Teddy Reed
02841f5e7f
Add kernel userland-API inet_diag header
2014-11-14 01:42:34 -08:00
Teddy Reed
565bce3c07
Fix unwind exception catching
2014-11-14 01:42:00 -08:00
Teddy Reed
0c675b23f2
Fix testing (only requireInstance) for DBHandle once
2014-11-13 09:33:13 -08:00
Vincent Mauge
632151d56a
Set ouput_bit to 0 instead of cast error
2014-11-12 22:02:04 -08:00
Teddy Reed
153cc7208f
More control over logging
2014-11-12 18:19:22 -07:00
Teddy Reed
aa933491d2
Merge pull request #416 from theopolis/hack_fix_386
...
[Fix #386 ] This is a hack to fix Ubuntu unwinding
2014-11-12 16:43:18 -08:00
Teddy Reed
b419c79791
[ Fix #386 ] This is a hack to fix Ubuntu unwinding
2014-11-12 17:12:37 -07:00
mike@arpaia.co
a8832482b3
implementation for #360
2014-11-12 16:51:14 -05:00
mike@arpaia.co
b423286297
failing test
2014-11-12 16:30:18 -05:00
Teddy Reed
0d8b9d3eaa
Use SQLite types
2014-11-12 11:07:24 -08:00
Teddy Reed
525a3b79a0
Tons of new build features
...
* The OS/DISTRO are available as defines when writing tables:
UBUNTU, UBUNTU_14_04, UBUNTU_12_04
CENTOS, CENTOS_6_6
DARWIN, DARWIN_10_10, DARWIN_10_9
* The table generation tooling now grabs virtual tables templates
from ./osquery/tables/templates/<name>.cpp.in.
* The table generation tooling will detect reserved column names.
* suid_bin uses the new UBUNTU to restrict calls to root (fix #362 ).
2014-11-12 00:57:47 -08:00
Teddy Reed
8e408f987e
Table spec documentation examples
2014-11-11 11:26:11 -08:00
mike@arpaia.co
88bec43d8a
removing superfluous nullptr checks. close #404
2014-11-11 11:17:28 -05:00
Bryan Eastes
ec081c9a54
Added --host_identifier option
...
Conflicts:
osquery/core/system.cpp
2014-11-10 16:41:13 -05:00
Teddy Reed
8b1af689db
Blacklist is now on by default
2014-11-10 13:30:38 -08:00
Teddy Reed
050e942d11
Support USE_BLACKLIST=1 to remove tables from release
2014-11-10 13:30:38 -08:00
Abe Stanway
811d98c595
free(linkname) and no more 'self'
2014-11-10 15:02:31 -05:00
Abe Stanway
30149a70f9
Updated
2014-11-10 15:02:31 -05:00
Abe Stanway
322fde0121
Socket_inode and port_inode tables to map PIDs->ports via netlink inet_diag
...
Example query:
```
SELECT port.local_port,
port.remote_port,
port.local_ip,
port.remote_ip,
socket.pid,
process.name,
process.cmdline
process.path
FROM socket_inode AS socket
JOIN port_inode AS port
ON socket.inode = port.inode
INNER JOIN processes AS process
ON socket.pid = process.pid;
```
2014-11-10 15:02:31 -05:00
Teddy Reed
86d2ac208b
Use leaks for OSX memory leak profiling
2014-11-10 11:34:17 -08:00
Mike Arpaia
3245e5a6cd
Merge pull request #394 from wizzat/process_args
...
Add cmdline to darwin
2014-11-10 13:20:47 -05:00
Teddy Reed
19aa99583e
Linux processes vtable use freeproc
2014-11-10 10:12:47 -08:00
Mark Roberts
dc1684fca7
Add cmdline to darwin
2014-11-10 09:36:17 -08:00
mike@arpaia.co
bd4d1dfc0f
Removing superfluous logging from DBHandle. close #387
2014-11-10 12:15:35 -05:00
Teddy Reed
bc05f5de78
Merge pull request #383 from theopolis/fix_rpm_packages
...
