valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-08 10:23:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
1,941 Commits 2 Branches 109 Tags 25 MiB
d6389dc64d
Commit Graph

1095 Commits

Author SHA1 Message Date
Mitchell Grenier
637336f8c9 Ability to configure osquery from multiple files 2015-03-13 17:19:02 -07:00
Teddy Reed
aeaee645cd Merge pull request #848 from theopolis/extensions_autoload 
Extension-dependent config/logger plugins
 2015-03-13 12:22:35 -07:00
Teddy Reed
fe0f369af0 Extension-dependent config/logger plugins 2015-03-13 12:01:30 -07:00
Teddy Reed
660c6ec53f Merge pull request #839 from theopolis/addons_vtable 
[#787] Add chrome, firefox, and safari related tables
 2015-03-13 11:01:25 -07:00
Teddy Reed
e281e6a214 [#787] Add chrome, firefox, and safari related tables 2015-03-13 10:48:14 -07:00
Teddy Reed
116d93ef0c Merge pull request #837 from theopolis/rlog 
[Implement #593] Add a RLOG, TLOG helper macro
 2015-03-10 16:06:30 -07:00
Teddy Reed
33cbdd42ba Merge pull request #834 from theopolis/keychain_items 
Add keychain_items to include basic item details
 2015-03-10 16:06:17 -07:00
Teddy Reed
90b7f0a986 Merge pull request #836 from theopolis/active_plugins 
Move logger/config to use Registry getActive
 2015-03-10 16:04:40 -07:00
Teddy Reed
528bcab3c8 Merge pull request #838 from theopolis/plist_nogoto 
[For #579] Remove gotos from auto-release plist parsing
 2015-03-10 16:04:18 -07:00
Teddy Reed
6a81cec937 Organize kernel_extensions to add signatures 2015-03-09 11:43:06 -07:00
Teddy Reed
5cfff6ac57 [For #579] Remove gotos from auto-release plist parsing 2015-03-08 15:45:39 -07:00
Teddy Reed
4c4cba73c8 [Implement #593] Add a RLOG, TLOG helper macro 2015-03-08 15:20:36 -07:00
Teddy Reed
6e7f3dbbbd Move logger/config to use Registry getActive 2015-03-08 14:52:13 -07:00
Teddy Reed
995a16d83f Add keychain_items to include basic item details 2015-03-08 01:59:59 -08:00
Teddy Reed
4916392aa8 Merge pull request #812 from theopolis/keychain 
Add more keychain search paths for certificates
 2015-03-07 23:27:50 -08:00
Teddy Reed
9b30657dab Merge pull request #827 from theopolis/move_defines 
Move preprocessor defines before compile flags
 2015-03-06 12:23:08 -08:00
Theodore M. Reed
4803b441a2 Move preprocessor defines before compile flags 2015-03-06 12:11:21 -08:00
Don Husa
f6b5c5a2e3 Cleaned Up Time Table 2015-03-05 16:57:44 -08:00
Teddy Reed
d1b045d588 Add libosquery as a dependency for the testing utils 2015-03-05 09:26:22 -08:00
Teddy Reed
95a9716e02 Remove shell tools from daemon 2015-03-04 23:21:16 -08:00
Teddy Reed
0673900837 Registry modules 2015-03-04 20:33:10 -08:00
Teddy Reed
99beceaef6 Switch lazy=active concept for registry setup 2015-03-04 18:51:41 -08:00
Teddy Reed
8efa07e520 Watcher process will fail if DB path is incorrect 2015-03-04 18:51:41 -08:00
Teddy Reed
3c02806cd8 Extensions autoloading prequel 2015-03-04 18:51:41 -08:00
Mitchell Grenier
d5e8fe61d2 Removed the checks 2015-03-04 11:27:11 -08:00
Mitchell Grenier
93577f3ab2 Added filesystem .. test 
Supporting relative paths
 2015-03-03 16:18:37 -08:00
Teddy Reed
6ad580a5de Merge pull request #811 from theopolis/python_tests 
Organizing osquery python testing
 2015-03-02 22:16:20 -08:00
Mitchell Grenier
3d27fff697 Merge pull request #784 from jedi22/directory_monitoring 
Adding ability to monitor whole folders
 2015-03-02 17:21:24 -08:00
Mitchell Grenier
f50593f030 Less capitals 2015-03-02 17:01:05 -08:00
Mitchell Grenier
fc09924a59 clang format 2015-03-02 16:48:01 -08:00
Teddy Reed
41ab6f3161 Organizing osquery python testing 
Move /osquery/python_tests/* to /tools/tests
Move test_extensions process controls to test_base module
Use test_base.Testing to implement each module's main()
  - This applies a default argparse with --build
  - test_base.ARGS is the argparse-parsed namespace
  - Use test_base.ARGS.build for the platform-specific dir
Move WatchdogTests to /tools/tests/test_watchdog.py
 2015-03-02 16:23:22 -08:00
Teddy Reed
40e167d7b7 Merge pull request #810 from theopolis/respect_cflags 
Respect external CMake C/CXX flags
 2015-03-02 16:01:53 -08:00
Teddy Reed
a6bc9d6d97 Merge pull request #804 from theopolis/network_settings 
Add sysctl (system_controls) table
 2015-03-02 16:01:39 -08:00
Mitchell Grenier
0016bc4a8c Addressing theopolis changes 2015-03-02 15:46:42 -08:00
Mitchell Grenier
68ea487137 Addressing theopolis changes 2015-03-02 15:43:31 -08:00
Teddy Reed
e123f9f0a2 Add more keychain search paths for certificates 2015-03-01 21:15:42 -08:00
Teddy Reed
dcff476807 Respect external CMake C/CXX flags 
Use osquery-C flags for every object compile.
