Title
#core
s

seph

11/21/2019, 7:32 PM
I don’t think I’ve seen anything yet (not to say there isn’t). But I’d probably go the route of whomping the registry.
packetzero

packetzero

11/21/2019, 7:49 PM
Not a bad idea
s

seph

11/21/2019, 7:50 PM
I’ve been playing with trying to suppress table registration. But having some unclear issue. I should push that code and get help
packetzero

packetzero

11/21/2019, 8:38 PM
Definitely. Send me a link and I’ll take a look tonight
s

seph

11/21/2019, 8:43 PM
I’m playing with https://github.com/osquery/osquery/compare/master...directionless:seph/table-suppression-for-testing (It’s got a lot of random notes for my tracing)
8:44 PM
The trouble I’m having is in https://github.com/directionless/osquery/blob/dd5585f1fa9cfd17a090cf11483cb636d825a8a8/osquery/registry/registry_interface.cpp#L384-L416 That if block is being parsed. But the flag value appear incorrect. It’s always the default. I don’t really understand how flags are supposed to work
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 9:56 PM
those functions are running during global initialization afaik
9:56 PM
which means that main() didn't even started yet
9:57 PM
tables registers during global init
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:05 PM
Sorry, what is the question?
10:06 PM
this is what I was talking about
10:06 PM
which starts from using the REGISTER macro
10:06 PM
in global space
s

seph

11/21/2019, 10:07 PM
Right — I found that via the REGISTER macro.
10:08 PM
But I may not understand something in c here.
10:08 PM
What causes this code to get run? And where does flag prsing happen
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:10 PM
global init is causing it to run, and the first lines of code I copied are declaring a constructor that gets called by the REGISTER macro, which is constructing an object in global scope in a variable named kclassname
10:11 PM
so for the audit case is kAuditEventPublisher
s

seph

11/21/2019, 10:11 PM
I did not think that code ran in the proprocess stage? It creates those
kAuditEventPublisher
blobs, right?
10:12 PM
What is “global init” ?
10:14 PM
Maybe I’m being misled by the bit in init.cpp:
// Initialize registries and plugins
  registryAndPluginInit();
Is that not where it happens?
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:14 PM
global initialization or static initialization is a phase of variable initialization that "runs as soon as the program starts"
10:15 PM
but before main() is being called
10:15 PM
compilers insert special code to do so
10:15 PM
it's something given by the language
s

seph

11/21/2019, 10:15 PM
Ah. this is maybe a c++ thing I haven’t seen before?
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:16 PM
well, it's not only in C++
s

seph

11/21/2019, 10:16 PM
Sure.
10:16 PM
But if we do all the table registration in the global init phase, then there’s probably no clean way in.
10:17 PM
I guess I could make this: • a build time option • an environmental variable switch • change registration ordering • add a de-register function
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:18 PM
well yeah, to be fair it would've been nicer if the only thing that happens in global init is collecting functions that can initialize something, more than actually initializing anything. That been said yes, they get initialized anyway but in theory you could make them unreachable by removing them later from the registry
s

seph

11/21/2019, 10:19 PM
Moving it out of global init seems nice, but also a deeper change than I think I can do quickly.
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:20 PM
ah sure; just saying that global init is a bit finicky, especially in the init and deinit order (which is "unknown")
s

seph

11/21/2019, 10:20 PM
Yeah.
10:20 PM
Okay, maybe I’ll look at making a de-register function.
10:20 PM
Thank you for walking me through some of this.
10:21 PM
Having actual code, but that’s running in an init phase is new to me
Stefano Bonicatti

Stefano Bonicatti

11/21/2019, 10:22 PM
Yeah, it's a "trick" that uses class constructors as functions to do things.. since initializing a variable, if that variable is a C++ class, means constructing it.
10:27 PM
And well, with C++ it's also easy enough to have code that runs at compile time with constexpr so..