Commit Graph

5746 Commits

Author SHA1 Message Date
Stefano Bonicatti
e14be45801
CMake: Add Valgrind support (#6834)
Add OSQUERY_ENABLE_VALGRIND_SUPPORT so that it's possible
to run osquery under Valgrind.
This is specifically required by the boost library
that needs to be compiled with a special define
and it also requires the valgrind.h header.

Also move the defines for the ASAN usage to the boost
library CMakeLists.txt instead of being in flags.cmake.
This way we reduce the unnecessary recompilation of code that
doesn't depend on boost, when switching options.
2020-12-22 09:04:51 -05:00
Teddy Reed
99b9857d92
Use make jobserver for OpenSSL on Linux and macOS (#6821) 2020-12-21 21:48:49 -05:00
Stefano Bonicatti
ccbb2529cc
CMake: Do not compile Windows libraries with debug symbols (#6833)
When possible try to avoid generating debug symbols
for third party libraries, when compiling in Debug or
RelWithDebInfo mode, like for POSIX platforms.

This might not always possible because there's no way
to explicitly disable symbol generation on Windows,
but this should be an improvement.
2020-12-21 21:46:38 -05:00
Stefano Bonicatti
8eda456bc0
CMake: Fix amalgamated tables generation on change (#6832)
The list of spec files, dependency of the amalgamated table generation,
was incorrectly specified.
When a list is used in a DEPENDS argument, all the components of
the argument should be a list.
Using double quotes breaks that.
2020-12-21 21:40:47 -05:00
Jason Meller
6e9f8720ae
Add new table location_services for darwin (#6826) 2020-12-21 10:37:31 -08:00
Stefano Bonicatti
9a3cccb5bd
CMake: Refactor and rename fuzzers build flag (#6829)
The flag to build the fuzzers is now OSQUERY_BUILD_FUZZERS
and it is independent from OSQUERY_BUILD_TESTS.

Now it's possible to build with the address sanitizer
but without any feature required by the fuzzers.

The fuzzers and the sanitizer flags are presented only on Linux.
2020-12-21 09:23:44 -05:00
Jason Meller
867bbef8ae
Add filevault_status to disk_encryption table (#6823) 2020-12-20 16:08:26 -05:00
Jason Meller
752f76946b
Place office_mru table spec in correct folder (#6827) 2020-12-20 16:04:26 -05:00
Stefano Bonicatti
1e3e4bc653
Update openssl to version 1.1.1i (#6820) 2020-12-19 19:00:26 -05:00
Stefano Bonicatti
90c981a0e9
Explicitly set the MSVC runtime library (#6818)
CMake doesn't add the /MD flag in the CMAKE_<LANG>_FLAGS_<CONFIG>
anymore, to be then replaced with /MT by us.
Without it, the build still defaults to using /MD, which is wrong.
2020-12-19 18:59:45 -05:00
Stefano Bonicatti
83b7e0468d
CI: Remove incorrect 2to3 symlink breaking Python brew upgrade (#6819)
Even if the macOS image have Python homebrew already installed,
there's the symlink /usr/local/bin/2to3 which points to the
system installed Python.
Normally that file is placed by homebrew Python,
but since it's not, upgrading the homebrew Python version
makes it soft fail because it cannot overwrite such symlink.
Later the CMake step fails to detect the correct Python version on the
system and the CI fails.

Since we are not interested in the Python 2 to 3 conversion,
delete the link and let homebrew place its own.
2020-12-19 15:19:19 -05:00
Sharvil Shah
965f8a7cf1
macOS: Fix OpenDirectory attribute mismatch. Closes #6320 (#6816) 2020-12-18 12:00:25 -08:00
Alessandro Gario
cfabaa9e28
Eventing framework refactor (#6610) 2020-12-17 22:21:53 -05:00
Mike Myers
c42be2b841
Fix wifi_tests on macOS 10.15 and above (#6724) 2020-12-17 22:17:36 -05:00
Danny Kopping
26d129360f
Docs: adding documentation for retrieving available tables/columns via SQL(#6812)
Signed-off-by: Danny Kopping <danny.kopping@grafana.com>
2020-12-17 22:15:56 -05:00
Zach Wasserman
d2d904f59f
Allow table info PRAGMAs (#6814)
Set up an allowlist for PRAGMA commands in the authorizer. Allow the
PRAGMAs for listing table schema and available functions.
2020-12-17 22:13:24 -05:00
Rachel Cipkins
90e23398bd
systemd_units: Implement new table that tracks systemd units (#6593)
Co-authored-by: Alessandro Gario <alessandro.gario@gmail.com>
2020-12-16 07:52:16 -08:00
seph
6d0348ce29
CHANGELOG 4.6.0 (#6809)
CHANGELOG 4.6.0

Co-authored-by: Teddy Reed <teddy@casualhacking.io>
2020-12-14 23:26:58 -05:00
Zach Wasserman
c3f9a3dae2
Merge pull request from GHSA-4g56-2482-x7q8
* Proposed fix for attach tables vulnerability

