예제 #1
0
bool addUniqueRowToQueryData(QueryData& q, const Row& r) {
  if (std::find(q.begin(), q.end(), r) != q.end()) {
    return false;
  }
  q.push_back(r);
  return true;
}
예제 #2
0
파일: results.cpp 프로젝트: Daheon/osquery
DiffResults diff(const QueryData& old_, const QueryData& new_) {
  DiffResults r;
  QueryData overlap;

  for (const auto& i : new_) {
    auto item = std::find(old_.begin(), old_.end(), i);
    if (item != old_.end()) {
      overlap.push_back(i);
    } else {
      r.added.push_back(i);
    }
  }

  std::multiset<Row> overlap_set(overlap.begin(), overlap.end());

  std::multiset<Row> old_set(old_.begin(), old_.end());

  std::set_difference(old_set.begin(),
                      old_set.end(),
                      overlap_set.begin(),
                      overlap_set.end(),
                      std::back_inserter(r.removed));

  return r;
}
예제 #3
0
QueryData pidsFromContext(const QueryContext& context, bool all) {
  QueryData procs;
  if (context.hasConstraint("pid", EQUALS)) {
    context.forEachConstraint(
        "pid", EQUALS, ([&procs](const std::string& expr) {
          auto proc = SQL::selectAllFrom("processes", "pid", EQUALS, expr);
          procs.insert(procs.end(), procs.begin(), procs.end());
        }));
  } else if (!all) {
    procs = SQL::selectAllFrom(
        "processes", "pid", EQUALS, std::to_string(platformGetPid()));
  } else {
    procs = SQL::selectAllFrom("processes");
  }
  return procs;
}
예제 #4
0
QueryData genShellHistory(QueryContext& context) {
  QueryData results;

  // Select only the home directory for this user.
  QueryData users;
  if (!context.constraints["username"].exists(EQUALS)) {
    users =
        SQL::selectAllFrom("users", "uid", EQUALS, std::to_string(getuid()));
  } else {
    auto usernames = context.constraints["username"].getAll(EQUALS);
    for (const auto& username : usernames) {
      // Use a predicated select all for each user.
      auto user = SQL::selectAllFrom("users", "username", EQUALS, username);
      users.insert(users.end(), user.begin(), user.end());
    }
  }

  // Iterate over each user
  for (const auto& row : users) {
    if (row.count("username") > 0 && row.count("directory") > 0) {
      genShellHistoryForUser(row.at("username"), row.at("directory"), results);
    }
  }

  return results;
}
예제 #5
0
QueryData usersFromContext(const QueryContext& context, bool all) {
  QueryData users;
  if (context.hasConstraint("uid", EQUALS)) {
    context.forEachConstraint(
        "uid", EQUALS, ([&users](const std::string& expr) {
          auto user = SQL::selectAllFrom("users", "uid", EQUALS, expr);
          users.insert(users.end(), user.begin(), user.end());
        }));
  } else if (!all) {
    users = SQL::selectAllFrom(
        "users", "uid", EQUALS, std::to_string(platformGetUid()));
  } else {
    users = SQL::selectAllFrom("users");
  }
  return users;
}
예제 #6
0
QueryData genEtcHosts(QueryContext& context) {
  std::string content;
  QueryData qres = {};

  if (readFile(kEtcHosts, content).ok()) {
    qres = parseEtcHostsContent(content);
  }

#ifdef WIN32
  content.clear();
  QueryData qres_ics = {};
  if (readFile(kEtcHostsIcs, content).ok()) {
    qres_ics = parseEtcHostsContent(content);
    qres.insert(qres.end(), qres_ics.begin(), qres_ics.end());
  }
#endif

  return qres;
}