Skip to content

Latest commit

 

History

History
228 lines (174 loc) · 20.2 KB

CHANGELOG.md

File metadata and controls

228 lines (174 loc) · 20.2 KB
Raw

4.1.2

Git Commits

New Features / Under the Hood improvements

  • Add more tests throughout the codebase (#5908), (#6071), (#6126)
  • The chrome_extensions table now supports Chromium and Brave (#6126)

Build

  • Require Python 3.5 and greater (#6081), (#6120)
  • Prepare Python tests for CI (lots of effort!) (#6068)
  • Restore osqueryd integration test (#6116)

Bug Fixes

  • Continue to use com.facebook.osquery.plist for Launch Daemon configuration (#6093)
  • Update systemd service to use KillMode=control-group (#6096)
  • RPM and DEB packages both have post-install scripts to reload systemd (#6097)
  • Update Windows package build script to include cert bundle (#6114)
  • Update table specs to fix constraints passing (#6103), (#6104), (#6105), (#6106), (#6122)

Table Changes

  • Added tables azure_instance_tags and azure_instance_metadata to Linux and Microsoft Windows (#5434)
  • Added column install_time (INTEGER_TYPE) to table rpm_packages (#6113)
  • Added column bsd_flags (TEST_TYPE) to table file on Darwin (#5981)

4.1.1

Git Commits

New Features / Under the Hood improvements

  • Improve nvram table to use input variable names (#6053)
  • Improve apt_sources source detection (#6047)
  • Change atom_packages to use user constraints (#6052)
  • Re-enable required-column warning messages (#6038)

Build

  • Migrate several libraries to the CMake source layer (#5902), (#6023)
  • Update SQLite from 3.29.0-3 to 3.30.1-1 (#6020)
  • Recommend building with MacOS 10.11 SDK (#6000)

Bug Fixes

  • Fix Linux audit incorrect read and handle leak (#5959)
  • Change "logNumericsAsNumbers" to "numerics" logger top-level key (#6002)
  • Restore INDEX behavior for extensions (#6006)
  • Fix potential JSON parsing issues in ATC plugin (#6029)
  • Avoid scanning special files with YARA (#5971)
  • Fix use-after-move in YARA subscriber (#6054)
  • Handle relative redirects in internal HTTP clients (#6049)
  • Apply options config parsing before others (#6050)

Table Changes

  • Added table windows_optional_features to Microsoft Windows #5991)

4.1.0

Git Commits

New Features / Under the Hood improvements

Build

Hardening

Bug Fixes

  • Set Windows MSI ErrorControl to normal instead of critical (#5818)
  • Wrap flagfile with quotes for Windows install flag (#5824)
  • Improve submodule usages in CMake (#5850), (#5880), (#5892), (#5897), (#5907)
  • Improve locking support in internal APIs (#5841), (#5906), (#5943), (#5944)
  • Fixes for macOS application layer firewall tables (#5378)
  • Fixes within BPF event tables (#5874)
  • Refactor and improve PCI device tables on Linux (#5446)
  • Implement PID indexing on Windows processes table (#5919)
  • Improve WHERE IN() performance (#5924), (#5938)
  • Improve the internal HTTP client (#5891), (#5946), (#5947)
  • Fix Windows version codename lookup (#5887)

Table Changes

  • Added table alf_services to Darwin (Apple OS X) (#5378)
  • Added table connectivity to Microsoft Windows (#5500)
  • Added table default_environment to Microsoft Windows (#5441)
  • Added table windows_security_products to Microsoft Windows (#5479)
  • Added column platform_mask (INTEGER_TYPE) to table osquery_info (#5898)

4.0.2

This release fixes crashes identified in 4.0.1. There are no changes in functionality.

Git Commits

Bug Fixes

  • Fix configuration of AWS libraries to address crash in Linux (#5799)
  • Remove RocksDB optimization causing crash (#5797)

4.0.1

This release has two major focuses. It is the first release since osquery transitioned to a Linux Foundation project.

It features a heavily reworked build system. This aims to provide flexibility and stability.

