Mark Roberts
|
f38bcd390e
|
Add file_type to process_open_files
|
2014-10-31 11:13:35 -07:00 |
|
Mark Roberts
|
3cf5aa4bae
|
Add lsof for #28 functionality to Darwin, refactor to use shared infra for process_envs
|
2014-10-31 03:28:14 -07:00 |
|
yetanotherhacker
|
8cee7e0b3c
|
Spelling fixes in comments and output.
|
2014-10-30 04:27:00 -04:00 |
|
Teddy Reed
|
4ed61ff868
|
Merge pull request #288 from vmauge/NewLongType
Add new long type and migrate some vtables
|
2014-10-29 23:12:52 -07:00 |
|
Vincent Mauge
|
07bd114107
|
Change users table to used new long long int type for uid and gid
It is now possible to do a proper order on uid or gid, ie:
SELECT * FROM users ORDER BY uid;
|
2014-10-29 18:57:12 -07:00 |
|
Vincent Mauge
|
755d8c198e
|
Change groups table to used new long long int type for gid
It is now possible to do a proper order on gid, ie:
SELECT * FROM groups ORDER BY gid;
|
2014-10-29 18:57:00 -07:00 |
|
Mike Arpaia
|
0f037d4082
|
Merge pull request #283 from facebook/fix_sockaddr_inc
Fix #277, add socket.h to interfaces on darwin
|
2014-10-29 17:41:36 -07:00 |
|
Teddy Reed
|
cd74544208
|
Fix #277, add socket.h to interfaces on darwin
|
2014-10-29 16:44:17 -07:00 |
|
Mark Roberts
|
0867c2b547
|
Add process_envs table for OSX and Linux for issue #99
|
2014-10-29 03:45:26 -07:00 |
|
Teddy Reed
|
39f866387f
|
[vtables] CPUID asm call feature information
|
2014-10-29 03:09:34 -07:00 |
|
Teddy Reed
|
1f1b38976a
|
Merge pull request #261 from facebook/crontab
[vtables] Crontab parsing for system/users
|
2014-10-29 02:52:11 -07:00 |
|
Teddy Reed
|
6db0c67555
|
Merge pull request #269 from vmauge/suidbin
Add suid_bin vtable
|
2014-10-29 02:30:29 -07:00 |
|
Teddy Reed
|
8a9374d6e3
|
[vtables] Support linux crontab vars
|
2014-10-29 02:24:00 -07:00 |
|
Teddy Reed
|
94c64d80ce
|
Merge pull request #267 from facebook/kernel_modules
[vtables] Linux kernel modules from procfs
|
2014-10-29 02:03:46 -07:00 |
|
Vincent Mauge
|
471d5faaa0
|
Add suid_bin vtable
The vtabel report :
- path: full path of the file
- unix_user: name of the owner (if not available display the uid)
- unix_group: name of the groupe (if not available display the gid)
- permissions: report suid or guid
* S for suid bin
* G for guid bin
Example :
osquery> select * from suid_bin;
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| path | unix_user | unix_group | permissions |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| "/bin/ps" | root | wheel | S |
| "/bin/rcp" | root | wheel | S |
| "/Users/vmauge/suid_test" | vmauge | 999 | SG |
| "/usr/bin/at" | root | wheel | S |
| "/usr/bin/atq" | root | wheel | S |
| "/usr/bin/atrm" | root | wheel | S |
| "/usr/bin/batch" | root | wheel | S |
| "/usr/bin/crontab" | root | wheel | S |
| "/usr/bin/ipcs" | root | wheel | S |
| "/usr/bin/lockfile" | root | mail | G |
| "/usr/bin/login" | root | wheel | S |
| "/usr/bin/newgrp" | root | wheel | S |
| "/usr/bin/procmail" | root | mail | G |
| "/usr/bin/quota" | root | wheel | S |
| "/usr/bin/rlogin" | root | wheel | S |
| "/usr/bin/rsh" | root | wheel | S |
| "/usr/bin/su" | root | wheel | S |
| "/usr/bin/sudo" | root | wheel | S |
| "/usr/bin/top" | root | wheel | S |
| "/usr/bin/wall" | root | tty | G |
| "/usr/bin/write" | root | tty | G |
| "/usr/sbin/postdrop" | root | _postdrop | G |
| "/usr/sbin/postqueue" | root | _postdrop | G |
| "/usr/sbin/rpc.net" | root | wheel | S |
| "/usr/sbin/rpcset" | root | wheel | S |
| "/usr/sbin/traceroute" | root | wheel | S |
| "/usr/sbin/traceroute6" | root | wheel | S |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
This commit fixes issue #253.
|
2014-10-29 01:33:58 -07:00 |
|
Teddy Reed
|
339b63677e
|
[vtables] Rename homebrew files, some cleanup
|
2014-10-29 00:34:55 -07:00 |
|
Teddy Reed
|
c1991e94e5
|
[vtables] Add user crons and use files
|
2014-10-29 00:28:19 -07:00 |
|
Martin Majlis
|
d645dfc257
|
Initial implementation for the homebrew table.
