mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 02:18:53 +00:00
65df593d33
There was a bug in the `osquery::Schedule` container object such that, when the iteration through the schedule occured, pack objects were being passed by value (copied) instead of passed by reference. Thus, the discovery query would be executed, the object's cache would be updated, and then the object would go out of scope and be destructed, thus leaving the original object without ever having ran the discovery query. This caused discovery queries to thrash. Bad times. I added a new test so that we don't regress here as well as const'd a few functions that should have been const in `osquery::Pack`.
58 lines
1.2 KiB
Plaintext
58 lines
1.2 KiB
Plaintext
{
|
|
"options": {
|
|
"enable_monitor": "true"
|
|
},
|
|
"packs": {
|
|
"kernel": {
|
|
"version": "1.5.0",
|
|
"queries": {
|
|
"process_events": {
|
|
"query": "select distinct path, cmdline, uid, euid, environment from process_events;",
|
|
"interval": 3600,
|
|
"version": "1.5.1-26",
|
|
"removed": false
|
|
}
|
|
}
|
|
},
|
|
"foobar": {
|
|
"platform": "darwin",
|
|
"version": "1.5.0",
|
|
"discovery": [
|
|
"select pid from processes where name = 'foobar';"
|
|
],
|
|
"queries": {
|
|
"kernel_modules": {
|
|
"query": "select * from kernel_modules;",
|
|
"interval": 3600
|
|
},
|
|
"totally_fake": {
|
|
"query": "select * from kernel_modules;",
|
|
"interval": 3600,
|
|
"platform": "lol"
|
|
}
|
|
}
|
|
},
|
|
"foobaz": {
|
|
"version": "9.9.9",
|
|
"queries": {}
|
|
},
|
|
"baz": {
|
|
"discovery": [
|
|
"select * from osquery_info;"
|
|
],
|
|
"queries": {
|
|
"kernel_modules": {
|
|
"query": "select * from kernel_modules;",
|
|
"interval": 3600
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"schedule": {
|
|
"launchd": {
|
|
"query": "select * from launchd;",
|
|
"interval": 3600
|
|
}
|
|
}
|
|
}
|