Add CXX flags without conditional logic.
Move the `python-thrift` target into the CPP generation command.
Remove verbose option for extensions python unittest.
Add thrift as a pip install requirement (for unittests).
 2015-03-01 21:19:31 -07:00
Mitchell Grenier
544615ef57 Bug fix for REC_LIST_FOLDERS 
Fixed a bug where when using REC_LIST_FOLDERS, the root resolution directory
would not be returned.
 2015-03-01 18:26:37 -08:00
Teddy Reed
be9218ecf1 Add sysctl (system_control) table 2015-03-01 18:51:33 -07:00
Mitchell Grenier
0031c6ed57 Fixed many bugs. inotify and fsevents should be same now 2015-02-27 17:28:51 -08:00
Teddy Reed
a3eade9bac Merge pull request #803 from zwass/python_testing 
Add Python integration testing to CTest.
 2015-02-27 17:16:29 -08:00
Zachary Wasserman
eb778fa361 Add Python integration testing to CTest. 
Here we create a new CMake macro for adding python integration tests,
as well as a wrapper for easy testing of osqueryi. There is a PoC test
of the time table.
 2015-02-27 10:10:26 -08:00
Teddy Reed
74ae25f727 Merge pull request #801 from theopolis/openssl_x509 
Rename ca_certs to certificates
 2015-02-26 23:59:49 -08:00
Teddy Reed
2237f00c12 Rename ca_certs to certificates 2015-02-26 23:47:05 -08:00
Mitchell Grenier
70c82b5a40 Linux inotify more closely resembles fsevents and is generally more awesome 2015-02-25 16:43:37 -08:00
Mitchell Grenier
6548006d3e Adding ability to monitor whole folders 2015-02-25 16:28:24 -08:00
Teddy Reed
9031bad609 Extensions helpers, API additions 
Use --socket for extensions, limit help
Add an 'active' concept to registries, support a blank item call
Add osquery_registry to list the internal/external plugin details
 2015-02-25 01:02:05 -07:00
Teddy Reed
c7e4094c53 Merge pull request #795 from theopolis/fix_788 
[Fix #788] Lookup ppids on OS X using CTL_KERN
 2015-02-24 13:52:40 -08:00
Teddy Reed
a70873c8ea [Fix #788] Lookup ppids on OS X using CTL_KERN 2015-02-24 13:31:30 -08:00
Mike Arpaia
260375cc21 Merge pull request #793 from theopolis/fix_regex 
[Fix #792] Replace std::regex with string parsing gcc below 4.9
 2015-02-24 13:28:11 -08:00
Mike Arpaia
503cf32522 Merge pull request #794 from marpaia/fix-785 
Adding warning text if the system is not configured
 2015-02-24 13:27:16 -08:00
mike@arpaia.co
5a5ec45bbb Adding warning text if the system is not configured 
See #785 for context. If you don't have a properly configured system,
osqueryd will print a convenient warning with instructions.
 2015-02-24 13:19:37 -08:00
Teddy Reed
148d7385f6 [Fix #792] Replace std::regex with string parsing gcc below 4.9 2015-02-24 13:19:27 -08:00
Teddy Reed
925deb8e74 [lints] Basic cpp linting 2015-02-24 03:47:12 -08:00
Teddy Reed
f173fb6e0a Working on sync using new non-macro decisions 2015-02-23 23:15:04 -08:00
Teddy Reed
ace433e49d Allow external calls from within registry 2015-02-23 21:35:54 -08:00
Teddy Reed
a29addba61 Extensions integrations testing 2015-02-22 22:56:18 -07:00
Teddy Reed
dd6283b6fe Merge pull request #779 from theopolis/events_strict 
Removed reinterpret plugin casts
 2015-02-19 17:56:59 -08:00
Teddy Reed
0f3adbbe24 Merge pull request #781 from theopolis/watcher_full_path 
Use full path for exec in watcher
 2015-02-19 17:02:46 -08:00
Teddy Reed
fa8dbf2b7f Use full path for exec in watcher 2015-02-19 16:00:12 -08:00
Teddy Reed
5334b9650a Merge pull request #775 from theopolis/sdk_build 
Building example extension with SDK
 2015-02-19 14:26:48 -08:00
Teddy Reed
247e57f2d6 Removed reinterpret plugin casts 2015-02-19 14:23:15 -08:00
Mitchell Grenier
182c69d4af Added ability to specify files to watch with wildcards 2015-02-19 12:43:23 -08:00
Teddy Reed
451ef686ed Building example extension with SDK 2015-02-18 20:11:00 -08:00
mike@arpaia.co
843fe3a302 syncing sdk with codemod and targets 2015-02-18 09:02:04 -08:00
Teddy Reed
8aefe1a110 Add thrift 'query' endpoint 
This allows extensions to execute SQL through the extensions API.
