julient
12/18/2018, 8:46 AMpacketzero
02/11/2019, 3:45 PMpacketzero
04/29/2019, 7:52 PMpacketzero
05/01/2019, 11:33 PMpacketzero
05/01/2019, 11:43 PMycpr
05/20/2019, 4:12 PMgoogletest
(libgtest.a
) while compiling osquery using qcreator on 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1 (2019-04-12) x86_64 GNU/Linux
. It compiles with make
though. Have anyone experienced such problem? I tried to install googletest
and libgtest-dev
packages and ran make deps
already.
17:13:40: Running steps for project OSQUERY...
17:13:40: Starting: "/usr/local/bin/cmake" --build . --target all
[ 1%] Linking CXX static library libgtest.a
Error running link command: No such file or directory
third-party/googletest/googlemock/gtest/CMakeFiles/gtest.dir/build.make:83: recipe for target 'third-party/googletest/googlemock/gtest/libgtest.a' failed
make[2]: *** [third-party/googletest/googlemock/gtest/libgtest.a] Error 2
make[1]: *** [third-party/googletest/googlemock/gtest/CMakeFiles/gtest.dir/all] Error 2
CMakeFiles/Makefile2:369: recipe for target 'third-party/googletest/googlemock/gtest/CMakeFiles/gtest.dir/all' failed
Makefile:140: recipe for target 'all' failed
make: *** [all] Error 2
17:13:40: The process "/usr/local/bin/cmake" exited with code 2.
Error while building/deploying project OSQUERY (kit: Desktop)
When executing step "Make"
17:13:40: Elapsed time: 00:00.
packetzero
08/21/2019, 3:26 PMFG
10/24/2019, 6:29 PMtheopolis
10/24/2019, 6:43 PMsean.cavanaugh
10/28/2019, 10:05 PMtimb
11/06/2019, 9:55 PMservice osqueryd stop
is supposed to wait for all of the processes to die but does not; i'm pretty sure i see the issue but a set of eyes familiar would be great. i'll thread here with some detailstheopolis
12/06/2019, 9:16 PMagrammenos
12/10/2019, 2:29 PMStefano Bonicatti
12/12/2019, 7:47 PMtimb
01/06/2020, 10:53 PMderwolfe
01/08/2020, 5:15 PMtheopolis
01/17/2020, 11:08 PMAnatol Pomazau
02/28/2020, 8:29 PMmaster
?Stefano Bonicatti
03/08/2020, 12:26 AMcraSH
03/27/2020, 11:38 PMpid
column of the table listening_ports
to be populated? I've identified that in my environment we're definitely not providing the needed capability to get that data (it just returns -1
), but in debugging if i give all capabilities it works. Just not super clear to me based on capabilities/kernel docs or the osquery source code (https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/networking/linux/process_open_sockets.cpp#L43 -ish?) which one it needsrmbowie
03/31/2020, 4:55 PMsundsta
04/03/2020, 11:21 PMProtectSystem=strict
feature. The daemon does not start, but no logs are produced. Does anyone know what changed between 4.0.2 and 4.1.1 that may have caused this? Hereâs my full service unit config:
[Unit]
Description=The osquery Daemon
After=network.service syslog.service
[Service]
TimeoutStartSec=0
EnvironmentFile=/etc/default/osqueryd
ExecStartPre=/bin/sh -c "if [ ! -f $CONFIG_FILE ]; then echo {} > $CONFIG_FILE; fi"
ExecStartPre=/bin/sh -c "if [ ! -f $FLAG_FILE ]; then touch $FLAG_FILE; fi"
ExecStartPre=/bin/sh -c "if [ -f $LOCAL_PIDFILE ]; then mv $LOCAL_PIDFILE $PIDFILE; fi"
ExecStart=/usr/bin/osqueryd \
--flagfile $FLAG_FILE \
--config_path $CONFIG_FILE
Restart=on-failure
KillMode=process
KillSignal=SIGTERM
ProtectSystem=strict
ReadWritePaths=/var/osquery /var/run /var/tmp /tmp
[Install]
WantedBy=multi-user.target
DU
04/16/2020, 1:17 PMhardware_xxx
from system_info
e.g.
hardware_model
Actual: Super Server
Expect: X11SSH-F
hardware_version
Actual: 0123456789
Expect: 1.01
hardware_serial
Actual: 0123456789
Expect: WM199xxxxxxx
after checking osquery/tables/system/linux/system_info.cpp
, I find out it matches type 1 (System Information )
only. And the expect value is from type 2 (Base Board or Module Information)
.
I would like to propose several new columns to system_info
table, i.e. board_vendor
, board_model
, board_version
and board_serial
, which is similar to hardware_xxx
.
What do you think?Anatol Pomazau
04/24/2020, 6:30 PMpacketzero
05/08/2020, 6:42 PMrokusei
06/02/2020, 9:37 AMrpmtools
and dpkg
are necessary for these? When building locally, it seems like
git python3 bison flex make
are the only requirements. (I haven't tried to run it though)poisonous97
06/10/2020, 10:07 AMgenerate
not return data
#!/usr/bin/env python
import magic
import json
import osquery
from os import listdir
from os.path import isfile, join
@osquery.register_plugin
class MyTablePlugin(osquery.TablePlugin):
def name(self):
return "types_file"
def columns(self):
return [
osquery.TableColumn(name="value", type=osquery.STRING),
osquery.TableColumn(name="path", type=osquery.STRING),
]
def get_context_list_val(self, val):
return "" if not val else val[0]["expr"]
def generate(self, context):
data = map(lambda x: (x["name"], self.get_context_list_val(x['list'])),
json.loads(json.loads(context))["constraints"])
path = dict(data)["path"]
onlyfiles = [join(path, f) for f in listdir(path) if isfile(join(path, f))]
data = []
for file_name in onlyfiles:
value = magic.from_file(file_name)
row = {}
print(str(file_name))
row['value'] = value
row["path"] = str(file_name)
data.append(row)
return data
if __name__ == "__main__":
osquery.start_extension(name="my_awesome_extension", version="1.0.0")
Fran RodrĂguez
06/15/2020, 8:51 AMroot 23309 0.0 0.4 126996 18400 ? SNsl Jun11 1:40 /usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf
root 23313 0.0 0.0 0 0 ? ZNl Jun11 0:07 [osqueryd] <defunct>
Fran RodrĂguez
06/16/2020, 5:51 PMFran RodrĂguez
06/17/2020, 8:11 AM