* Add authorizer to ATC tables and cleanups

- Add unit test for authorizer function
2020-12-14 15:41:57 -05:00
Teddy Reed
dcfbd89885
cpack: Use CPACK_RPM_PACKAGE_RELEASE (#6805) 2020-12-13 22:22:55 -05:00
Stefano Bonicatti
2b0c4304c7
CMake: add max version limit to 3.18.0 on Linux (#6801)
Due to a bug present in CPack provided with CMake
version 3.18.0 and higher on RPM packages generation,
add a check which fails the configuration
if a version with the bug is found.
Provide a way to ignore the check by setting
OSQUERY_IGNORE_CMAKE_MAX_VERSION_CHECK=TRUE.
2020-12-13 10:04:29 -05:00
Alessandro Gario
32cc8ff54f
libs: Update sqlite to version 3.34.0 (#6804) 2020-12-12 18:40:09 -05:00
Mike Myers
d0e8fbcc18
Add indexed column support to Windows users table (#6782) 2020-12-11 22:01:39 -05:00
Alessandro Gario
8a3c856c76
file_events: Add configuration flag (#6663)
This allows Linux users to configure the process_file_events table
without enabling file_events by mistake.
2020-12-11 21:18:14 -05:00
Stefano Bonicatti
370908d49d
CI: Make the built packages available to be downloaded (#6772)
Also add TGZ as a supported package format on macOS,
since it's already used on the CI.
2020-12-11 21:17:02 -05:00
Stefano Bonicatti
89298dba49
Remove a Buck leftover (#6799) 2020-12-11 14:01:01 +01:00
Alessandro Gario
802bc06965
CI: Update brew scripts (#6794) 2020-12-08 18:15:58 +01:00
Stefano Bonicatti
c3b139d48a
CI: Python installation improvements on Windows (#6764)
Since the CI already selects the newest installation of Python,
to then install some additional packages, lets pass the root folder to CMake,
so it doesn't have to detect Python again and possibly select the wrong version.

Remove the need to use Python3 32bit, since it's not necessary
and the Windows installation used is a 64bit one anyway.

Fix pip complaining about the Scripts folder not being in the PATH,
by prepending the PATH with the selected Python installation
root folder and Scripts folder.

Split and reorder the various prerequisite install steps
so that they are closer to each other
and slightly better categorized.
2020-12-04 21:07:31 -05:00
Alessandro Gario
b04da26b9e
BPF: Fix the tests (#6783) 2020-12-04 18:06:07 +01:00
Alessandro Gario
719cb9b986
libs: Update bzip2 to version 1.0.8 (#6786) 2020-12-03 11:56:45 +01:00
Stefano Bonicatti
4dd97ea6a0
Update cmake_minum_required to 3.17.5 and pin version in CI (#6770) 2020-11-30 15:02:19 +01:00
Stefano Bonicatti
ec0d8f44ee
CMake: Remove unused LTCG flag (#6769) 2020-11-29 15:14:21 +01:00
Stefano Bonicatti
35417f589b
Remove boost workaround introduced in #5591 for string_view (#6771) 2020-11-29 15:13:03 +01:00
Alessandro Gario
6ab99467cd
libs: Update BPF libraries to support LLVM 11 (#6775) 2020-11-29 14:38:27 +01:00
Alessandro Gario
af41184a00
BPF: Fix wrong d_type compare in fs classes (#6774) 2020-11-29 14:38:14 +01:00
Alessandro Gario
4aaeb7a3dc
startup_info: Fix memory leak in the dbus classes (#6773) 2020-11-29 14:37:57 +01:00
Stefano Bonicatti
7ea3bc0090
Change urls for submodules gpg-error, libgcrypt, libcap (#6768)
The gpg-error and libgcrypt repositories often fail cloning.
We use our mirrored version on Github instead.

libcap repository does not support shallow cloning,
change the url to another official mirror which supports it.
2020-11-26 13:45:48 +01:00
Alessandro Gario
fc2bf46c9c
libs: Port the RocksDB Win7 compat patch to MSBuild (#6765) 2020-11-26 13:40:40 +01:00
seph
f986e9c04d
PackageIdentifiers are optional in InstallHistory.plist (#6767)
Allow nil PackageIdentifiers, as they sometimes appear in `/Library/Receipts/InstallHistory.plist` 

Fixes: #6766
2020-11-25 10:20:38 -05:00
Alessandro Gario
76c7733a75
Port the extended_attributes table to Linux, add support for Linux capabilities (#6195) 2020-11-24 13:36:56 -08:00
Pawel Kadluczka
8a79e7cb93
Adding support for pretty-printing JSON results (#6695) 2020-11-24 13:51:06 -05:00
Alessandro Gario
37f2be6143
CMake: Disable BPF support if the LLVM libs are not compatible (#6746) 2020-11-24 13:50:18 -05:00
Alejandro Ortuno
1de11719e5
Added notices about journald audit logs masking (#6748) 2020-11-24 13:49:16 -05:00
Stefano Bonicatti
e96a963dfa
Do not use memset on VirtualTable, a non-POD type (#6760)
Reported by cppcheck:
[osquery/sql/virtual_table.cpp:557]: (error) Using 'memset' on struct that contains a 'std::shared_ptr'
2020-11-24 13:49:03 -05:00
Alessandro Gario
bf46e53995
libs: Update ebpfpub to latest version (#6757)
This imports an upstream commit that fixes an assert on single core machines
2020-11-22 22:40:10 -08:00
Rachel Cipkins
82908870a1
startup_items: Add systemd support on Linux (#6562)
Co-authored-by: Alessandro Gario <alessandro.gario@gmail.com>
2020-11-22 22:37:55 -08:00
Alessandro Gario
dab1a20582
libs: Update RocksDB to version 6.14.5 (#6759) 2020-11-21 17:41:16 +01:00
ntuckerxx
2da28bb188
Fixes #6752 - support TLS client cert chains (#6753) 2020-11-19 20:38:11 -05:00
Sharvil Shah
c1636adbc1
Extend EC2 table support to Windows (#6756) 2020-11-19 11:06:12 -08:00
Sharvil Shah
a407121f17
Enable AWS Instance profile as credential provider on Windows (#6754) 2020-11-18 10:07:09 -08:00