« Changelog History


OSQuery v5.0.1 Release Notes

  • Git Commits

    Representing commits from 21 contributors! Thank you all.

    🚀 osquery 5.0 is a tremendously exciting release!

    • 🍎 We now install into /opt/osquery on macOS and Linux for better portability.
    • 🍎 Our default and recommended installation for macOS uses an application bundle to support entitlement-based features.
    • 🔒 We now use Endpoint Security APIs for various event-based tables on macOS (more to come in the future!)
    • 🍎 We now use an osquery-organization macOS code signing certificate.

    There are several breaking changes:

    • 🍎 Installation paths have changes from /usr/local to /opt/osquery on macOS and Linux (symlinks to executables are provided).
    • 🍎 macOS codesigning is now down through the Osquery Foundation account
    • ⚡️ If you manage macOS full disk permission through a profile, you will need to update it. See docs
    • 🔧 We removed the deprecated blacklist key from the configuration (#7153)
    • Search semantics on the augeas table have changed to be more performant, but do break the existing query API.

    Table Changes

    • ➕ Add secureboot table for Linux and Windows (#7202)
    • ➕ Add tpm_info for Windows (#7107)
    • 🏗 Fix osquery_info build_platform column value on Linux (#7254)
    • Support pid_with_namespace in more tables (#7132)
    • ⚡️ Update augeas table to use native pattern matching (BREAKING) (#6982)
    • ⚡️ Update chrome_extensions to include Edge & EdgeBeta (#7170)
    • ⚡️ Update disk_encryption table to support QueryContext (#7209)
    • ⚡️ Update last to include utmp type name column (#7201)
    • ⚡️ Update sudoers table to support newer include syntax (#7185)
    • Update user_ssh_keys to detect encryption of ed25519 keys (#7168)

    Under the Hood Improvements

    • ➕ Add ruby namespace to the thrift definition (#7191)
    • 🐎 Always initialize variable change in PerformanceChange (#7176)
    • ✂ Remove deprecated blacklist key (#7153)
    • 🏁 Use total_size within watchdog on Windows (#7157)
    • 👌 Support AF_PACKET sockets reporting on Linux (#7282)
    • 🐧 socket_events improvements in Linux audit system (#7269)

    🐛 Bug Fixes

    • ➕ Add case sensitive pragma to the pragma/actions authorizer allow list (#7267)
    • ➕ Add feature to skip denylist for event-based queries (#7158)
    • 🔄 Change logger_mode flag to be correctly interpreted as an octal (#7273)
    • Do not let osquery create multiple copies of the extension running at once (#7178)
    • 🛠 Fix Linux audit rule removal upon osquery exit (#7221)
    • 🛠 Fix broadcasting empty logs to logger plugins (#7183)
    • 🛠 Fix issues applying ACLs during chocolatey deployment (#7166)
    • 🛠 Fix memory issue in Windows fileops (#7179)
    • Fix process_open_sockets type error on darwin (#6546)
    • 🚚 Make sure that the file action MOVED_TO is tracked with yara events. (#7203)
    • Prevent osquery from killing itself when the --force flag is used (#7295)
    • 👷 Prevent race condition between shutdown and worker or extension launch (#7204)

    📚 Documentation

    • ➕ Add a security assurance case (#7048)
    • Bring the YARA wiki page up to date (#7172)
    • 🛠 Spelling fixes (#7211, #7186)
    • ⚡️ Update uptime table description (#7270)
    • 📚 Update osquery installed artifacts paths in the documentation (#7286)

    🏗 Build

    • ➕ Add TimeoutStopSec to systemd service files (#7190)
    • 🍎 Correct macOS installed app bundle path in osqueryctl and doc (#7289)
    • 🍎 Create an macOS app bundle (#7263)
    • 🛠 Fix choco packaging not failing when an error occurs during install or upgrade (#7182)
    • 🛠 Fix path in macOS launchd plist (#7288)
    • 📌 Pin the packaging repo within GitHub workflows (#7208, #7255, #7279)
    • 🚀 Update Windows deployment icon to png (#7163)
    • ⚡️ Update install paths, and remove deprecated Facebook naming (#7210)
    • ⚡️ Update macOS build to include app bundle related files (#7184)
    • ⚡️ Update osquery installed artifacts default paths in code (#7285)
    • ⚡️ Update the installation path on Linux (#7271)
    • libs: Add options to AWS Optionally enable debug option and restrict content-type header size for PUT req (#7216)
    • 🍎 libs: Enable and compile the YARA macho module on macOS (#7174)
    • ⚡️ libs: Update OpenSSL to version 1.1.1l (#7293)
    • ⚡️ libs: Update Strawberry Perl to 5.32.1.1, use HTTPS downloads (#7199)
    • ⚡️ libs: Update ebpfpub (#7173, #7219)