[Fix #367 ] Check RPMTAG class before cast
2014-11-10 01:59:13 -08:00
Teddy Reed
b0ff403d3d
Fixing librpm API usage leaks
2014-11-10 01:48:07 -08:00
Teddy Reed
b2e806e453
Merge pull request #384 from ga2arch/stringstream
...
read the file directly into a stringstream buffer
2014-11-09 13:30:22 -08:00
Gabriele Carrettoni
77b521ce7b
read the file directly into a stringstream buffer
2014-11-09 16:57:35 +01:00
Teddy Reed
b77406b122
[ Fix #367 ] Check RPMTAG class before cast
2014-11-09 02:07:49 -08:00
Teddy Reed
84cc45a366
SQLite DBfile not needed
2014-11-09 01:01:17 -08:00
Teddy Reed
f7667ec440
Remove Threads requirement, cleanup flags
2014-11-09 00:00:57 -08:00
Teddy Reed
078d4cf7d2
Refector shell flags/versioning
2014-11-08 20:27:28 -08:00
Teddy Reed
62d6472cfe
Rethinking some build improvements
2014-11-08 19:28:35 -08:00
Gabriele Carrettoni
848bd4d96e
use unique_ptr instead of raw pointer
2014-11-09 02:23:19 +01:00
Veres Lajos
afc82c722f
typo fixes - https://github.com/vlajos/misspell_fixer
2014-11-07 22:18:02 +00:00
Alexander Polyakov
00dbf282a6
/ is not always readable
2014-11-07 01:00:58 +03:00
Alexander Polyakov
78af7dd885
Catch exception in pathExists
...
boost::filesystem::exists() throws
2014-11-07 00:20:22 +03:00
Alexander Polyakov
c0d827f534
Add euid / egid to process table
...
(not tested on darwin)
2014-11-06 01:35:52 +03:00
mike@arpaia.co
05cfff81c8
clang-format
2014-11-04 11:42:30 -08:00
mike@arpaia.co
896a4f2957
generic users function and some general cleanups
2014-11-04 11:40:54 -08:00
Zachary Wasserman
0b30b9f692
Add basic Mac startup items vtable
2014-11-04 11:40:54 -08:00
Alexander Polyakov
a60230af5e
linux/processes: fix infinite loop, throw away workaround
2014-11-04 15:31:35 +03:00
Teddy Reed
03034780f1
Add note about blocking process_env as non-su
2014-11-03 23:46:47 -08:00
Teddy Reed
ea3880eefb
Merge pull request #354 from wizzat/graceful_envs
...
Graceful envs
2014-11-03 23:43:04 -08:00
Teddy Reed
2f6369ad99
Fix boost filesystem path for inotify
2014-11-03 23:37:45 -08:00
Mike Arpaia
37734bc5a4
Merge pull request #351 from LTD-Beget/blockdev_table
...
Blockdev table for linux
2014-11-03 22:29:35 -08:00
Mark Roberts
5780fffa22
Potential Linux fix, pending boost::filesystem::path fix on master. Issue #323
2014-11-03 20:39:51 -08:00
Alexander Polyakov
cbc2139047
block_devices: trim spaces around model and vendor
2014-11-04 05:00:24 +03:00
Teddy Reed
dc77df602e
[format] Cleanup various PRs not run through clang-format
2014-11-03 17:57:01 -08:00
Mark Roberts
176af65fb5
Remove logging of permissions error when running as non-root user on OSX
...
Issue #323
2014-11-03 17:29:22 -08:00
Mike Arpaia
01944a3bb7
Merge pull request #352 from LTD-Beget/pci_devices_crash
...
pci_devices: udev_device_get_property_values() can return NULL
2014-11-03 15:17:03 -08:00
Alexander Polyakov
95aeaba024
pci_devices: unref things after use
2014-11-04 01:48:42 +03:00
mike@arpaia.co
92381f2009
unbreaking master
2014-11-03 14:28:34 -08:00
Alexander Polyakov
1ce1424d01
Add braces
2014-11-04 01:21:02 +03:00
Alexander Polyakov
e3364ac34c
Add braces
2014-11-04 01:13:49 +03:00
Mike Arpaia
a9e636af9f
Merge pull request #349 from facebook/329
...
