Teddy Reed
a72fa19536
Use a noexcept method of directory checking for hash
2015-11-20 13:32:56 -08:00
Teddy Reed
aa4973a1b3
Merge pull request #1644 from stripe/andrew-add-timezone
...
Add timezone field to time table
2015-11-10 16:41:39 -08:00
Teddy Reed
daee71919a
Merge pull request #1642 from stripe/andrew-add-codesign
...
Add a `signature` table on Darwin
2015-11-10 16:23:16 -08:00
Andrew Dunham
0ae380297f
Add timezone field to time table
2015-11-10 15:17:49 -08:00
Andrew Dunham
dea93c8aa5
Add a signature table on Darwin
...
This table allows verifying the signature of files (or bundles) on
Darwin. It also provides the signing identifier that is a part of the
signature.
2015-11-10 13:21:18 -08:00
Teddy Reed
c441de27aa
Merge pull request #1643 from theopolis/fix_wifi_analysis
...
Fix missed nullptr checks in wifi
2015-11-10 12:56:45 -08:00
Teddy Reed
0a6d334f27
Fix missed nullptr checks in wifi
2015-11-10 01:01:12 -08:00
Teddy Reed
0d01a382b6
[ Fix #1634 ] Add sys/stat to filesystem
2015-11-09 01:33:17 -08:00
Teddy Reed
988daeb9e6
Merge pull request #1635 from theopolis/drop_gid
...
Add GID to PrivilegeDropper
2015-11-09 00:05:51 -08:00
Teddy Reed
4c2319f8dd
Add GID to PrivilegeDropper
2015-11-08 01:03:08 -08:00
Teddy Reed
18b1947e5b
Config/Schedule should not populate in extensions
2015-11-06 09:52:10 -08:00
Teddy Reed
41ba637030
Linux inotify should accept non-glob dirs
2015-11-04 13:46:47 -08:00
Teddy Reed
b29168a7b7
Use a null DB for the run test binary
2015-11-04 10:39:40 -08:00
Teddy Reed
57e8ef2ab3
[ #1546 ] Add computer_name to system_info and extend to Linux
2015-11-04 10:31:16 -08:00
Teddy Reed
2cf9e95fa1
Allow user-controlled FIFOs
2015-11-04 01:29:54 -08:00
Teddy Reed
084ccaf080
Use default blank value for startup_items Alias
2015-11-03 22:58:00 -08:00
Teddy Reed
7c70183a87
Merge pull request #1625 from theopolis/pack_delim
...
Add pack_delimiter option
2015-11-03 21:05:44 -08:00
Teddy Reed
cd4de8023f
Merge pull request #1630 from theopolis/fix_1626
...
[Fix #1626 ] Add schedule blacklist and protect DBHandle
2015-11-03 21:05:29 -08:00
Teddy Reed
edea3d6edd
[ Fix #1626 ] Add schedule blacklist and protect DBHandle
2015-11-03 20:50:22 -08:00
Teddy Reed
15c4673c5a
Add pack_delimiter option
2015-11-02 18:05:46 -08:00
Teddy Reed
7b270af6b2
Merge pull request #1623 from theopolis/simple_errors
...
Remove specific filenames from RocksDB IOErrors
2015-11-02 16:12:00 -08:00
Teddy Reed
5aa225d4c3
Merge pull request #1619 from sharvilshah/wifi
...
Implement wifi_networks tables for OS X
2015-11-02 16:11:21 -08:00
Teddy Reed
5728c93392
Remove specific filenames from RocksDB IOErrors
2015-11-02 15:12:52 -08:00
Teddy Reed
15215cdbc0
Add persistent splays
2015-11-02 14:10:04 -08:00
Teddy Reed
402490e75b
Attempt to improve DB/query performance
2015-11-02 10:57:01 -08:00
Teddy Reed
6aae4c9aa0
Fix tests and shell escape errors (faults)
2015-11-02 10:57:01 -08:00
Teddy Reed
425e5e5596
Change the watcher limits to default=loose
2015-11-02 10:57:01 -08:00
Teddy Reed
5233d7dcf8
Add start time to osquery_info, remove md5/path
2015-11-02 10:57:01 -08:00
Teddy Reed
19427b1854
Add database benchmarks
2015-11-02 10:57:01 -08:00
Teddy Reed
75bfcddc31
Merge pull request #1622 from theopolis/faster_sockets
...
