Zachary Wasserman
|
0b30b9f692
|
Add basic Mac startup items vtable
|
2014-11-04 11:40:54 -08:00 |
|
Alexander Polakov
|
274e037527
|
Blockdev table for linux
|
2014-11-03 23:39:14 +03:00 |
|
Akshay Dixit
|
6c418507e6
|
renamed lspci to pci_devices and specified it linux only
|
2014-11-02 21:09:04 -07:00 |
|
Akshay Dixit
|
afd9d5e160
|
changed lspci to be a linux only virtual table, and added udev dependency to provisions.sh
|
2014-11-02 21:07:35 -07:00 |
|
Akshay Dixit
|
7896e7f78e
|
added lspci virtual table and libudev dependencies
|
2014-11-02 21:03:43 -07:00 |
|
Alexander Polyakov
|
58716d6cfa
|
Mounts table for linux
|
2014-11-01 16:12:56 +03:00 |
|
Teddy Reed
|
eb240ac527
|
RPM table and more robust Linux building
|
2014-10-31 21:59:10 -07:00 |
|
castrapel
|
2557bac3d4
|
RPM Package listing is now working
|
2014-10-31 16:52:58 -07:00 |
|
Pablo S. Torralba
|
a6e04efdd7
|
Add quarantine vtable for OSX
The tables reports:
- path: The file in quarantine
- creator: The application that created the file
Example:
osquery> select * from quarantine limit 10;
+----------------------------------------------------------------------------+---------------+
| path | creator |
+----------------------------------------------------------------------------+---------------+
| /Applications/Adium.app | Google Chrome |
| /Applications/Adium.app/Contents | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature/CodeResources | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Adium | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Headers | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/PrivateHeaders | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Resources | Google Chrome |
+----------------------------------------------------------------------------+---------------+
Fixes issue #231
|
2014-10-31 06:10:51 -07:00 |
|
Teddy Reed
|
39f866387f
|
[vtables] CPUID asm call feature information
|
2014-10-29 03:09:34 -07:00 |
|
Teddy Reed
|
1f1b38976a
|
Merge pull request #261 from facebook/crontab
[vtables] Crontab parsing for system/users
|
2014-10-29 02:52:11 -07:00 |
|
Teddy Reed
|
6db0c67555
|
Merge pull request #269 from vmauge/suidbin
Add suid_bin vtable
|
2014-10-29 02:30:29 -07:00 |
|
Vincent Mauge
|
471d5faaa0
|
Add suid_bin vtable
The vtabel report :
- path: full path of the file
- unix_user: name of the owner (if not available display the uid)
- unix_group: name of the groupe (if not available display the gid)
- permissions: report suid or guid
* S for suid bin
* G for guid bin
Example :
osquery> select * from suid_bin;
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| path | unix_user | unix_group | permissions |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| "/bin/ps" | root | wheel | S |
| "/bin/rcp" | root | wheel | S |
| "/Users/vmauge/suid_test" | vmauge | 999 | SG |
| "/usr/bin/at" | root | wheel | S |
| "/usr/bin/atq" | root | wheel | S |
| "/usr/bin/atrm" | root | wheel | S |
| "/usr/bin/batch" | root | wheel | S |
| "/usr/bin/crontab" | root | wheel | S |
| "/usr/bin/ipcs" | root | wheel | S |
| "/usr/bin/lockfile" | root | mail | G |
| "/usr/bin/login" | root | wheel | S |
| "/usr/bin/newgrp" | root | wheel | S |
| "/usr/bin/procmail" | root | mail | G |
| "/usr/bin/quota" | root | wheel | S |
| "/usr/bin/rlogin" | root | wheel | S |
| "/usr/bin/rsh" | root | wheel | S |
| "/usr/bin/su" | root | wheel | S |
| "/usr/bin/sudo" | root | wheel | S |
| "/usr/bin/top" | root | wheel | S |
| "/usr/bin/wall" | root | tty | G |
| "/usr/bin/write" | root | tty | G |
| "/usr/sbin/postdrop" | root | _postdrop | G |
| "/usr/sbin/postqueue" | root | _postdrop | G |
| "/usr/sbin/rpc.net" | root | wheel | S |
| "/usr/sbin/rpcset" | root | wheel | S |
| "/usr/sbin/traceroute" | root | wheel | S |
| "/usr/sbin/traceroute6" | root | wheel | S |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
This commit fixes issue #253.
|
2014-10-29 01:33:58 -07:00 |
|
Teddy Reed
|
339b63677e
|
[vtables] Rename homebrew files, some cleanup
|
2014-10-29 00:34:55 -07:00 |
|
Martin Majlis
|
d645dfc257
|
Initial implementation for the homebrew table.
|
2014-10-28 21:03:56 -07:00 |
|
Martin Majlis
|
8b8ec7c644
|
Added initial implementation for crontab.