|
2014-10-28 21:03:56 -07:00 |
|
Teddy Reed
|
9abcbcd485
|
[vtables] Linux kernel modules from procfs
|
2014-10-28 21:01:51 -07:00 |
|
Martin Majlis
|
e8eb1e222f
|
Reformating the code with clang-formatter.
|
2014-10-28 19:43:13 -07:00 |
|
Martin Majlis
|
8b8ec7c644
|
Added initial implementation for crontab.
|
2014-10-28 17:52:03 -07:00 |
|
Teddy Reed
|
6e60612520
|
Using clang-format 3.5
|
2014-10-27 17:37:36 -07:00 |
|
Mike Arpaia
|
0f57dba4d9
|
Merge pull request #228 from facebook/bash_history_table
Adding virtual table bash_history, for linux and darwin
|
2014-10-27 16:41:17 -04:00 |
|
mike@arpaia.co
|
dafd2d7534
|
updating comment
|
2014-10-27 16:34:00 -04:00 |
|
Mike Arpaia
|
a5f7dc1aa3
|
Merge pull request #247 from facebook/time-types
time types
|
2014-10-27 12:47:52 -04:00 |
|
mike@arpaia.co
|
2ba54f5211
|
time types
|
2014-10-27 09:13:21 -04:00 |
|
Teddy Reed
|
53afc6b8b2
|
Merge pull request #240 from facebook/event_logs
Change log formatting to individual events
|
2014-10-26 14:53:58 -07:00 |
|
Javier Marcos
|
c8c3363455
|
Changed logic to ignore when history file is not found (expected)
|
2014-10-24 20:38:09 -07:00 |
|
Javier Marcos
|
542d53fd5e
|
Refactoring and added column for history file, also more history files supported
|
2014-10-24 20:29:23 -07:00 |
|
Teddy Reed
|
84e8718d62
|
Merge pull request #238 from facebook/unify_routes
[vtable] Unify routes table for OSX/Linux
|
2014-10-24 17:08:16 -07:00 |
|
Teddy Reed
|
a82792b3f7
|
Log results as events
|
2014-10-24 17:05:17 -07:00 |
|
Teddy Reed
|
3d7c8b5684
|
[vtable] Unify routes table for OSX/Linux
|
2014-10-24 12:34:18 -07:00 |
|
Javier Marcos
|
bf3cd15c91
|
Final fix for the allocation problem
|
2014-10-23 17:17:50 -07:00 |
|
Javier Marcos
|
f69913938f
|
Bad memory leak with OpenDirectory and pwd/grp.h code
|
2014-10-22 23:49:16 -07:00 |
|
Javier Marcos
|
1066f667ab
|
Adding virtual table bash_history, for linux and darwin
|
2014-10-22 15:21:05 -07:00 |
|
Javier Marcos
|
bf1ffb1537
|
Removing old code for generating virtual tables
|
2014-10-13 21:58:26 -07:00 |
|
Javier Marcos
|
06792db7f0
|
Adding support for last in linux
|
2014-10-13 18:19:08 -07:00 |
|
Javier Marcos
|
b3208bab70
|
Errors handled, shit is on fire
|
2014-10-10 16:09:45 -07:00 |
|
Javier Marcos
|
b518c6b9e0
|
Adding groups vtable and refactoring users
|
2014-10-10 15:09:14 -07:00 |
|
mike@arpaia.co
|
ae91f7af7e
|
only index if it's not nullptr
|
2014-10-09 22:08:37 -07:00 |
|
mike@arpaia.co
|
0033e9bd02
|
cleaning up some memory leak supps
|
2014-10-09 22:06:55 -07:00 |
|
Javier Marcos
|
19a2d64959
|
Making sure we do not add duplicated users
|
2014-10-09 18:55:25 -07:00 |
|
mike@arpaia.co
|
f45798d31a
|
OMG memory leaks
|
2014-10-09 18:08:31 -07:00 |
|
Javier Marcos
|
64ce35c949
|
Virtual table to be build in both linux and mac
|
2014-10-09 15:27:18 -07:00 |
|
Javier Marcos
|
d09e6037dd
|
Fixing infinite loop adding mutex
|
2014-10-09 14:42:37 -07:00 |
|
Javier Marcos
|
7944ab50da
|
Adding vtable for users
|
2014-10-09 12:50:34 -07:00 |
|
Javier Marcos
|
e66a4d8873
|
Install package depending on arch and better comments
|
2014-10-08 23:09:02 +00:00 |
|
Javier Marcos
|
5db9fa59a5
|
Adding support to build osquery in centos 6.5
|
2014-10-08 03:45:56 +00:00 |
|
Teddy Reed
|
2063252f73
|
[vtable] Fix warning for process in-condition assignment
|
2014-10-04 13:29:17 -07:00 |
|
Teddy Reed
|
5e6be33767
|
Merge pull request #199 from facebook/unify_processes
[vtable] Parity with OSX/Linux processes table
|
2014-10-03 17:30:47 -07:00 |
|