Git Commits

New Features / Under the Hood improvements

  • Linux Audit process_events Implement support for fork/vfork/clone/execveat (#5701)
  • New SQLite function regex_match to match across columns (#5444)
  • LRU cache for syscall tracing (#5521)
  • Basic tracing via eBPF on Linux (#5403, #5386, #5384)
  • Experimental kill and setuid syscall tracing in Linux via eBPF (#5519)
  • New eventing (ev2) framework (#5401)
  • Improved table performance profiles (#5187)
  • macOS query pack: detect SearchAwesome malware (#5713)
  • macOS query pack: detect when a process is tapping keyboard event (#5345)

Build

Harderning

  • Link binaries with Full RELRO on Linux (#5748)
  • Remove FTS features from SQLite (#5703) (#5702)
  • Fix SQLite API usage errors (#5551)
  • Fix issues reported by ASAN (#5665)
  • Handle bad FDs in md_tables (#5553)
  • Fix lock resource leak in events/syslog (#5552)
  • Fix memory leak in macOS keychain_items and extended_attributes tables (#5550, #5538)
  • Fix memory leak in genLoggedInUsers (Windows). Update WTSFreeMemoryEx to WTSFreeMemory (#5642)
  • Fix potential null dereferences in smbios_tables (#5332)
  • Fix osquery exiting with wrong status (3824c2e6)
  • Add additional install and uninstall flag incompatibility check (85eb77a0)
  • Fix warning with constants initialisation in magic (2a624f2f)
  • Fix sign compare warning in file_compression (b93069b3)
  • Refactored logical_drives table on Windows (#5400)
  • Refactored core/windows/wmi to use smart pointers (#5492)
  • Fixed various potential crashes in the virtual table implementaion (6ade85a5)
  • Increase the amount of MaxRecvRetries for Thrift sockets (#5390)

Bug Fixes

  • Fix the reading of the serial of a certificate (little-endian big int) (#5742)
  • Fix bugs and update pathname variables in MSI package build script (#5733)
  • Fix registry table exception closing an uninitialized key handle (#5718)
  • Config views are now recreated on startup (#5732)
  • Change MSI Service Error handling on Windows (#5467)
  • Allow mounting SQLite DBs using WAL journaling with ATC (#5525, #5633)
  • Fix mount table interacting with direct autofs (#5635)
  • Fix HTTP Host Header to include port (#5576)
  • Various fixes to the Windows certificates table and expansion to include Personal certificates (#5697), (#5696), (#5640), (#5631)
  • Add optimization back to macOS users and groups (#5684)
  • Do not return a row for macOS battery if no data is present (#5650)
  • Fix several integer conversions in process_ops (#5614)
  • Include weekends on the kernel_panics table (#5298)
  • Fix key_strength bug for Windows certificates table (#5304)
  • The interface column of routes table could be empty on Windows (bcf0ab8e)
  • The name column of programs table could be empty on Windows (7bceba4b)
  • Fix disable_watcher flag (08dc11b7)
  • Populate path column correctly in firefox_addons table (#5462)
  • Fix numeric monitoring plugin not being registered (#5484)
  • Fix wrong error code returned when querying the Windows registry (#5621)
  • Fix logical_drives boot partition detection (#5477)
  • Replace sync calls by async within the HTTP client implementation (#5606)
  • Fix RocksDB crash related to OptimizeForSmallDb (a31d7582)
  • Fix bug in table column data validator (e3037331)
  • Fix random port problem (a32ed7c4)
  • Refactor battery table and return information even if advanced information is missing (6a64e353)

Table Changes

  • Added table ibridge_info on macOS (Notebooks only) (#5707)
  • Added table running_apps on macOS (#5216)
  • Added table atom_packages on macOS and Linux (6d159d40)
  • Remove EC2 tables on Windows (#5657)
  • Added column win_timestamp to time table on Windows (3bbe6c51)
  • Added column is_hidded to users and groups table on macOS (#5368)
  • Added column profile to chrome_extensions table (#5213)
  • Added column epoch to rpm_packages table on Linux (#5248)
  • Added column sid to logged_in_users table on Windows (#5454)
  • Added column registry_hive to logged_in_users table on Windows (#5454)
  • Added column sid to certificates table on Windows (#5631)
  • Added column store_location to certificates table on Windows (#5631)
  • Added column store to certificates table on Windows (#5631)
  • Added column username to certificates table on Windows (#5631)
  • Added column store_id to certificates table on Windows (#5631)
  • Added column product_version to file table on Windows (#5431)
  • Added column source to sudoers table on POSIX systems (#5350)