mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 18:33:54 +00:00
c7355b19aa
Summary: Pull Request resolved: https://github.com/facebook/osquery/pull/5452 As suggested in another diff, this diff updates the language we use to describe the osquery licensing terms. We are changing all instances of //This source code is licensed as defined on the LICENSE file found in the root directory of this source tree.// to //This source code is licensed in accordance with the terms specified in the LICENSE file found in the root directory of this source tree.// We accomplish this with a codemod: $ codemod -md xplat/osquery/oss --extensions cpp,h,in,py,sh,mm,ps1 "(.\s+)This source code is licensed as defined on the LICENSE file found in the(.*)root directory of this source tree\." "\1This source code is licensed in accordance with the terms specified in\2the LICENSE file found in the root directory of this source tree." Reviewed By: fmanco Differential Revision: D14131290 fbshipit-source-id: 52c90da342263e2a80f5a678ecd760c19cf7513e
46 lines
1.3 KiB
C++
46 lines
1.3 KiB
C++
/**
|
|
* Copyright (c) 2014-present, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed in accordance with the terms specified in
|
|
* the LICENSE file found in the root directory of this source tree.
|
|
*/
|
|
|
|
#include <osquery/events.h>
|
|
#include <osquery/sql.h>
|
|
|
|
#include <osquery/hashing/hashing.h>
|
|
#include <osquery/tables/events/event_utils.h>
|
|
|
|
namespace osquery {
|
|
|
|
const std::set<std::string> kCommonFileColumns = {
|
|
"inode", "uid", "gid", "mode", "size", "atime", "mtime", "ctime",
|
|
};
|
|
|
|
void decorateFileEvent(const std::string& path, bool hash, Row& r) {
|
|
auto results = SQL::selectAllFrom("file", "path", EQUALS, path);
|
|
if (results.size() == 1) {
|
|
auto& row = results.at(0);
|
|
for (const auto& key : kCommonFileColumns) {
|
|
if (row.count(key) > 0) {
|
|
r[key] = row.at(key);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (hash) {
|
|
auto hashes = hashMultiFromFile(
|
|
HASH_TYPE_MD5 | HASH_TYPE_SHA1 | HASH_TYPE_SHA256, path);
|
|
r["md5"] = std::move(hashes.md5);
|
|
r["sha1"] = std::move(hashes.sha1);
|
|
r["sha256"] = std::move(hashes.sha256);
|
|
// Hashed determines the success/status of hashing, -1 failed, 1 success.
|
|
r["hashed"] = (r.at("md5").empty()) ? "-1" : "1";
|
|
} else {
|
|
// Alternatively if hashing wasn't needed hashed is a 0.
|
|
r["hashed"] = "0";
|
|
}
|
|
}
|
|
}
|