Faster socket_events on Linux
2015-11-02 10:56:37 -08:00
Teddy Reed
a1a9131174
Optimize socket_events and Linux users
2015-11-02 10:37:56 -08:00
Teddy Reed
50550e607a
Build and provision edits for FreeBSD CI
2015-11-02 01:47:09 -08:00
Sharvil Shah
9a6d6d1293
Implement wifi_networks tables for OS X
...
If the option of remembering known Wi-Fi networks is enabled on a system,
they are persisted to disk as a preferences property list file.
This table is populated by parsing that file.
2015-11-01 16:53:51 -08:00
Teddy Reed
b97a2bcdb9
Merge pull request #1618 from theopolis/clang_addr_sanitize_3.7
...
Passing clang Address/Leak Sanitize version 3.7
2015-11-01 16:23:31 -08:00
Teddy Reed
6a07135648
Passing clang Address/Leak Sanitize version 3.7
2015-11-01 04:00:21 -08:00
Teddy Reed
d27a7ecc4c
Fix clang warnings, promote warnings to errors
2015-11-01 02:12:07 -08:00
Teddy Reed
97a6521445
Merge pull request #1614 from theopolis/drop_around_files
...
Expand the scope of permissions dropping
2015-10-30 17:07:04 -07:00
Teddy Reed
09e4e3c42e
Expand the scope of permissions dropping
2015-10-30 09:56:33 -07:00
Teddy Reed
4ac9317f64
Merge pull request #1613 from theopolis/fix_1611
...
[Fix #1611 ] Prevent fs links in inotify path search
2015-10-29 23:47:28 -07:00
Teddy Reed
2cf7543181
[ Fix #1611 ] Prevent fs links in inotify path search
2015-10-29 23:19:07 -07:00
Michael George
fb545bb85e
added sh_history
2015-10-29 10:53:04 -07:00
Teddy Reed
db58ec5e44
Only emit process events for 0-status execve
2015-10-27 17:12:23 -07:00
Teddy Reed
a3067fcbb5
Fix auditd message parsing
2015-10-27 16:56:42 -07:00
Teddy Reed
689ec53a71
Merge pull request #1603 from theopolis/inotify_mod_only
...
[#1600 ] Put inotify into a mod-only watch mode
2015-10-27 16:53:59 -07:00
Teddy Reed
ba4eeb6a80
[ #1600 ] Put inotify into a mod-only watch mode
2015-10-27 16:42:21 -07:00
Teddy Reed
8ca2925ef0
[ Fix #1583 ] Require osqueryd to have R/W access to RocksDB
2015-10-27 16:09:24 -07:00
Teddy Reed
811d578739
Merge pull request #1599 from theopolis/socket_events
...
Refactor a bit of config and add socket_events table to Linux
2015-10-27 15:30:15 -07:00
Teddy Reed
b81b6de6ae
This refactors a bit of config/packs and adds a socket_events table to Linux.
...
The refactor of config/packs was initiated because event subscribers needed
a method for toggling `::init` based on some configurable option. In the case
of auditd, turning on the support with `--disable_audit=false` used to start
auditing the EXECVE syscall. It was understandable that this would cause
latency based on the number of processes executing per measure of time.
A new `socket_events` table will do the same but for `bind` and `connect`. These
are less-obvious and for now, require a scan of /proc for socket tuples. In the
future this file descriptor to socket tuple will be faster.
2015-10-27 15:13:02 -07:00
Teddy Reed
b8087a1b26
Fix readFile TOCTOU error
2015-10-26 01:21:05 -07:00
Teddy Reed
654830cf11
Merge pull request #1594 from rcseacord/additional-sign-fixes
...
eliminated some warnings from Clang 3.7 analyze mode
2015-10-23 13:03:54 -03:00