Ensuring that listening_ports results are unique
2014-11-03 14:08:04 -08:00
Mike Arpaia
3fd0645c07
Merge pull request #350 from zwass/filesystem_path
...
Refactor osquery::fileystem to use boost::filesystem::path rather than std::string
2014-11-03 14:00:19 -08:00
Alexander Polyakov
f96180e926
pci_devices: udev_device_get_property_values() can return NULL
2014-11-03 23:56:59 +03:00
Alexander Polakov
274e037527
Blockdev table for linux
2014-11-03 23:39:14 +03:00
mike@arpaia.co
dfc206035c
using std::find instead of manual iteration
2014-11-03 12:14:14 -08:00
Zachary Wasserman
c559f0e1d2
Refactor osquery::fileystem to use boost::filesystem::path rather than std::string
2014-11-03 12:08:46 -08:00
mike@arpaia.co
75ded8b881
Ensuring that listening_ports results are unique
2014-11-03 12:03:57 -08:00
Zachary Wasserman
07c8671ede
Use relative path from argv[0]
2014-11-03 11:24:38 -08:00
Zachary Wasserman
e658aa5b65
Add test for plist with binary
2014-11-03 11:24:38 -08:00
Zachary Wasserman
66ceec0de3
Fix Plist parsing of binary blobs
2014-11-03 11:24:38 -08:00
Akshay Dixit
c99c08c607
changed comments to // from /* , char* to std::string consts, and ran clang-format on the file
2014-11-02 21:09:04 -07:00
Akshay Dixit
cb1bf1c305
cleaned up pci_devices.cpp
2014-11-02 21:09:04 -07:00
Akshay Dixit
6c418507e6
renamed lspci to pci_devices and specified it linux only
2014-11-02 21:09:04 -07:00
Akshay Dixit
afd9d5e160
changed lspci to be a linux only virtual table, and added udev dependency to provisions.sh
2014-11-02 21:07:35 -07:00
Akshay Dixit
7896e7f78e
added lspci virtual table and libudev dependencies
2014-11-02 21:03:43 -07:00
Teddy Reed
1abbe7478a
Merge pull request #332 from vmauge/depends_gentable
...
Add dependency to gentable.py
2014-11-02 17:50:07 -08:00
Vincent Mauge
b18dcaa7cb
Add dependency to gentable.py
...
With this commit, a change to gentable.py will trigger
the regeneration of cpp code for each table.
2014-11-02 17:00:47 -08:00
Teddy Reed
24b7be320c
Fix #328 , add gflags defines for shell-internal flags
2014-11-02 15:40:35 -08:00
Teddy Reed
37b8336a1f
Silence parentheses warnings in linux/mounts
2014-11-02 01:42:04 -08:00
Teddy Reed
287bbc06a8
Merge pull request #316 from LTD-Beget/mounts
...
Mounts table for linux
2014-11-02 01:37:00 -08:00
Larz Conwell
a0d7533c96
Closes #319 , Install libraries and headers.
2014-11-02 00:08:11 -04:00
Alexander Polyakov apolyakov@beget.ru
fd5ed3bc19
Rename dir to path
2014-11-02 01:09:24 +03:00
Alexander Polyakov apolyakov@beget.ru
fa81e54e27
Fix indentation, no functional change
2014-11-02 00:36:56 +03:00
Alexander Polyakov
58716d6cfa
Mounts table for linux
2014-11-01 16:12:56 +03:00
Teddy Reed
eb240ac527
RPM table and more robust Linux building
2014-10-31 21:59:10 -07:00
castrapel
2557bac3d4
RPM Package listing is now working
2014-10-31 16:52:58 -07:00
castrapel
a51f97871f
Adding RPM functionality for CentOS packages (Not working in EL6 due to older rpm-devel)
2014-10-31 16:52:58 -07:00
Teddy Reed
fd8f5782ab
Merge pull request #308 from facebook/lsof
...