 2015-02-17 18:42:09 -08:00
Teddy Reed
16832ba72c Merge pull request #766 from theopolis/logs 
Improved logging control
 2015-02-17 16:37:50 -08:00
Teddy Reed
1f8dacec3c Add flag aliasing, logger/flag tests 2015-02-17 16:26:14 -08:00
Mitchell Grenier
dd01c67dcf Merge pull request #767 from jedi22/version_fix 
Added osquery version to .version because it makes sense
 2015-02-17 11:27:44 -08:00
Mitchell Grenier
e3a1c0638d Added osquery version to .version because it makes sense 2015-02-17 11:18:28 -08:00
Teddy Reed
fc64965c68 Fix ctor logger locking 2015-02-16 16:37:39 -08:00
Teddy Reed
6f155d63c5 Improve flag storage and printing 2015-02-16 16:26:06 -08:00
Teddy Reed
6994361f26 Improved logging control 2015-02-16 14:42:22 -08:00
Teddy Reed
3c36c4196b Merge pull request #731 from jedi22/wildcard_events 
Added parsing of extra data along with its addition to the osqueryconfig structure
 2015-02-15 19:16:54 -08:00
Teddy Reed
95dd2a808f Merge pull request #762 from theopolis/startup_items 
[Fix #758] Parse startup_items Alias data
 2015-02-15 16:33:39 -08:00
Teddy Reed
1ea06a9d15 [Fix #758] Parse startup_items Alias data 2015-02-13 17:40:02 -08:00
Mitchell Grenier
de5ac74fab All changes addressed 2015-02-13 16:52:11 -08:00
Teddy Reed
f162a20ee2 Merge pull request #759 from theopolis/fix_processes 
Fix getProcList indexing
 2015-02-13 14:58:39 -08:00
Teddy Reed
3246b346dc Fix getProcList indexing 2015-02-13 14:38:49 -08:00
Zachary Wasserman
1f450fb1ef Merge pull request #710 from zwass/distributed 
POC for client side of distributed queries.
 2015-02-13 14:25:52 -08:00
Zachary Wasserman
79034111a5 POC for client side of distributed queries. 
This introduces the notion of a DistributedQueryHandler that uses a "provider" to read/write requests and results to and from the master. The full flow is exercised via integration tests, and unit tests for each component.

It is intended to foster discussion around this client side interface, as well as provide a base to build from.
 2015-02-13 13:01:02 -08:00
Teddy Reed
aa078895d3 CentOS7 clang without fortify 
1. _FORTIFY_SOURCE=1 will cause readlink/recv to hang when using
heap-allocated target buffers.
2. Install boost/rocksdb/thrift using source, similar to CentOS6.5
3. Remove boost::regex, prefer extended std::regex without static
link to boost_regex.
 2015-02-13 12:47:30 -08:00
Mitchell Grenier
54ef2045e5 Made config a meyers singleton. Load should now only ever have to happen once 2015-02-13 12:32:54 -08:00
Teddy Reed
340dcd775a Add 'cwd', 'root' to processes 2015-02-12 18:05:10 -08:00
Teddy Reed
b7160aae72 Merge pull request #750 from theopolis/file_directory 
Allow file table to use a directory constraint
 2015-02-12 15:57:20 -08:00
Teddy Reed
584a326f63 Merge pull request #748 from theopolis/improve_processes 
[#721] Add pid constraint checking to darwin procs
 2015-02-12 15:57:15 -08:00
Teddy Reed
b7734dcd3e Allow file table to use a directory constraint 2015-02-12 15:44:39 -08:00
Teddy Reed
11323a1487 [#721] Add pid constraint checking to darwin procs 2015-02-12 11:32:29 -08:00
Javier Marcos
715f894c1c Fix for the CentOS 7 support 2015-02-11 22:07:25 -08:00
Mitchell Grenier
9dfcfc5725 Fast forwarded to current head 2015-02-11 19:47:30 -08:00
Mitchell Grenier
0448afbd91 Asynchronously resolve the wildcards of all the files we want to monitor 2015-02-11 19:35:57 -08:00
Mitchell Grenier
dca2f9d7bb Added parsing of extra data along with its addition to the osqueryconfig structure 
Added tests as well
 2015-02-11 19:35:57 -08:00
Teddy Reed
65e0da4790 Merge pull request #743 from theopolis/env_ele_apps 
Add environment/element to OS X apps
 2015-02-11 18:38:11 -08:00
Teddy Reed
2e0f99432f Add environment/element to OS X apps 2015-02-11 18:28:56 -08:00
Teddy Reed
7fbb7ef48e Add plist/file parsing similar to OS X defaults 2015-02-11 17:48:01 -08:00
Teddy Reed
5810a35cec Add a SQLiteDBManager 2015-02-11 15:27:45 -08:00
Teddy Reed
04fb33cbf2 Merge pull request #737 from theopolis/safe 
Safer compile flags
 2015-02-11 12:32:36 -08:00
Teddy Reed
7bab4a4706 Merge pull request #732 from theopolis/plist_defaults 
Added 'defaults' table called 'preferences'
 2015-02-11 12:03:23 -08:00
Teddy Reed
fd92f9cb4c Added 'defaults' table called 'preferences' 2015-02-11 11:39:25 -08:00
Teddy Reed
a59dcf01ee Add osquery_extensions table 2015-02-11 10:52:25 -08:00
Teddy Reed
2593e8f837 Add extensions status to osquery_info 2015-02-11 10:52:25 -08:00
Teddy Reed
9eeda1f02c Safer compile flags 2015-02-11 10:45:04 -08:00
Mitchell Grenier
