Do not add (self) events for FSEvents · TomA-R/osquery@db3782b · GitHub

TomA-R / osquery Public

forked from osquery/osquery

• Notifications You must be signed in to change notification settings
• Fork 0
• Star 0

• Code
• Pull requests
• Actions
• Projects
• Wiki
• Security and quality
• Insights

Additional navigation options

Commit db3782b

Browse filesBrowse the repository at this point in the historyBrowse files

Teddy Reed

committed

Do not add (self) events for FSEvents

1 parent d379264 commit db3782b
Copy full SHA for db3782b

3 files changed

+22-4Lines changed: 22 additions & 4 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• osquery/events/darwin
  • fsevents.cpp
  • fsevents.h
  • tests
    • fsevents_tests.cpp

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎osquery/events/darwin/fsevents.cpp‎

Copy file name to clipboardExpand all lines: osquery/events/darwin/fsevents.cpp

+12-4Lines changed: 12 additions & 4 deletions

Original file line number	Diff line number	Diff line change
@@ -82,16 +82,24 @@ void FSEventsEventPublisher::restart() {
82	82	// Remove any existing stream.
83	83	stop();
84	84
85		- // Create the FSEvent stream
	85	+ // Set stream flags.
	86	+ auto flags =
	87	+ kFSEventStreamCreateFlagFileEvents | kFSEventStreamCreateFlagWatchRoot;
	88	+ if (no_defer_) {
	89	+ flags |= kFSEventStreamCreateFlagNoDefer;
	90	+ }
	91	+ if (no_self_) {
	92	+ flags |= kFSEventStreamCreateFlagIgnoreSelf;
	93	+ }
	94	+
	95	+ // Create the FSEvent stream.
86	96	stream_ = FSEventStreamCreate(nullptr,
87	97	&FSEventsEventPublisher::Callback,
88	98	nullptr,
89	99	watch_list,
90	100	kFSEventStreamEventIdSinceNow,
91	101	1,
92		- kFSEventStreamCreateFlagFileEvents |
93		- kFSEventStreamCreateFlagNoDefer |
94		- kFSEventStreamCreateFlagWatchRoot);
	102	+ flags);
95	103	if (stream_ != nullptr) {
96	104	// Schedule the stream on the run loop.
97	105	FSEventStreamScheduleWithRunLoop(stream_, run_loop_, kCFRunLoopDefaultMode);

Collapse file

‎osquery/events/darwin/fsevents.h‎

Copy file name to clipboardExpand all lines: osquery/events/darwin/fsevents.h

+8Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -144,8 +144,16 @@ class FSEventsEventPublisher
144	144	/// Set of paths to monitor, determined by a configure step.
145	145	std::set<std::string> paths_;
146	146
	147	+ /// Reference to the run loop for this thread.
147	148	CFRunLoopRef run_loop_{nullptr};
148	149
	150	+ private:
	151	+ /// For testing only, ask the event stream to publish events immediately.
	152	+ bool no_defer_{false};
	153	+
	154	+ /// For testing only, allow the event stream to publish its own events.
	155	+ bool no_self_{true};
	156	+
149	157	private:
150	158	friend class FSEventsTests;
151	159	FRIEND_TEST(FSEventsTests, test_register_event_pub);

Collapse file

‎osquery/events/darwin/tests/fsevents_tests.cpp‎

Copy file name to clipboardExpand all lines: osquery/events/darwin/tests/fsevents_tests.cpp

+2Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -40,6 +40,8 @@ class FSEventsTests : public testing::Test {
40	40
41	41	void StartEventLoop() {
42	42	event_pub_ = std::make_shared<FSEventsEventPublisher>();
	43	+ event_pub_->no_defer_ = true;
	44	+ event_pub_->no_self_ = false;
43	45	EventFactory::registerEventPublisher(event_pub_);
44	46	FILE* fd = fopen(trigger_path.c_str(), "w");
45	47	fclose(fd);

0 commit comments

Comments

0 (0)