Darwin lsof
2014-10-31 16:32:30 -07:00
Mark Roberts
675dc308b9
Fix possible errors with getProcPath and getProcName
2014-10-31 16:07:09 -07:00
Mike Arpaia
fba9d1143b
Merge pull request #310 from facebook/quarantine
...
Add quarantine vtable for OSX
2014-10-31 15:35:47 -07:00
Pablo S. Torralba
42c73897bf
Some minor stetic changes to keep the code clean
2014-10-31 14:27:15 -07:00
Mark Roberts
534999b396
Whitespace
2014-10-31 13:49:25 -07:00
Pablo S. Torralba
366274504b
Feedback fixes to clean the code a bit
2014-10-31 13:44:00 -07:00
Mark Roberts
f38bcd390e
Add file_type to process_open_files
2014-10-31 11:13:35 -07:00
Teddy Reed
0604b3a5e0
Fix 301, pragma cols pretty print
2014-10-31 10:19:49 -07:00
Pablo S. Torralba
a6e04efdd7
Add quarantine vtable for OSX
...
The tables reports:
- path: The file in quarantine
- creator: The application that created the file
Example:
osquery> select * from quarantine limit 10;
+----------------------------------------------------------------------------+---------------+
| path | creator |
+----------------------------------------------------------------------------+---------------+
| /Applications/Adium.app | Google Chrome |
| /Applications/Adium.app/Contents | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature/CodeResources | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Adium | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Headers | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/PrivateHeaders | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Resources | Google Chrome |
+----------------------------------------------------------------------------+---------------+
Fixes issue #231
2014-10-31 06:10:51 -07:00
Mark Roberts
3cf5aa4bae
Add lsof for #28 functionality to Darwin, refactor to use shared infra for process_envs
2014-10-31 03:28:14 -07:00
Teddy Reed
bcca0824b0
Fix memset/memcpy for pretty print in osqueryi
2014-10-30 18:07:32 -07:00
Teddy Reed
1554bf3295
Fix #290 , add permissions to osqueryd logging
2014-10-30 15:03:05 -07:00
yetanotherhacker
8cee7e0b3c
Spelling fixes in comments and output.
2014-10-30 04:27:00 -04:00
Teddy Reed
4ed61ff868
Merge pull request #288 from vmauge/NewLongType
...
Add new long type and migrate some vtables
2014-10-29 23:12:52 -07:00
Vincent Mauge
07bd114107
Change users table to used new long long int type for uid and gid
...
It is now possible to do a proper order on uid or gid, ie:
SELECT * FROM users ORDER BY uid;
2014-10-29 18:57:12 -07:00
Vincent Mauge
755d8c198e
Change groups table to used new long long int type for gid
...
It is now possible to do a proper order on gid, ie:
SELECT * FROM groups ORDER BY gid;
2014-10-29 18:57:00 -07:00
Mike Arpaia
0f037d4082
Merge pull request #283 from facebook/fix_sockaddr_inc
...
Fix #277 , add socket.h to interfaces on darwin
2014-10-29 17:41:36 -07:00
Teddy Reed
cd74544208
Fix #277 , add socket.h to interfaces on darwin
2014-10-29 16:44:17 -07:00
Scott Robinson
e57bfac5fb
Fix a small typo.
2014-10-30 08:25:25 +11:00
Mark Roberts
3b90184da3
Fix clang format error
2014-10-29 10:43:32 -07:00
Mark Roberts
0867c2b547
Add process_envs table for OSX and Linux for issue #99
2014-10-29 03:45:26 -07:00
Teddy Reed
39f866387f
[vtables] CPUID asm call feature information
2014-10-29 03:09:34 -07:00
Teddy Reed
1f1b38976a
Merge pull request #261 from facebook/crontab
...
[vtables] Crontab parsing for system/users
2014-10-29 02:52:11 -07:00
Teddy Reed
6db0c67555
Merge pull request #269 from vmauge/suidbin
...
