diff --git a/osquery/tables/events/linux/seccomp_events.h b/osquery/tables/events/linux/seccomp_events.h index 104506db8e2..7b19fa7edac 100644 --- a/osquery/tables/events/linux/seccomp_events.h +++ b/osquery/tables/events/linux/seccomp_events.h @@ -42,14 +42,14 @@ class SeccompEventSubscriber final : public EventSubscriber { /// Mapping from seccomp action codes from seccomp.h to seccomp action names static const std::unordered_map - seccomp_actions_map; + kSeccompActionsMap; /// Mapping from architecture codes from audit.h to architecture names - static const std::unordered_map arch_codes_map; + static const std::unordered_map kArchCodesMap; /// Mapping from system call numbers to system call names for x86_64 static const std::unordered_map - syscall_x86_64_map; + kSyscallX8664Map; static void parseEvent(const AuditEvent& event, Row& parsed_event) noexcept; diff --git a/osquery/tables/system/windows/windows_search.cpp b/osquery/tables/system/windows/windows_search.cpp index 57aa320491c..cdab83f229e 100644 --- a/osquery/tables/system/windows/windows_search.cpp +++ b/osquery/tables/system/windows/windows_search.cpp @@ -35,27 +35,27 @@ namespace osquery { namespace tables { -const std::string windowsSearchTableName = "windows_search"; +const std::string kWindowsSearchTableName = "windows_search"; LONGLONG dateToUnixTime(const DATE date) { SYSTEMTIME st = {0}; FILETIME ft = {0}; if (!VariantTimeToSystemTime(date, &st)) { - LOG(ERROR) << windowsSearchTableName + LOG(ERROR) << kWindowsSearchTableName << ": failed to convert date to system time"; return 0; } if (!SystemTimeToFileTime(&st, &ft)) { - LOG(ERROR) << windowsSearchTableName + LOG(ERROR) << kWindowsSearchTableName << ": failed to convert system time to file time"; return 0; } LONGLONG unixtime = filetimeToUnixtime(ft); if (unixtime == 0) { - LOG(ERROR) << windowsSearchTableName + LOG(ERROR) << kWindowsSearchTableName << ": failed to convert file time to unix time"; return 0; } @@ -72,7 +72,7 @@ void writePropVariant(REFPROPVARIANT variant, std::wstringstream& wss) { SafeArrayAccessData(variant.parray, reinterpret_cast(&pBStr)); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": SafeArrayAccessData failed"; + LOG(ERROR) << kWindowsSearchTableName << ": SafeArrayAccessData failed"; return; } @@ -220,7 +220,7 @@ osquery::QueryData executeWindowsSearchQuery(CSession& cSession, hr = cCommand.Open(cSession, query.c_str()); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": error executing query"; + LOG(ERROR) << kWindowsSearchTableName << ": error executing query"; return results; } @@ -256,7 +256,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&pSearchManager)); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName + LOG(ERROR) << kWindowsSearchTableName << ": failed to create ISearchManager instance"; return ""; } @@ -269,7 +269,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, // the ISearchCatalogManager hr = pSearchManager->GetCatalog(L"SystemIndex", &pSearchCatalogManager); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": failed to get catalog manager"; + LOG(ERROR) << kWindowsSearchTableName << ": failed to get catalog manager"; return ""; } auto const pSearchCatalogManagerGuard = scope_guard::create( @@ -280,7 +280,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, ISearchQueryHelper* pQueryHelper = nullptr; hr = pSearchCatalogManager->GetQueryHelper(&pQueryHelper); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": failed to get query helper"; + LOG(ERROR) << kWindowsSearchTableName << ": failed to get query helper"; return ""; } auto const pQueryHelperGuard = @@ -288,7 +288,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, hr = pQueryHelper->put_QueryMaxResults(maxResults); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": failed to set max results"; + LOG(ERROR) << kWindowsSearchTableName << ": failed to set max results"; return ""; } @@ -309,7 +309,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, hr = pQueryHelper->put_QuerySelectColumns( stringToWstring(selectColumns).c_str()); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": failed to set columns"; + LOG(ERROR) << kWindowsSearchTableName << ": failed to set columns"; return ""; } } @@ -317,7 +317,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, if (!sort.empty()) { hr = pQueryHelper->put_QuerySorting(stringToWstring(sort).c_str()); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": failed to set sort"; + LOG(ERROR) << kWindowsSearchTableName << ": failed to set sort"; return ""; } } @@ -326,7 +326,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput, hr = pQueryHelper->GenerateSQLFromUserQuery( stringToWstring(userInput).c_str(), &sql); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName + LOG(ERROR) << kWindowsSearchTableName << ": failed to generate SQL from user query"; return ""; } @@ -347,7 +347,7 @@ QueryData genWindowsSearch(QueryContext& context) { L"provider=Search.CollatorDSO.1;EXTENDED " L"PROPERTIES=\"Application=Windows\""); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": error initializing CDataSource"; + LOG(ERROR) << kWindowsSearchTableName << ": error initializing CDataSource"; return results; } auto const cDataSourceGuard = @@ -356,7 +356,7 @@ QueryData genWindowsSearch(QueryContext& context) { CSession cSession; hr = cSession.Open(cDataSource); if (FAILED(hr)) { - LOG(ERROR) << windowsSearchTableName << ": error opening CSession"; + LOG(ERROR) << kWindowsSearchTableName << ": error opening CSession"; return results; } auto const cSessionGuard = @@ -476,3 +476,4 @@ QueryData genWindowsSearch(QueryContext& context) { } // namespace tables } // namespace osquery + diff --git a/osquery/utils/system/windows/errno.cpp b/osquery/utils/system/windows/errno.cpp index f41535aacb5..ed48fa68aa7 100644 --- a/osquery/utils/system/windows/errno.cpp +++ b/osquery/utils/system/windows/errno.cpp @@ -10,16 +10,17 @@ #include #include +#include #include -#define MAX_BUFFER_SIZE 256 +constexpr std::size_t kMaxBufferSize = 256; namespace osquery { const auto kWindowsLanguageId = MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT); std::string platformStrerr(int errnum) { std::vector buffer; - buffer.assign(MAX_BUFFER_SIZE, '\0'); + buffer.assign(kMaxBufferSize, '\0'); auto status = ::strerror_s(buffer.data(), buffer.size(), errnum); if (status != 0) { @@ -57,3 +58,4 @@ Status getWindowsErrorDescription(std::wstring& error_message, DWORD error_id) { } } // namespace osquery +