4238eccdcd Adding test to make sure Apps table returns real data 2015-02-10 18:59:26 -08:00
Teddy Reed
74496c74d5 [Fix #733] Use directories instead of files in apps 2015-02-10 17:35:18 -08:00
Teddy Reed
7f7b2acd37 Merge pull request #728 from theopolis/pubs_as_runnables 
[Fix #704] Events sleep with dispatcher's interruptableSleep
 2015-02-10 13:06:16 -08:00
Teddy Reed
23864f220d [Fix #704] Events sleep with dispatcher's interruptableSleep 2015-02-10 12:51:26 -08:00
Teddy Reed
55dfdfcace Move lsperms into filesystem 2015-02-10 03:00:29 -07:00
Javier Marcos
9f5b819967 Adding description to columns 2015-02-09 20:13:11 -08:00
Javier Marcos
a3e004bb62 Adding description to columns 2015-02-09 18:18:22 -08:00
Teddy Reed
94f97b93e8 Fix symbol rename regression in processes 2015-02-09 14:04:39 -08:00
Teddy Reed
6cc9fa4c3e Merge pull request #720 from theopolis/memory_tables 
Add shared_memory, memory_maps, process_memory_map table to Linux
 2015-02-09 12:59:43 -08:00
Teddy Reed
4b07479c3d Merge pull request #719 from theopolis/file_stat 
Add stat details to file table
 2015-02-09 12:59:35 -08:00
Teddy Reed
d373aef0fa Merge pull request #716 from theopolis/fix_713 
[Fix #713] Do not abort if EM fails
 2015-02-09 12:59:28 -08:00
Teddy Reed
de868e6eb1 Merge pull request #715 from theopolis/more_descriptions 
Add more table descriptions for API generation
 2015-02-09 12:59:22 -08:00
Teddy Reed
4615019dd0 Merge pull request #711 from theopolis/harden_worker 
Harden watcher for more perf, use exec and watch from worker
 2015-02-09 12:59:14 -08:00
Teddy Reed
d2b18c05c9 Add watcher profiles 2015-02-09 12:38:50 -08:00
Teddy Reed
ca95e7c59a Add process_memory_map and remove path,name from process_envs 2015-02-09 01:37:59 -07:00
Teddy Reed
edc93fb81b Add Linux memory map table 2015-02-09 00:47:40 -07:00
Teddy Reed
653b3a19e5 Add shared_memory table to Linux 2015-02-08 21:32:30 -07:00
Teddy Reed
ff0da3dd19 Add stat details to file table 2015-02-08 20:41:31 -07:00
Teddy Reed
3548e7ea63 [Fix #713] Do not abort if EM fails 2015-02-08 19:05:36 -07:00
Teddy Reed
1252fa2663 Add more table descriptions for API generation 2015-02-08 18:40:35 -07:00
Teddy Reed
19998a001a Harden watcher for more perf, use exec and watch from worker 2015-02-08 00:06:44 -07:00
Javier Marcos
2383fb1f77 Merge pull request #712 from facebook/description_tables 
Addind all the missing descriptions for tables
 2015-02-06 19:23:08 -08:00
Javier Marcos
8bc0087bbc Addind all the missing descriptions for tables 2015-02-06 19:05:50 -08:00
Teddy Reed
c0be6faede Merge pull request #702 from theopolis/sdk_step2 
Adding thrift extension API
 2015-02-06 17:51:20 -08:00
Mitchell Grenier
4cf0fc859c Merge pull request #709 from jedi22/test_open_sockets 
Fixed open sockets on OS X
 2015-02-06 14:49:43 -08:00
Mitchell Grenier
898c0933e6 Fixed open sockets on OS X 
Minimal fix
 2015-02-06 14:41:38 -08:00
Teddy Reed
771887c27a Fix GTest/siginfo redefine by libthrift 2015-02-06 09:40:50 -08:00
Teddy Reed
7597e823c5 Fixing build RC, TestRunnable tests 2015-02-06 09:40:49 -08:00
Teddy Reed
993e2c4577 Changes to flags, extensions now loaded with shell/daemon 2015-02-06 09:40:49 -08:00
Teddy Reed
4f10a35f80 Adding thrift extension API 2015-02-06 09:40:49 -08:00
Mike Arpaia
88e211d686 Merge pull request #707 from theopolis/table_docs 
Adding table spec documentation
 2015-02-05 14:42:42 -08:00
Mitchell Grenier
f9d310a6c4 Adding in the tests for recursive filesystems resolutions 2015-02-05 11:04:02 -08:00
Mitchell Grenier
159b2add89 Merge pull request #689 from jedi22/letter_wild 
First iteration to support letter wilds in file paths
 2015-02-05 10:42:50 -08:00
Mitchell Grenier
bb855f4551 Adding last wildcarding component 2015-02-05 10:34:42 -08:00
Teddy Reed
eb55c9e83a Adding table spec documentation 2015-02-04 22:47:02 -07:00
Teddy Reed
ed9bae29b7 Organizing headers/build for SDK 2015-02-03 14:59:32 -08:00
Mike Arpaia
38369bb30f Update daemon.cpp 2015-02-03 14:27:17 -08:00
Mitchell Grenier
50eaccc40b Merge pull request #653 from jedi22/osx-xattr 
OS X Where From
 2015-02-03 11:55:35 -08:00
Mitchell Grenier
30e268b22b Can query for where a file came from using the OS X eXtended attributes 2015-02-03 11:34:29 -08:00
Zachary Wasserman
ac53637bcf Add getQueryColumns function to core 
This new getQueryColumns function allows us to determine what columns
will be returned by executing a given query. It is intended to be used
with the distributed query system, to determine a schema for the
results before sending the query.