Add suid_bin vtable
2014-10-29 02:30:29 -07:00
Teddy Reed
8a9374d6e3
[vtables] Support linux crontab vars
2014-10-29 02:24:00 -07:00
Teddy Reed
94c64d80ce
Merge pull request #267 from facebook/kernel_modules
...
[vtables] Linux kernel modules from procfs
2014-10-29 02:03:46 -07:00
Vincent Mauge
471d5faaa0
Add suid_bin vtable
...
The vtabel report :
- path: full path of the file
- unix_user: name of the owner (if not available display the uid)
- unix_group: name of the groupe (if not available display the gid)
- permissions: report suid or guid
* S for suid bin
* G for guid bin
Example :
osquery> select * from suid_bin;
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| path | unix_user | unix_group | permissions |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| "/bin/ps" | root | wheel | S |
| "/bin/rcp" | root | wheel | S |
| "/Users/vmauge/suid_test" | vmauge | 999 | SG |
| "/usr/bin/at" | root | wheel | S |
| "/usr/bin/atq" | root | wheel | S |
| "/usr/bin/atrm" | root | wheel | S |
| "/usr/bin/batch" | root | wheel | S |
| "/usr/bin/crontab" | root | wheel | S |
| "/usr/bin/ipcs" | root | wheel | S |
| "/usr/bin/lockfile" | root | mail | G |
| "/usr/bin/login" | root | wheel | S |
| "/usr/bin/newgrp" | root | wheel | S |
| "/usr/bin/procmail" | root | mail | G |
| "/usr/bin/quota" | root | wheel | S |
| "/usr/bin/rlogin" | root | wheel | S |
| "/usr/bin/rsh" | root | wheel | S |
| "/usr/bin/su" | root | wheel | S |
| "/usr/bin/sudo" | root | wheel | S |
| "/usr/bin/top" | root | wheel | S |
| "/usr/bin/wall" | root | tty | G |
| "/usr/bin/write" | root | tty | G |
| "/usr/sbin/postdrop" | root | _postdrop | G |
| "/usr/sbin/postqueue" | root | _postdrop | G |
| "/usr/sbin/rpc.net" | root | wheel | S |
| "/usr/sbin/rpcset" | root | wheel | S |
| "/usr/sbin/traceroute" | root | wheel | S |
| "/usr/sbin/traceroute6" | root | wheel | S |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
This commit fixes issue #253 .
2014-10-29 01:33:58 -07:00
Teddy Reed
339b63677e
[vtables] Rename homebrew files, some cleanup
2014-10-29 00:34:55 -07:00
Teddy Reed
c1991e94e5
[vtables] Add user crons and use files
2014-10-29 00:28:19 -07:00
Martin Majlis
d645dfc257
Initial implementation for the homebrew table.
2014-10-28 21:03:56 -07:00
Teddy Reed
9abcbcd485
[vtables] Linux kernel modules from procfs
2014-10-28 21:01:51 -07:00
Martin Majlis
e8eb1e222f
Reformating the code with clang-formatter.
2014-10-28 19:43:13 -07:00
Martin Majlis
8b8ec7c644
Added initial implementation for crontab.
2014-10-28 17:52:03 -07:00
Teddy Reed
47d1f13966
Using Cpp03 to remove double right angle brackets
2014-10-27 17:56:55 -07:00
Teddy Reed
6e60612520
Using clang-format 3.5
2014-10-27 17:37:36 -07:00
Mike Arpaia
0f57dba4d9
Merge pull request #228 from facebook/bash_history_table
...
Adding virtual table bash_history, for linux and darwin
2014-10-27 16:41:17 -04:00
mike@arpaia.co
dafd2d7534
updating comment
2014-10-27 16:34:00 -04:00
Teddy Reed
0a1925200e
Clean flags usage in daemon/shell and dbhandle
2014-10-27 12:09:35 -07:00
Teddy Reed
6d50d762ce
Changing flag infra, reducing config testing, adding debug macro
2014-10-27 10:30:02 -07:00
Teddy Reed
16c1fa68ba
Merge pull request #246 from facebook/db_handle_problems
...
