Teddy Reed
fcdf49d17f
WIP migrating Linux Events
2014-12-15 00:43:28 -08:00
Teddy Reed
17efa0b3d6
Migrate subscribers on OSX
2014-12-15 00:25:28 -08:00
Teddy Reed
fbd56663d9
Migrate fsevents to events 2.0
2014-12-14 22:17:38 -08:00
Teddy Reed
d927495209
Support casted subscribes
2014-12-14 21:20:20 -08:00
Teddy Reed
c1e37b73fb
Non-static event type and name IDs
2014-12-14 18:03:41 -08:00
Teddy Reed
d2a93cf8c1
Remove EventSubscriber macros
2014-12-14 17:05:07 -07:00
Teddy Reed
0d00e4b0e9
Remove EventPublisher macros
2014-12-14 04:43:31 -07:00
Teddy Reed
353b44c6cc
Merge pull request #542 from theopolis/iokit_hid_events
...
IOKit HID events and OSX hardware_events table
2014-12-12 14:08:21 -08:00
Teddy Reed
cd20ed6b77
Prevent IOKitHID value subscriptions
2014-12-11 18:19:05 -08:00
Teddy Reed
acccfa94e2
IOKit HID events and OSX hardware_events table
2014-12-11 18:06:08 -08:00
Teddy Reed
8d1966f7ff
Merge pull request #541 from theopolis/usb_parity
...
PCI/USB parity
2014-12-11 10:29:24 -08:00
Teddy Reed
7b56fa605d
PCI/USB parity
2014-12-10 19:51:18 -08:00
Teddy Reed
a75fa3bf11
Merge pull request #538 from theopolis/improve_usb
...
Improve usb_devices on OSX
2014-12-10 19:51:08 -08:00
Teddy Reed
fcfac2174f
Merge pull request #540 from facebook/osquery_info
...
osquery_info table
2014-12-10 19:50:45 -08:00
mike@arpaia.co
8f8bc6b772
osquery_info table
2014-12-10 18:38:41 -08:00
Teddy Reed
b08ad3cb14
Check USB property for CFString type
2014-12-10 09:12:12 -08:00
Teddy Reed
f29e0c17ca
Update ca_certs_tests to use moved OSX conversions
2014-12-10 01:59:13 -08:00
Teddy Reed
4644c5e19b
Simple usb_devices updates
2014-12-10 01:52:02 -08:00
Teddy Reed
7ba4fb31dd
Merge pull request #536 from theopolis/suid_fix
...
Suid fix
2014-12-10 01:19:48 -08:00
Teddy Reed
b8f3d36754
Merge pull request #535 from theopolis/osqueryd_osquery
...
Using osquery as the app ID
2014-12-10 01:19:30 -08:00
Teddy Reed
0b5083bd0e
Improve usb_devices on OSX
2014-12-10 01:17:24 -08:00
Teddy Reed
ab8df11818
Add filesystem_error catching and remove suid_bin from BL
2014-12-09 20:13:39 -08:00
Teddy Reed
76d97f60ac
Merge pull request #534 from theopolis/linux_netlink
...
[Fix #530 ] Continue to read from NL socket
2014-12-09 18:24:42 -08:00
Teddy Reed
5b029c96ec
Using osquery as the app ID
2014-12-09 17:37:58 -08:00
Teddy Reed
9a9de67b93
Restrict suid_bin to common search paths
2014-12-09 16:38:14 -08:00
Teddy Reed
192224977d
Add small delay if NL read = 0
2014-12-09 16:02:25 -08:00
Teddy Reed
22c9664ae1
[ Fix #530 ] Continue to read from NL socket
2014-12-09 15:49:40 -08:00
Teddy Reed
f4a226f4cf
Merge pull request #533 from theopolis/static_build_osx
...
Link the brew dependencies statically on OSX
2014-12-09 14:03:54 -08:00
Teddy Reed
2fae6c0d7c
Link the brew dependencies statically on OSX
2014-12-09 13:40:53 -08:00
Teddy Reed
c26c3a6dfa
Merge pull request #532 from arirubinstein/master
...
Force git to return something if tags aren't found
2014-12-09 10:12:19 -08:00
Ari Rubinstein
27b6fb021e
Force git to return something if tags aren't found
...
If there are no tags in the current repository, this command will fail leaving the OSQUERY_BUILD_VERSION blank, and therefore breaking the package building process (and presumably other things too) due to the empty version flag. By adding the flag --always, this forces git to fallback to a commit id instead of returning nothing.
2014-12-09 09:52:36 -08:00
Mike Arpaia
ee285fca91
Merge pull request #531 from facebook/pidfile-fix
...
Fixing pidfile creation bug
2014-12-09 02:21:01 -08:00
mike@arpaia.co
0846b6ddd5
Fixing pidfile creation bug
...
If osqueryd was killed and another process was started with osqueryd's
old pid before a new osqueryd could start, osqueryd would encounter a
bug where osqueryd would never start.
This executes an osquery query to the processes table to make sure that
the name of the process is "osqueryd". Of course, you could perhaps
denial of service osqueryd this way, but that would require root
filesystem access (assuming that the last version of osqueryd was
ran as root). Thoughts?
2014-12-08 23:52:38 -08:00
mike@arpaia.co
fda82f21ab
TARGETS updates
2014-12-08 18:20:02 -08:00
Teddy Reed
a5fa544568
Merge pull request #529 from theopolis/linux_events_udev
...
Linux udev events
2014-12-08 16:11:43 -08:00
Teddy Reed
96d68ce98a
Clean before building CI
2014-12-08 15:22:17 -08:00
Teddy Reed
2ebbbf6f98
Linux udev events
2014-12-08 14:13:47 -08:00
mike@arpaia.co
e260007f04
Change exit(-1) to exit(EXIT_FAILURE)
2014-12-08 10:40:10 -08:00
Teddy Reed
fb5048596c
Merge pull request #527 from theopolis/fix_linux_processes_cmdline
...
Replace linux cmdline tokens with spaces
2014-12-07 18:11:07 -08:00
Teddy Reed
f8cc579d36
Fix json results clear
2014-12-07 15:53:37 -07:00
Teddy Reed
b890670be1
Replace linux cmdline tokens with spaces
2014-12-07 00:35:24 -07:00
Teddy Reed
a0866c0972
Merge pull request #524 from theopolis/events_expiry
...
Events expiry
2014-12-06 19:52:16 -08:00
Teddy Reed
b77f469752
Merge pull request #526 from theopolis/json-output
...
Add -json output mode for shell
2014-12-06 19:52:06 -08:00
Teddy Reed
19695d40aa
Add expiration to events
2014-12-06 18:28:03 -07:00
Teddy Reed
78ecc73d81
Add -json output mode for shell
2014-12-06 18:22:48 -07:00
Sean Williams
c74c972e1d
Update CONTRIBUTING.md
2014-12-06 12:35:02 -08:00
Sean Williams
9c513c20e7
Update CONTRIBUTING.md
2014-12-06 12:34:19 -08:00
Teddy Reed
7b16e45f55
Improve pubsub unittests
2014-12-05 16:18:05 -07:00
Teddy Reed
76597aa25f
Merge pull request #522 from theopolis/make_pkg_simple
...
Add -s flag to OSX package script
2014-12-04 09:46:03 -08:00
Teddy Reed
f3ab333cf1
Add -s flag to OSX package script
2014-12-04 09:33:04 -08:00