Tested by unit tests. Also used valgrind and did not find errors that
looked related to this change (though there appear to be many errors
related to glog logging).
 2015-02-02 10:11:00 -08:00
Teddy Reed
b0a91e1058 Fixing threading assumptions for FSEvents runloop 2015-02-01 05:12:28 -07:00
Teddy Reed
e37b16ce2f Clang analyze fixups for Linux 2015-02-01 05:10:57 -07:00
Teddy Reed
5072b40997 Fix missing virtual destructors for event APIs 2015-02-01 04:32:18 -07:00
Teddy Reed
e4b369917b Unref udev monitor during events tearDown 2015-02-01 03:00:09 -07:00
Teddy Reed
f96b498ae3 Remove EventFactory::deregister... in favor of ::end 2015-02-01 02:20:09 -07:00
Teddy Reed
bd620853aa Verbose log when table row is missing a column 2015-02-01 02:20:09 -07:00
Teddy Reed
d39f1fae95 Minor registry documentation, using macros for create/add 2015-02-01 02:20:09 -07:00
Teddy Reed
ab1cb942a8 Fix typo in passwd subscriber, merge vtable tests 2015-02-01 02:20:09 -07:00
Teddy Reed
ab08bc76a8 Towards a new registry 2015-02-01 02:20:09 -07:00
Teddy Reed
ba3931cc1f Faster fstests using tmp structures 2015-02-01 02:11:46 -07:00
Teddy Reed
c4fb5d45ed Added make analyze (clang-analyze) and fixed output 2015-01-31 03:09:30 -08:00
Teddy Reed
38a757c7f0 Merge pull request #673 from theopolis/fork 
Adding a watcher/worker model for osqueryd
 2015-01-30 19:09:55 -08:00
Javier Marcos
c0398e2cef Different packages for different ubuntus 2015-01-30 14:55:28 -08:00
Zachary Wasserman
d840fb8896 Merge pull request #685 from zwass/status_enhancements 
Add useful operator implementations to Status
 2015-01-30 10:03:41 -08:00
Zachary Wasserman
5a2296b91b Add useful operator implementations to Status 2015-01-29 17:33:41 -08:00
Mitchell Grenier
dcfaeda4ca Merge pull request #674 from jedi22/filesystem_wild 
Adding recursive directory traversal functionality
 2015-01-29 17:28:35 -08:00
Mitchell Grenier
0ab10f9982 Added the ability to search through directories using wildcards 2015-01-29 17:18:39 -08:00
schettino72
f7357dd4b8 add column info to CREATE VIRTUAL TABLE statement. 2015-01-30 01:08:36 +08:00
schettino72
3a8df753e2 Add unit-test for TablePlugin::statement(). 2015-01-30 01:08:36 +08:00
Mitchell Grenier
0e7bf914a3 Removed 2 lines of code that didn't look like they were doing anything 2015-01-27 17:27:01 -08:00
Teddy Reed
a95c6f2b8b Merge pull request #679 from theopolis/force 
[FIx #676] Add --force option to osqueryd
 2015-01-27 16:11:12 -08:00
Teddy Reed
a9ede83446 [FIx #676] Add --force option to osqueryd 2015-01-27 16:00:39 -08:00
Mitchell Grenier
299bef0452 Fixing the last strcpy 2015-01-27 14:06:12 -08:00
Teddy Reed
74d38fa354 Merge pull request #675 from facebook/marpaia-patch-1 
Update init osquery to not overwrite the logging plugin
 2015-01-26 16:54:27 -08:00
Mike Arpaia
db24472539 Update init osquery to not overwrite the logging plugin 2015-01-26 10:44:27 -08:00
Teddy Reed
8fd56417fd Adding a watcher/worker model for osqueryd 2015-01-26 01:22:50 -07:00
Teddy Reed
72fcd44bf1 Fallback to /proc/net/ for open sockets in Linux 2015-01-25 18:44:10 -07:00
Teddy Reed
59b757c5d5 Adding block_devices to OSX 2015-01-23 13:47:20 -08:00
Teddy Reed
b3fa936156 Add kernel_info to OSX 2015-01-23 13:47:20 -08:00
Teddy Reed
22273b403d Adding kernel_info to Linux 2015-01-23 13:47:20 -08:00
mike@arpaia.co
b4a2ca1afa moving config and plist to prefixed directory 2015-01-22 11:07:19 -08:00
Teddy Reed
ee44764098 Add libglog to OBJCXX targets 2015-01-21 23:43:50 -07:00
Teddy Reed
22a91e2bb2 All libraries depend on the external project(s) 2015-01-21 21:35:16 -07:00
Teddy Reed
d912009569 Add unit testing to hashing 2015-01-21 16:24:40 -08:00
Teddy Reed
9c1faec090 Isolate glog include and depend on libglog for #652 2015-01-21 13:37:06 -08:00
Mike Arpaia
248f8b90e6 Merge pull request #657 from facebook/marpaia-patch-1 
static lock in config.cpp
 2015-01-21 13:33:35 -08:00
Mike Arpaia
8e677caaef Update config.cpp 2015-01-21 13:08:17 -08:00
mike@arpaia.co
10d5aabd36 config-check command in osqueryd 
This addresses #585
 2015-01-21 12:59:39 -08:00
Mike Arpaia
