library (#6831)
Added the OSQUERY_BUILD_AWS option due to
oss-fuzz CI failing to build the AWS EC2 library,
due to its high requirement of memory.
The fuzzers do not gain much from having these tables enabled,
moreover this can be used during development
to avoid building a possibly unneeded table.

Done some minor cleanups to remove logic duplication
and enable ec2 integration tests on all the platforms
that supports them.
2020-12-22 09:10:32 -05:00
Stefano Bonicatti
5b17d9a4b4
Permit running formatting earlier in the CI (#6836)
Also find the clang-format binary using find_program and
permit to give a path if it doesn't find it,
unless the Linux osquery toolchain is used.
2020-12-22 09:09:46 -05:00
Stefano Bonicatti
e14be45801
CMake: Add Valgrind support (#6834)
Add OSQUERY_ENABLE_VALGRIND_SUPPORT so that it's possible
to run osquery under Valgrind.
This is specifically required by the boost library
that needs to be compiled with a special define
and it also requires the valgrind.h header.

Also move the defines for the ASAN usage to the boost
library CMakeLists.txt instead of being in flags.cmake.
This way we reduce the unnecessary recompilation of code that
doesn't depend on boost, when switching options.
2020-12-22 09:04:51 -05:00
Teddy Reed
99b9857d92
Use make jobserver for OpenSSL on Linux and macOS (#6821) 2020-12-21 21:48:49 -05:00
Stefano Bonicatti
ccbb2529cc
CMake: Do not compile Windows libraries with debug symbols (#6833)
When possible try to avoid generating debug symbols
for third party libraries, when compiling in Debug or
RelWithDebInfo mode, like for POSIX platforms.

This might not always possible because there's no way
to explicitly disable symbol generation on Windows,
but this should be an improvement.
2020-12-21 21:46:38 -05:00
Stefano Bonicatti
8eda456bc0
CMake: Fix amalgamated tables generation on change (#6832)
The list of spec files, dependency of the amalgamated table generation,
was incorrectly specified.
When a list is used in a DEPENDS argument, all the components of
the argument should be a list.
Using double quotes breaks that.
2020-12-21 21:40:47 -05:00
Jason Meller
6e9f8720ae
Add new table location_services for darwin (#6826) 2020-12-21 10:37:31 -08:00
Stefano Bonicatti
9a3cccb5bd
CMake: Refactor and rename fuzzers build flag (#6829)
The flag to build the fuzzers is now OSQUERY_BUILD_FUZZERS
and it is independent from OSQUERY_BUILD_TESTS.

Now it's possible to build with the address sanitizer
but without any feature required by the fuzzers.

The fuzzers and the sanitizer flags are presented only on Linux.
2020-12-21 09:23:44 -05:00
Jason Meller
867bbef8ae
Add filevault_status to disk_encryption table (#6823) 2020-12-20 16:08:26 -05:00
Jason Meller
752f76946b
Place office_mru table spec in correct folder (#6827) 2020-12-20 16:04:26 -05:00
Stefano Bonicatti
1e3e4bc653
Update openssl to version 1.1.1i (#6820) 2020-12-19 19:00:26 -05:00
Stefano Bonicatti
90c981a0e9
Explicitly set the MSVC runtime library (#6818)
CMake doesn't add the /MD flag in the CMAKE_<LANG>_FLAGS_<CONFIG>
anymore, to be then replaced with /MT by us.
Without it, the build still defaults to using /MD, which is wrong.
2020-12-19 18:59:45 -05:00
Stefano Bonicatti
83b7e0468d
CI: Remove incorrect 2to3 symlink breaking Python brew upgrade (#6819)
Even if the macOS image have Python homebrew already installed,
there's the symlink /usr/local/bin/2to3 which points to the
system installed Python.
Normally that file is placed by homebrew Python,
but since it's not, upgrading the homebrew Python version
makes it soft fail because it cannot overwrite such symlink.
Later the CMake step fails to detect the correct Python version on the
system and the CI fails.

