Commit Graph

3112 Commits

Author SHA1 Message Date
Zachary Wasserman
63dbb76018 Add wiki build to make docs and verify in CI (#2279) 2016-07-27 15:25:17 -07:00
nerddotcat
e015c132f6 Added memory_info table for Linux (#2282) 2016-07-27 15:20:07 -07:00
Nick Anderson
5463a7d15c Adding CLI compile script for windows (#2295) 2016-07-25 21:51:37 -07:00
Nick Anderson
df9a33e0ec Rearranged virtual tables for Windows (#2291) 2016-07-25 17:15:19 -07:00
yying
6eb3cc4f9a Refactored timer functionality in osquery shell (#2290) 2016-07-25 15:35:34 -07:00
Teddy Reed
c99a1e15a0 Refactor system into POSIX and add CPUID to Windows (#2288) 2016-07-25 15:34:17 -07:00
Teddy Reed
14230d7bfa Port utilities/file to Windows (#2286) 2016-07-25 15:13:41 -07:00
Teddy Reed
42dbbd92ba Print UTC for blank timezones in utilities/time (#2287) 2016-07-25 14:46:14 -07:00
yying
0ef284b8e7 Changes to make osqueryd/osqueryi mostly build sans cputime/uptime tables (#2283) 2016-07-25 11:58:55 -07:00
Zachary Wasserman
b71276a1ea Fix up doxygen docs and require correct docs in CI (#2280)
This change causes Doxygen to error if there are unrecognized commands, or
undocumented/incorrect parameters in documented functions. It does not require
that every function be fully documented, just that those that are do not have
errors.

Old documentation with problems was fixed to comply.
2016-07-25 12:21:26 -04:00
Nick Anderson
10719e5cff Fixed 'off the end' bug in crashes table (#2285) 2016-07-23 11:06:56 -07:00
yying
2fb3797c53 Changes to support building a osquery Windows service. (#2278) 2016-07-22 13:29:37 -07:00
Teddy Reed
870c5bd9f9 Clean up verbose logging for OS X kernel extension (#2276) 2016-07-21 14:29:17 -07:00
Teddy Reed
c22f6147ea Move OSQUERY_HOME into core and use as filesystem config default (#2275) 2016-07-21 13:28:23 -07:00
Teddy Reed
6fc0ddb31d Add watcher column to osquery_info (#2261) 2016-07-21 13:07:24 -07:00
Zachary Wasserman
a7aac29465 Clarify events and database flags in osqueryi docs (#2269) 2016-07-21 12:53:17 -07:00
Zachary Wasserman
0483bed29d Fix broken links to FIM wiki page (#2272) 2016-07-21 12:33:46 -07:00
Teddy Reed
6df4c8c4d4 The watcher process should apply memory limits to itself (#2263) 2016-07-21 12:33:14 -07:00
Nick Anderson
673f39e86f fixed provision script path in make-win64-dev-env (#2271) 2016-07-21 11:15:49 -07:00
yying
547e8f961c CMake configuration file changes to support Windows (#2258) 2016-07-20 23:48:55 -07:00
Teddy Reed
1e4dcb121b Introduce --audit_allow_sockets for Linux socket_events (#2270) 2016-07-20 23:47:54 -07:00
Zachary Wasserman
f1f00cec2b Enable DB in osqueryi when --database_path specified (#2268)
Prior to this change, both --disable_database=false and --database_path had to
be specified together. Now, if the user specifies --database_path the database
is enabled automatically.
2016-07-20 17:44:50 -07:00
Teddy Reed
172363d3f5 Fix debug-kernel build and deploy dependencies (#2266) 2016-07-20 17:21:20 -07:00
Teddy Reed
edc3fa5a25 Remove process_file_events subscriber from Linux (#2267) 2016-07-20 17:20:23 -07:00
amironenko
575314bf61 Ubuntu + Debian build fixes (#2247) (#2248) 2016-07-20 17:02:40 -07:00
Teddy Reed
5be180a8f9 Swap removed and added for logs (#2260) 2016-07-20 12:25:10 -07:00
Teddy Reed
394bce27d5 Fix mismatched free/delete in QueryContext dtor (#2259) 2016-07-19 19:27:48 -07:00
Nick Anderson
00935e28cc Moved windows provisioning script (#2257) 2016-07-19 16:47:51 -07:00
nerddotcat
ebf3ae378d added ssh_keys table for id_rsa files. (#2245) 2016-07-19 09:21:01 -07:00
Tony
c1d004ed1f Better fault-tolerant defaults for systemd service (#2255) 2016-07-17 18:56:00 -07:00
Teddy Reed
b9a5313123 Update third-party for Win10 building and add .patch to gitignore (#2250) 2016-07-15 10:55:28 -07:00
artemdinaburg
78e1cf7ab4 Transition __attribute__((constructor)) to a more platform independent approach (#2233) 2016-07-14 14:19:33 -07:00
Zachary Wasserman
8161a5f0a8 Add autocompletion of table names in osqueryi (#2236) 2016-07-14 14:15:32 -07:00
Nick Anderson
8d97d06b89 Crashes table now grabs all register values (#2243) 2016-07-13 11:29:07 -07:00
Marcin Wielgoszewski
805e24928d Log execution of a distributed query (#2241) 2016-07-12 19:22:06 -07:00
Teddy Reed
45530c0496 Slight performance improvments (#2242) 2016-07-12 19:16:50 -07:00
DaanDeMeyer
0544b50530 Cleaned up arch provisioning (#2239) 2016-07-12 11:51:35 -07:00
Teddy Reed
7f304a0934 Various fixups and best practices (#2237) 2016-07-11 09:45:57 -07:00
Zachary Wasserman
b5c129f324 Fix process path parsing (#2234)
This commit fixes two issues with `path` in the linux processes table:

(1) Fixes a bug in which `on_disk` is set to `NULL` instead of `0` when the
binary is not on disk.

(2) Fixes a bug in which a filename ending in ` (deleted)` could cause osquery
to return an incorrect value for `on_disk`. See
https://github.com/facebook/osquery/issues/1607
2016-07-08 12:06:56 -07:00
Peter
51f5fa9095 [#2216] Add notice text for required table predicates (#2225) 2016-07-08 08:33:37 -07:00
Teddy Reed
54557b16e7 [Fix #2196] Fix osquery home directory checking (#2232) 2016-07-07 17:33:52 -07:00
Teddy Reed
48cb4d555d Add systemLog API (#2229)
This includes a minor SDK refactor as it move quite a few specialized
functions and facilities from core.h into system.h. There was a breaking point
for needing to frequently update core includes.

The new logger systemLog function allows a call site to bypass logging config
and write a line to the OS logger (aka syslog).
2016-07-07 15:16:28 -07:00
Michael George
f0108ac901 update osx_attacks with Backdoor.MAC.Eleanor with fixes (#2226) 2016-07-07 15:14:27 -07:00
Javier Marcos
43dd75eb59 Adding folder signature for iWorm OSX malware (#2231) 2016-07-07 15:14:01 -07:00
Teddy Reed
6852122af9 Force RocksDB to sync writes for non-event domains (#2228)
RocksDB is the default "database" plugin. Writes are normally kept in an
in-memory memtable. Writes that are not part of the event pubsub system can
be forced to sync to disk.
2016-07-07 14:08:12 -07:00
Chris Long
1e9aa1a49c Adding Aobo Keylogger and OSX_Keydnap to osx-attacks (#2230) 2016-07-07 14:04:05 -07:00
Ryan Holeman
88053a08b4 Optional top level decorator functionality (#2177) 2016-07-06 15:31:59 -07:00
Tony
aa714d4c77 Add ability to provision Arch Linux (#2215) 2016-07-06 15:02:58 -07:00
Zachary Wasserman
8909602a40 Increase block period in flaky BufferedForwarder test (#2222)
This test was intermittently failing because it relies on the actual thread
scheduling. Our discussion in issue #2218 decided that it was worth keeping the
test around, while trying to mitigate the flakiness. The longer sleeps in this
test ran successfully hundreds of times in local testing.
2016-07-06 14:59:24 -07:00
Teddy Reed
21d1fca37d Add shutdown method to extensions (#2224)
This alters the osquery.thrift spec to add a ::shutdown method to the
Extension class. The ExtensionManager inherits from this but includes a
no-op shutdown method.

When an ExtensionManager (osquery core) stops, it optionally requests all
Extensions to shutdown immediately. This helps quit extensions processes
faster.
2016-07-06 12:23:24 -07:00