778789d74e Merge pull request #648 from marpaia/hash-docs 
hash.h documentation
 2015-01-20 16:04:32 -08:00
mike@arpaia.co
ba2e465472 migrating smbios to use new hash api 2015-01-20 15:54:00 -08:00
mike@arpaia.co
ecfe29282b hash.h documentation 
I added some doxygen docs for hash.h
 2015-01-20 15:36:53 -08:00
Teddy Reed
7e58691df0 Merge pull request #637 from theopolis/osx_smbios 
OSX/Linux SMBIOS tables
 2015-01-20 15:28:55 -08:00
Teddy Reed
b7549e09ca SMBIOS parsing on Linux using mem 2015-01-20 15:10:19 -08:00
mike@arpaia.co
b6eed30688 removing md5.h 2015-01-20 15:07:50 -08:00
Teddy Reed
6b6649bbd4 Adding mem to Linux filesystem lib 2015-01-20 15:06:34 -08:00
Teddy Reed
b7852650c2 SMBIOS structure tables for OSX 2015-01-20 15:06:34 -08:00
Teddy Reed
7b0f7f3c49 Rename ACPI length to size 2015-01-20 15:06:34 -08:00
Teddy Reed
64d82388e4 Update the md5 hashing callsites 2015-01-20 14:52:07 -08:00
Teddy Reed
11237d2397 Merge pull request #644 from theopolis/md5_macros 
Use API macro for hash algorithms
 2015-01-20 14:33:55 -08:00
Teddy Reed
a2d9236478 Use API macro for hash algorithms 2015-01-20 14:24:49 -08:00
Mike Arpaia
4937e5cd2e Merge pull request #641 from theopolis/iokit_registry 
Separate IOKit devicetree from registry
 2015-01-20 13:31:24 -08:00
Zachary Wasserman
ee798cdde7 Use sizeof with memcpy and memset 
I'd like to make sure we use expressions of sizeof to relate buffer
sizes to memcpy and memset. This should make modifying the code less
error prone.

Conflicts:
	osquery/tables/system/darwin/nvram.cpp
 2015-01-20 12:36:36 -08:00
Mitchell Grenier
053fcc28ef More minor changes to address marpias requests 2015-01-20 12:13:10 -08:00
Mitchell Grenier
b8b1837bd6 Replaced loop with auto iterator, eliminating need to dereference 2015-01-20 12:13:10 -08:00
Mitchell Grenier
d2fe1826ae Minor code change and clang-format 2015-01-20 12:13:10 -08:00
Mitchell Grenier
34e6bd45c3 Addressed @marpia s changes 2015-01-20 12:13:10 -08:00
Mitchell Grenier
b9c477080f NFS Table for darwin systems. 
Currently table readonly field is a string, this may change in the future to an
integer to stay consistent with other parts of osquery.
 2015-01-20 12:13:09 -08:00
Teddy Reed
416198732a Merge pull request #631 from jedi22/sha-hashs 
Added SHA1 and SHA256 in Hash Table
 2015-01-20 11:24:43 -08:00
Teddy Reed
716aa41c15 Separate IOKit devicetree from registry 2015-01-20 11:15:20 -08:00
Mitchell Grenier
8f407a1e8f Moving commits around for efficientcy 2015-01-20 10:49:58 -08:00
Teddy Reed
5f8eccb3f3 Remove gotos from linux routes 2015-01-19 18:06:34 -08:00
Teddy Reed
8475522e76 Remove goto/sprintf from NVRAM parsing 2015-01-19 17:10:40 -08:00
Teddy Reed
066b7d78d9 Add basic acpi_tables hashing to Linux 2015-01-17 23:02:14 -08:00
Teddy Reed
09ce5099b2 Merge pull request #632 from theopolis/osx_boot_info 
OSX IOKit registry and ACPI table data
 2015-01-17 17:56:51 -08:00
Teddy Reed
545a6b0930 Merge pull request #629 from marpaia/cmdline-whitespace-fix 
Fix for #628
 2015-01-17 17:51:06 -08:00
Mitchell Grenier
c1a1013e5a Minor code changes and namespacing 2015-01-16 12:03:23 -08:00
Teddy Reed
ba716712cf [Fix #630] Clear stacking index plans 2015-01-16 06:47:32 -08:00
Teddy Reed
1df958c583 ACPI tables for OSX 2015-01-15 21:37:02 -08:00
Mitchell Grenier
e6e722dd17 Modifed config.cpp to not use the old MD5 implementation 2015-01-15 17:40:42 -08:00
Mitchell Grenier
570c6a32f3 Moved hashing functions into core. #include<osquery/hash.h> 2015-01-15 17:16:05 -08:00
Mitchell Grenier
c13a0e79a5 Most hashing stuff working though rerun bug is still plaguing the queries 2015-01-15 15:06:30 -08:00
Teddy Reed
803204a9dd iokit_registry table 2015-01-15 12:53:46 -08:00
mike@arpaia.co
aef517a29e Fix for #628 2015-01-15 12:11:25 -08:00
Teddy Reed
663e481d9e [Fix #620] Add query plan estimates bias toward constraints 2015-01-13 21:17:15 -08:00
Teddy Reed
367709429e Treat IOKit HID failures as warnings 2015-01-13 17:25:11 -08:00
Teddy Reed
4db7c90758 Merge pull request #608 from theopolis/linux_ports 
Moved socket_inode on Linux to process_open_files