Since we are not interested in the Python 2 to 3 conversion,
delete the link and let homebrew place its own.
2020-12-19 15:19:19 -05:00
Sharvil Shah
965f8a7cf1
macOS: Fix OpenDirectory attribute mismatch. Closes #6320 (#6816) 2020-12-18 12:00:25 -08:00
Alessandro Gario
cfabaa9e28
Eventing framework refactor (#6610) 2020-12-17 22:21:53 -05:00
Mike Myers
c42be2b841
Fix wifi_tests on macOS 10.15 and above (#6724) 2020-12-17 22:17:36 -05:00
Danny Kopping
26d129360f
Docs: adding documentation for retrieving available tables/columns via SQL(#6812)
Signed-off-by: Danny Kopping <danny.kopping@grafana.com>
2020-12-17 22:15:56 -05:00
Zach Wasserman
d2d904f59f
Allow table info PRAGMAs (#6814)
Set up an allowlist for PRAGMA commands in the authorizer. Allow the
PRAGMAs for listing table schema and available functions.
2020-12-17 22:13:24 -05:00
Rachel Cipkins
90e23398bd
systemd_units: Implement new table that tracks systemd units (#6593)
Co-authored-by: Alessandro Gario <alessandro.gario@gmail.com>
2020-12-16 07:52:16 -08:00
seph
6d0348ce29
CHANGELOG 4.6.0 (#6809)
CHANGELOG 4.6.0

Co-authored-by: Teddy Reed <teddy@casualhacking.io>
2020-12-14 23:26:58 -05:00
Zach Wasserman
c3f9a3dae2
Merge pull request from GHSA-4g56-2482-x7q8
* Proposed fix for attach tables vulnerability

* Add authorizer to ATC tables and cleanups

- Add unit test for authorizer function
2020-12-14 15:41:57 -05:00
Teddy Reed
dcfbd89885
cpack: Use CPACK_RPM_PACKAGE_RELEASE (#6805) 2020-12-13 22:22:55 -05:00
Stefano Bonicatti
2b0c4304c7
CMake: add max version limit to 3.18.0 on Linux (#6801)
Due to a bug present in CPack provided with CMake
version 3.18.0 and higher on RPM packages generation,
add a check which fails the configuration
if a version with the bug is found.
Provide a way to ignore the check by setting
OSQUERY_IGNORE_CMAKE_MAX_VERSION_CHECK=TRUE.
2020-12-13 10:04:29 -05:00
Alessandro Gario
32cc8ff54f
libs: Update sqlite to version 3.34.0 (#6804) 2020-12-12 18:40:09 -05:00
Mike Myers
d0e8fbcc18
Add indexed column support to Windows users table (#6782) 2020-12-11 22:01:39 -05:00
Alessandro Gario
8a3c856c76
file_events: Add configuration flag (#6663)
This allows Linux users to configure the process_file_events table
without enabling file_events by mistake.
2020-12-11 21:18:14 -05:00
Stefano Bonicatti
370908d49d
CI: Make the built packages available to be downloaded (#6772)
Also add TGZ as a supported package format on macOS,
since it's already used on the CI.
2020-12-11 21:17:02 -05:00
Stefano Bonicatti
89298dba49
Remove a Buck leftover (#6799) 2020-12-11 14:01:01 +01:00
Alessandro Gario
802bc06965
CI: Update brew scripts (#6794) 2020-12-08 18:15:58 +01:00
Stefano Bonicatti
c3b139d48a
CI: Python installation improvements on Windows (#6764)
Since the CI already selects the newest installation of Python,
to then install some additional packages, lets pass the root folder to CMake,
so it doesn't have to detect Python again and possibly select the wrong version.

Remove the need to use Python3 32bit, since it's not necessary
and the Windows installation used is a 64bit one anyway.

Fix pip complaining about the Scripts folder not being in the PATH,
by prepending the PATH with the selected Python installation
root folder and Scripts folder.

Split and reorder the various prerequisite install steps
so that they are closer to each other
and slightly better categorized.
2020-12-04 21:07:31 -05:00
Alessandro Gario
b04da26b9e
BPF: Fix the tests (#6783) 2020-12-04 18:06:07 +01:00
Alessandro Gario
719cb9b986
libs: Update bzip2 to version 1.0.8 (#6786) 2020-12-03 11:56:45 +01:00
Stefano Bonicatti
4dd97ea6a0
Update cmake_minum_required to 3.17.5 and pin version in CI (#6770) 2020-11-30 15:02:19 +01:00
Stefano Bonicatti
ec0d8f44ee
CMake: Remove unused LTCG flag (#6769) 2020-11-29 15:14:21 +01:00
Stefano Bonicatti
35417f589b
Remove boost workaround introduced in #5591 for string_view (#6771) 2020-11-29 15:13:03 +01:00
Alessandro Gario
6ab99467cd
libs: Update BPF libraries to support LLVM 11 (#6775) 2020-11-29 14:38:27 +01:00
Alessandro Gario
af41184a00
BPF: Fix wrong d_type compare in fs classes (#6774) 2020-11-29 14:38:14 +01:00
Alessandro Gario
4aaeb7a3dc
startup_info: Fix memory leak in the dbus classes (#6773) 2020-11-29 14:37:57 +01:00