if(APPLE) file(GLOB OSQUERY_OBJC_TABLES "*/darwin/*.mm") ADD_OSQUERY_OBJCXX_LIBRARY_ADDITIONAL(osquery_tables_objc ${OSQUERY_OBJC_TABLES} ) file(GLOB OSQUERY_DARWIN_TABLES "*/darwin/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_darwin ${OSQUERY_DARWIN_TABLES} ) file(GLOB OSQUERY_DARWIN_TABLES_TESTS "*/darwin/tests/*.cpp" "*/darwin/tests/*.mm") ADD_OSQUERY_TABLE_TEST(${OSQUERY_DARWIN_TABLES_TESTS}) ADD_OSQUERY_LINK_ADDITIONAL("-framework CoreFoundation") ADD_OSQUERY_LINK_ADDITIONAL("-framework CoreWLAN") ADD_OSQUERY_LINK_ADDITIONAL("-framework Security") ADD_OSQUERY_LINK_ADDITIONAL("-framework OpenDirectory") ADD_OSQUERY_LINK_ADDITIONAL("-framework DiskArbitration") ADD_OSQUERY_LINK_ADDITIONAL("libresolv.dylib") ADD_OSQUERY_LINK_ADDITIONAL("libxar.dylib") ADD_OSQUERY_LINK_ADDITIONAL("magic") ADD_OSQUERY_LINK_ADDITIONAL("tsk") elseif(FREEBSD) file(GLOB OSQUERY_FREEBSD_TABLES "*/freebsd/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_freebsd ${OSQUERY_FREEBSD_TABLES} ) file(GLOB OSQUERY_FREEBSD_TABLES_TESTS "*/freebsd/tests/*.cpp") ADD_OSQUERY_TABLE_TEST(${OSQUERY_FREEBSD_TABLES_TESTS}) ADD_OSQUERY_LINK_ADDITIONAL("procstat") ADD_OSQUERY_LINK_ADDITIONAL("util") ADD_OSQUERY_LINK_ADDITIONAL("kvm") ADD_OSQUERY_LINK_ADDITIONAL("elf") ADD_OSQUERY_LINK_ADDITIONAL("magic") elseif(WINDOWS) # Additional Windows libraries ADD_OSQUERY_LINK_ADDITIONAL("Advapi32.lib") ADD_OSQUERY_LINK_ADDITIONAL("version.lib") # Windows specific tables file(GLOB OSQUERY_WINDOWS_TABLES "*/windows/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_windows ${OSQUERY_WINDOWS_TABLES} ) file(GLOB OSQUERY_WINDOWS_TABLES_TESTS "*/windows/tests/*.cpp") ADD_OSQUERY_TABLE_TEST(${OSQUERY_WINDOWS_TABLES_TESTS}) else() file(GLOB OSQUERY_LINUX_TABLES "*/linux/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_linux ${OSQUERY_LINUX_TABLES} ) file(GLOB OSQUERY_LINUX_TABLES_TESTS "*/linux/tests/*.cpp") ADD_OSQUERY_TABLE_TEST(${OSQUERY_LINUX_TABLES_TESTS}) if(REDHAT_BASED) # CentOS specific tables # file(GLOB OSQUERY_REDHAT_TABLES "*/centos/*.cpp") # ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_redhat # ${OSQUERY_REDHAT_TABLES} # ) elseif(DEBIAN_BASED) # Ubuntu specific tables # file(GLOB OSQUERY_UBUNTU_TABLES "*/ubuntu/*.cpp") # ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_ubuntu # ${OSQUERY_UBUNTU_TABLES} # ) endif() ADD_OSQUERY_LINK_ADDITIONAL("libresolv.so") ADD_OSQUERY_LINK_ADDITIONAL("cryptsetup devmapper") ADD_OSQUERY_LINK_ADDITIONAL("gcrypt gpg-error") ADD_OSQUERY_LINK_ADDITIONAL("blkid") ADD_OSQUERY_LINK_ADDITIONAL("ip4tc") ADD_OSQUERY_LINK_ADDITIONAL("magic") ADD_OSQUERY_LINK_ADDITIONAL("tsk") ADD_OSQUERY_LINK_ADDITIONAL("apt-pkg dpkg lzma lz4 bz2") ADD_OSQUERY_LINK_ADDITIONAL("rpm rpmio beecrypt popt db") endif() if(APPLE OR LINUX) file(GLOB OSQUERY_CROSS_EVENTS_TABLES "events/*.cpp") ADD_OSQUERY_LINK_ADDITIONAL("augeas fa xml2") if(APPLE) ADD_OSQUERY_LINK_ADDITIONAL("libiconv") endif() else() # TODO: When we have Windows events, fill this in set(OSQUERY_CROSS_EVENTS_TABLES "") endif() # TODO: These tables should be made Windows-compatible if(NOT WINDOWS) file(GLOB OSQUERY_POSIX_NETWORKING_TABLES "networking/posix/*.cpp") file(GLOB OSQUERY_CROSS_FORENSIC_TABLES "forensic/*.cpp") file(GLOB OSQUERY_POSIX_APPLICATIONS_TABLES "applications/posix/*.cpp") file(GLOB OSQUERY_POSIX_SYSTEM_TABLES "system/posix/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables ${OSQUERY_POSIX_APPLICATIONS_TABLES} ${OSQUERY_POSIX_NETWORKING_TABLES} ${OSQUERY_CROSS_EVENTS_TABLES} ${OSQUERY_CROSS_FORENSIC_TABLES} ${OSQUERY_POSIX_SYSTEM_TABLES} ) file(GLOB OSQUERY_POSIX_TABLES_TESTS "*/posix/tests/*.cpp") ADD_OSQUERY_TABLE_TEST(${OSQUERY_POSIX_TABLES_TESTS}) endif() # No cross-platform application tables yet. file(GLOB OSQUERY_CROSS_APPLICATIONS_TABLES "applications/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_applications ${OSQUERY_CROSS_APPLICATIONS_TABLES} ) file(GLOB OSQUERY_CROSS_NETWORKING_TABLES "networking/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_networking ${OSQUERY_CROSS_NETWORKING_TABLES} ) file(GLOB OSQUERY_CROSS_SYSTEM_TABLES "system/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_tables_system ${OSQUERY_CROSS_SYSTEM_TABLES} ) file(GLOB OSQUERY_CROSS_TABLES_TESTS "[!uo]*/tests/*/*.cpp") file(GLOB OSQUERY_CATEGORY_TABLE_TESTS "[!uo]*/tests/*.cpp") file(GLOB OSQUERY_TABLE_TESTS "tests/*.cpp") ADD_OSQUERY_TABLE_TEST( ${OSQUERY_CROSS_TABLES_TESTS} ${OSQUERY_CATEGORY_TABLE_TESTS} ${OSQUERY_TABLE_TESTS} ) file(GLOB OSQUERY_UTILITY_TABLES "utility/*.cpp") ADD_OSQUERY_LIBRARY_CORE(osquery_tables_utility ${OSQUERY_UTILITY_TABLES} ) if(NOT FREEBSD AND NOT WINDOWS) file(GLOB OSQUERY_UTILS "other/*.cpp") ADD_OSQUERY_LIBRARY_ADDITIONAL(osquery_utils ${OSQUERY_UTILS} ) file(GLOB OSQUERY_UTILS_TESTS "other/tests/*.cpp") ADD_OSQUERY_TEST_ADDITIONAL(${OSQUERY_UTILS_TESTS}) endif()