 2015-01-13 14:54:35 -08:00
Teddy Reed
a709a34220 Merge pull request #605 from theopolis/fix_599 
[Fix #599] Rename kextstat->kernel_extensions
 2015-01-13 14:53:32 -08:00
Teddy Reed
ac0f2f96e4 Split OSX process_open_files into files/sockets 2015-01-13 11:05:54 -08:00
Teddy Reed
f0eec6fbe3 Adding listening_ports to Linux 2015-01-13 09:51:40 -08:00
Teddy Reed
bb6f313c6c Moved socket_inode on Linux to process_open_files 2015-01-13 08:26:47 -08:00
Teddy Reed
376a438516 Moving splay to scheduler and adding config logging 2015-01-12 12:53:05 -08:00
Teddy Reed
84ef94ce9d Testing for table query constraints 2015-01-12 12:52:29 -08:00
Teddy Reed
465db46628 Fix shouldFire pubsub virtual 2015-01-11 19:51:54 -08:00
Teddy Reed
6deeba39c9 Merged Linux/OSX interfaces implementation 2015-01-11 01:39:16 -07:00
Teddy Reed
6dfc5d88f4 Added interfaces to Linux 2015-01-11 00:42:23 -07:00
Teddy Reed
a2cc1c85ea [Fix #599] Rename kextstat->kernel_extensions 2015-01-11 00:38:03 -07:00
Teddy Reed
c5cbf992ad Remove installed unwind headers 2015-01-10 20:38:31 -07:00
mike@arpaia.co
a0a404acc1 removing the dependency on unwind 
Moving glog to third-party so that we can custom compile it so that
we no longer have the dependency on libunwind. #578
 2015-01-10 13:02:30 -07:00
Teddy Reed
18d93d8cbc Building DEB/RPM package dependencies 2015-01-09 12:24:54 -08:00
Teddy Reed
a4e236e16a Simpler OSX package building 2015-01-07 20:01:33 -08:00
Teddy Reed
45ee10f162 More complete make package 2015-01-07 16:07:19 -08:00
Teddy Reed
2ad15763e2 Provide example config, improve pid check 2015-01-07 15:22:50 -08:00
Teddy Reed
dbb7050376 Merge pull request #575 from theopolis/fix_574 
[Fix #574] Undef DEBUG for apt-pkg for make debug
 2015-01-06 07:29:02 -08:00
Teddy Reed
27541d4260 [Fix #574] Undef DEBUG for apt-pkg for make debug 2015-01-06 06:53:42 -08:00
Teddy Reed
f865647d0c [Fix #545] Simpler socket_info parsing in process_open_files 2015-01-06 06:23:48 -08:00
Teddy Reed
df3029e880 [Fix #559] Detach event publisher threads when ending 2015-01-05 19:07:08 -08:00
Norm MacLennan
7a6eb8255a renaming apt sources gen function 2015-01-05 18:02:55 -05:00
Norm MacLennan
38447838db merging upstream cmake changes 2015-01-05 17:43:07 -05:00
Teddy Reed
a4e5e58ec0 Merge pull request #572 from theopolis/auto_dependency 
Use CMake find_library for dependencies
 2015-01-05 08:59:03 -08:00
Teddy Reed
d2cea32644 Use CMake find_library for dependencies 2015-01-05 08:32:05 -08:00
Teddy Reed
80276471c5 Add --daemonize option to osqueryd 2015-01-04 19:27:04 -08:00
Norm MacLennan
a6b769b6f4 a table to show apt package sources 2015-01-04 19:44:45 -05:00
Teddy Reed
86cce395ab [Fix #553] Move config JSON parsing into try 2015-01-03 23:12:28 -08:00
Teddy Reed
2cef8d6f9f Merge pull request #564 from maclennann/deb_packages 
deb_packages table
 2015-01-02 11:15:56 -08:00
Norm MacLennan
cf08d605f0 code review changes and adding revision field 2015-01-02 13:30:04 -05:00
Teddy Reed
9b0adcc47f [Fix #560] Improve config tests 2015-01-01 22:05:03 -08:00
Norm MacLennan
18f40b0952 fixing compatibility issues with 1204 dpkg version 2015-01-01 18:58:00 -05:00
Norm MacLennan
dd4a9d9d74 merging cmake changes for distro-specific tables 2014-12-31 13:06:54 -05:00
Teddy Reed
ed00c95dca Support centos/ubuntu-specific tables 2014-12-31 09:38:18 -08:00
Teddy Reed
914ae37a72 Move CMakeLibs and valgrind supp file 2014-12-31 08:32:23 -08:00
Norm MacLennan
beff9471f8 resolve merge conflict with upstream 2014-12-30 18:21:00 -05:00
Norm MacLennan
0191f1de29 resurrect the deb_packages table 2014-12-30 17:24:49 -05:00
Sean Williams
c54a568af3 Merge pull request #528 from facebook/linux-camb 
Initial linux kernel instrumentation bits
 2014-12-29 14:20:54 -08:00
Teddy Reed
2bf86ebda9 Merge pull request #562 from theopolis/plugins_refactor 
Plugins Refactor: Towards external plugins
 2014-12-29 13:37:03 -08:00
Teddy Reed
d7653c77e7 Support 'make libosquery' for a wrappable so/dylib 2014-12-27 23:14:34 -08:00
Teddy Reed
7d260d3c05 Cleanup cmake files 2014-12-27 22:55:08 -08:00
Teddy Reed