|
2014-10-28 17:52:03 -07:00 |
|
Javier Marcos
|
1066f667ab
|
Adding virtual table bash_history, for linux and darwin
|
2014-10-22 15:21:05 -07:00 |
|
Javier Marcos
|
06792db7f0
|
Adding support for last in linux
|
2014-10-13 18:19:08 -07:00 |
|
Javier Marcos
|
b518c6b9e0
|
Adding groups vtable and refactoring users
|
2014-10-10 15:09:14 -07:00 |
|
mike@arpaia.co
|
f45798d31a
|
OMG memory leaks
|
2014-10-09 18:08:31 -07:00 |
|
Javier Marcos
|
64ce35c949
|
Virtual table to be build in both linux and mac
|
2014-10-09 15:27:18 -07:00 |
|
Javier Marcos
|
7944ab50da
|
Adding vtable for users
|
2014-10-09 12:50:34 -07:00 |
|
Teddy Reed
|
69bfb92905
|
[events] Fleshing out OSX FSEvent framework
|
2014-10-02 21:30:14 -07:00 |
|
Teddy Reed
|
ed338e8356
|
[events] Events lifecycle complete, passwd_changes vtable
|
2014-09-26 12:58:32 -07:00 |
|
mike@arpaia.co
|
6beb5d1247
|
Moving table generation to CMake
CMake now handles building all of the generated code.
|
2014-09-23 17:55:54 -07:00 |
|
mike@arpaia.co
|
4218a4c2ab
|
cmake cleanups
|
2014-09-22 21:23:16 -07:00 |
|
mike@arpaia.co
|
9e2507409c
|
linking tests against libosquery
|
2014-09-22 19:54:59 -07:00 |
|
Mike Arpaia
|
db0f0105dd
|
Revert "Skip tests when making 'fast'"
|
2014-09-09 21:37:08 -07:00 |
|
Teddy Reed
|
2e150ef8a9
|
Skip tests when making 'fast'
|
2014-09-09 16:25:22 -07:00 |
|
Teddy Reed
|
825b50f932
|
[vtables] Routes table for Linux
|
2014-09-09 16:07:36 -07:00 |
|
Teddy Reed
|
bfba3d491d
|
Merge pull request #117 from facebook/linux-processes-vtable
[vtables] Processes table for Linux (procps3)
|
2014-09-09 14:43:26 -07:00 |
|
Mike Arpaia
|
d6699bd0fe
|
Adding header files to CMakeLists.txt so that other build tools can perform better introspection into the codebase.
|
2014-09-09 10:53:59 -07:00 |
|
Teddy Reed
|
c6a7e86b18
|
[vtables] Processes table for Linux (procps3)
|
2014-09-08 22:42:17 -07:00 |
|
mike@arpaia.co
|
c72d069689
|
vagrant and make deps on linux
|
2014-09-08 19:24:23 -07:00 |
|
Teddy Reed
|
7e470747b4
|
Moving sublibs to single libosquery
|
2014-09-08 01:58:29 -07:00 |
|
Teddy Reed
|
e23e7bdab8
|
Merge pull request #102 from facebook/linux-build
Changes for Linux (Ubuntu 14.04) build
|
2014-09-05 14:52:35 -07:00 |
|
Teddy Reed
|
4ffd184eaf
|
Changes for Linux (Ubuntu 14.04) build
|
2014-09-05 10:58:58 -07:00 |
|
Javier Marcos
|
344ca31f26
|
Adding last virtual table
|
2014-09-04 16:42:18 -07:00 |
|
mike@arpaia.co
|
63070a0d49
|
migrating project to use CMake's CTest to run unit tests
|
2014-09-02 11:14:21 -07:00 |
|
mike@arpaia.co
|
6498f45924
|
renaming the cacerts table to ca_certs
|
2014-09-01 18:46:16 -07:00 |
|
mike@arpaia.co
|
8649951fab
|
minimum possible linkages
|
2014-08-30 14:29:45 -07:00 |
|
mike@arpaia.co
|
f174c4dbd0
|
enabling unit tests for tables
|
2014-08-30 14:26:24 -07:00 |
|
mike@arpaia.co
|
2e5810ae9a
|
proper ordering in tables/CMakeLists.txt
|
2014-08-30 04:28:49 -07:00 |
|
mike@arpaia.co
|
b1f86466e0
|
alphabetizing the order of sources in the tables cmake file
|
2014-08-30 03:46:08 -07:00 |
|
mike@arpaia.co
|
5b904cca26
|
moving the table_sources blob down to just above where it's used
|
2014-08-30 03:43:02 -07:00 |
|
mike@arpaia.co
|
dd909ed39d
|
breaking out the implementation of os x specific virtual tables into their own cmake library
|
2014-08-30 03:24:35 -07:00 |
|
mike@arpaia.co
|
3b05ffb97d
|
breaking out objective-c tables such that they use arc
|
2014-08-30 03:19:16 -07:00 |
|
mike@arpaia.co
|
92845146d7
|
re-adding all of the virtual tables that depended on performant objective-c interop
|
2014-08-30 03:09:04 -07:00 |
|
mike@arpaia.co
|
0e806eff83
|
Proper ARC in Objective-C++ code
|
2014-08-30 00:22:26 -07:00 |
|
Teddy Reed
|
f461605b94
|
[vtable_interfaces] Add interface_{details, addresses} vtables
|
2014-08-21 18:49:15 -07:00 |
|