Fix permissions on DB handle
2014-10-27 10:27:07 -07:00
Teddy Reed
991cbdfb00
Fix permissions on DB handle
2014-10-27 10:05:08 -07:00
Mike Arpaia
a5f7dc1aa3
Merge pull request #247 from facebook/time-types
...
time types
2014-10-27 12:47:52 -04:00
mike@arpaia.co
2ba54f5211
time types
2014-10-27 09:13:21 -04:00
Teddy Reed
53afc6b8b2
Merge pull request #240 from facebook/event_logs
...
Change log formatting to individual events
2014-10-26 14:53:58 -07:00
Teddy Reed
67dce20974
Log event results as a flat map
2014-10-26 10:18:26 -07:00
Teddy Reed
2346fa00d5
Merge pull request #243 from facebook/fix_100p
...
[events] Fix SCNetwork runloop thrashing
2014-10-25 16:41:57 -07:00
Teddy Reed
9d6efc83b8
[events] Fix SCNetwork runloop thrashing
2014-10-25 07:01:57 -07:00
Javier Marcos
c8c3363455
Changed logic to ignore when history file is not found (expected)
2014-10-24 20:38:09 -07:00
Javier Marcos
542d53fd5e
Refactoring and added column for history file, also more history files supported
2014-10-24 20:29:23 -07:00
Teddy Reed
84e8718d62
Merge pull request #238 from facebook/unify_routes
...
[vtable] Unify routes table for OSX/Linux
2014-10-24 17:08:16 -07:00
Teddy Reed
a82792b3f7
Log results as events
2014-10-24 17:05:17 -07:00
Teddy Reed
3d7c8b5684
[vtable] Unify routes table for OSX/Linux
2014-10-24 12:34:18 -07:00
Teddy Reed
35aeb1e87d
Merge pull request #237 from facebook/dual_build
...
Build into platform-specific build dirs
2014-10-24 09:24:11 -07:00
Javier Marcos
bf3cd15c91
Final fix for the allocation problem
2014-10-23 17:17:50 -07:00
Teddy Reed
1598892ab1
Fix Ubuntu build issues (proc/bz2/z)
2014-10-23 16:27:43 -07:00
Teddy Reed
5b2510784e
Build into platform-specific build dirs
2014-10-23 14:39:15 -07:00
Javier Marcos
f69913938f
Bad memory leak with OpenDirectory and pwd/grp.h code
2014-10-22 23:49:16 -07:00
Javier Marcos
1066f667ab
Adding virtual table bash_history, for linux and darwin
2014-10-22 15:21:05 -07:00
Teddy Reed
21a0fd1aec
Merge pull request #207 from facebook/scnetwork_publisher
...
[events] OSX SCNetwork Publisher
2014-10-16 16:27:35 -07:00
Javier Marcos
bf1ffb1537
Removing old code for generating virtual tables
2014-10-13 21:58:26 -07:00
Javier Marcos
c2f4453749
Merge pull request #213 from facebook/last_access_linux
...
Adding support for last vtable in linux
2014-10-13 19:07:59 -07:00
Javier Marcos
06792db7f0
Adding support for last in linux
2014-10-13 18:19:08 -07:00
mike@arpaia.co
ce5d53e169
fixing the shell text [skip ci]
2014-10-13 17:23:20 -07:00
Javier Marcos
b3208bab70
Errors handled, shit is on fire
2014-10-10 16:09:45 -07:00
Javier Marcos
b518c6b9e0
Adding groups vtable and refactoring users
2014-10-10 15:09:14 -07:00
mike@arpaia.co
ae91f7af7e
only index if it's not nullptr
2014-10-09 22:08:37 -07:00
mike@arpaia.co
0033e9bd02
cleaning up some memory leak supps
2014-10-09 22:06:55 -07:00
Javier Marcos
19a2d64959
Making sure we do not add duplicated users
2014-10-09 18:55:25 -07:00