8c6e45e9b5 Fix ca_certs memory leak 2014-12-25 12:49:45 -08:00
Teddy Reed
94811f3ee8 Removed 'core' tables as a build dependency 2014-12-25 12:46:59 -08:00
Teddy Reed
e4b60e883a Variable amalgamation output filename 2014-12-23 21:53:59 -07:00
Theodore M. Reed
b2be1fa383 Whole link tests and refactor flags_test 2014-12-23 20:38:16 -08:00
Teddy Reed
b2dca55539 Build leaner libosquery, allow control over spec/impl 2014-12-23 20:07:12 -08:00
Theodore M. Reed
01005c72b3 Moved crontab out of utility 2014-12-23 14:39:59 -08:00
Theodore M. Reed
53d683a3b3 Remove tables dependency from CMake build 2014-12-23 14:37:07 -08:00
Theodore M. Reed
7b0640e4eb Move table link dependencies into tables CMakeLists 2014-12-23 14:37:00 -08:00
Bryan Eastes
93cb303abc Merge branch 'master' of github.com:facebook/osquery into 520_pt_json_workaround 2014-12-20 18:24:33 -08:00
Bryan Eastes
5ad8d3ec55 Changes from CR 2014-12-20 18:19:33 -08:00
Sean Williams
9bb8efb9d9 Explicitly move out of osquery proper 2014-12-18 16:45:32 -08:00
Teddy Reed
ff7ca1e800 Merge pull request #557 from theopolis/xprotect_results 
OSX results of XProtect hits
 2014-12-18 13:04:08 -08:00
mike@arpaia.co
b9f732c31f Updating the license comment to be the correct open source header 
As per t5494224, all of the license headers in osquery needed to be updated
to reflect the correct open source header style.
 2014-12-18 10:52:55 -08:00
Teddy Reed
6a6851c4bc Merge pull request #544 from theopolis/events_2.0 
Events 2.0
 2014-12-17 20:17:02 -08:00
Teddy Reed
888f74de36 OSX results of XProtect hits 2014-12-17 18:35:01 -08:00
Teddy Reed
4453806dce Remove raw pattern from XProtect 2014-12-17 14:46:53 -08:00
Teddy Reed
7602d17de9 Move base64Decode from ca_certs testing to conversions 2014-12-17 14:03:52 -08:00
Teddy Reed
fefe6de824 OSX XProtect siganture DB as virtual table 2014-12-16 21:35:26 -08:00
Teddy Reed
8c38492b2a Add XProtect vtable to OSX 2014-12-16 17:59:07 -08:00
Teddy Reed
30a27798d5 osqueryd should announce to syslog when starting 2014-12-16 12:04:43 -08:00
Sean Williams
a236e9cf89 Add copyright header 2014-12-16 19:39:16 +00:00
Teddy Reed
d5c5253bbc Add osquery_flags vtable 2014-12-16 02:07:50 -08:00
Teddy Reed
b5535256e6 [Fix #546] Rename md5 to config_md5 and add config_path to osquery_info 2014-12-16 01:52:02 -08:00
Teddy Reed
b442ef0fd3 Merge pull request #548 from theopolis/support_any_brew_openssl 
Use static openssl libs to support thrift 0.9.x
 2014-12-16 01:23:25 -08:00
Teddy Reed
4425bed23e Merge pull request #504 from Anubisss/master 
Adding a table which maps services from /etc/services.
 2014-12-16 01:23:05 -08:00
Teddy Reed
5bd8d9ac37 Use static openssl libs to support thrift 0.9.x 2014-12-16 01:15:58 -08:00
Teddy Reed
dd2eaf248a Fixing Linux syntax errors and tests for Events 2.0 2014-12-15 16:47:09 -08:00
Teddy Reed
6de14466db Events 2.0 using pbr 2014-12-15 11:55:05 -08:00
Teddy Reed
fcdf49d17f WIP migrating Linux Events 2014-12-15 00:43:28 -08:00
Teddy Reed
17efa0b3d6 Migrate subscribers on OSX 2014-12-15 00:25:28 -08:00
Teddy Reed
fbd56663d9 Migrate fsevents to events 2.0 2014-12-14 22:17:38 -08:00
Teddy Reed
d927495209 Support casted subscribes 2014-12-14 21:20:20 -08:00
Teddy Reed
c1e37b73fb Non-static event type and name IDs 2014-12-14 18:03:41 -08:00
Teddy Reed
d2a93cf8c1 Remove EventSubscriber macros 2014-12-14 17:05:07 -07:00
anuka
fa95ff09d8 Some fix for etc_services. 
Signed-off-by: anuka <david.vas1@gmail.com>
 2014-12-14 22:14:00 +01:00
Teddy Reed
0d00e4b0e9 Remove EventPublisher macros 2014-12-14 04:43:31 -07:00
anuka
375c837b74 Merge remote-tracking branch 'upstream/master' 2014-12-13 15:27:09 +01:00
Teddy Reed
00c88a19bc Add timeout to netlink socket read 2014-12-12 17:50:47 -08:00
Sean Williams
4faa10eba0 Move non-external API header files back to src dir 2014-12-12 14:45:29 -08:00
Teddy Reed
cd20ed6b77 Prevent IOKitHID value subscriptions 2014-12-11 18:19:05 -08:00
Teddy Reed
acccfa94e2 IOKit HID events and OSX hardware_events table 2014-12-11 18:06:08 -08:00
Teddy Reed
7b56fa605d PCI/USB parity 2014-12-10 19:51:18 -08:00