class OsqueryManager final {
public:
- ~OsqueryManager(void) noexcept;
+ OsqueryManager(const OsqueryManager&) = delete;
+ OsqueryManager& operator=(const OsqueryManager&) = delete;
- OsqueryManager(const OsqueryManager &) = delete;
- OsqueryManager(OsqueryManager &&) = delete;
- OsqueryManager &operator=(const OsqueryManager &) = delete;
- OsqueryManager &operator=(OsqueryManager &&) = delete;
-
- static std::shared_ptr<OsqueryManager> Load();
-
- Rows execute(const std::string& query) const;
-
- std::vector<std::string> tables(void) const noexcept;
- std::vector<std::string> columns(const std::string& table) const noexcept;
+ /// TBD: Consider error handling.
+ static Rows execute(const std::string& query);
+ static std::vector<std::string> tables(void) noexcept;
+ static std::vector<std::string> columns(const std::string& table) noexcept;
private:
OsqueryManager();
+ ~OsqueryManager() noexcept;
+
+ static OsqueryManager& instance();
+
+ /// TODO(Sangwan): Apply pimpl idiom.
+ Rows executeInternal(const std::string& query) const;
+ std::vector<std::string> tablesInternal(void) const noexcept;
+ std::vector<std::string> columnsInternal(const std::string& table) const noexcept;
};
} // namespace osquery
// 1. Write query as std::string
std::string query = "SELECT subject_label, object_label FROM smack WHERE access_type = 'read'";
- // 2. Load OsqueryManager
- auto manager = OsqueryManager::Load();
+ // 2. Execute query by using OsqueryManager
+ auto rows = OsqueryManager::execute(query);
- // 3. Execute query by using OsqueryManager
- auto rows = manager->execute(query);
-
- // 4. Get result
+ // 3. Get result
for (const auto& row : rows) {
std::string slabel = row["subject_label"];
std::string olabel = row["object_label];
using namespace osquerypp;
// 1. Write callback function
- auto onDeny = [&](const EventContext& ec, const Row& row)
+ auto onDeny = [&](const EventContext& ec, const Row& row)
{
// get data of event table
std::cout << row["action"] << std::endl;
std::cout << row["object_label"] << std::endl;
}
- // 2. Load OsqueryManager
- auto manager = OsqueryManager::Load();
-
- // 3. Register callback with event_table by using OsqueryManager
- manager->subscribe("smack_deny_events", onDeny);
+ // 2. Register callback with event_table by using OsqueryManager
+ OsqueryManager::subscribe("smack_deny_events", onDeny);
```
if (!logDir.empty() && !(pathExists(logDir).ok()))
boost::filesystem::create_directories(logDir);
- // TODO(sangwan.kwon): Get debug mode at build time
+ // TODO(Sangwan): Get debug mode at build time
Flag::updateValue("verbose_debug", "true");
const char* cargv[] = {"tizen-osquery"};
osquery::shutdownOsquery();
}
-std::shared_ptr<OsqueryManager> OsqueryManager::Load()
+OsqueryManager& OsqueryManager::instance()
{
- static std::shared_ptr<OsqueryManager> manager(new OsqueryManager);
+ static OsqueryManager manager;
return manager;
}
-Rows OsqueryManager::execute(const std::string& query) const
+Rows OsqueryManager::execute(const std::string& query)
+{
+ LOG(INFO) << "Execute query: " << query;
+
+ return instance().executeInternal(query);
+}
+
+Rows OsqueryManager::executeInternal(const std::string& query) const
{
LOG(INFO) << "Execute query: " << query;
return results;
}
-std::vector<std::string> OsqueryManager::tables(void) const noexcept
+std::vector<std::string> OsqueryManager::tables(void) noexcept
+{
+ return instance().tablesInternal();
+}
+
+std::vector<std::string> OsqueryManager::columns(const std::string& table) noexcept
+{
+ return instance().columnsInternal(table);
+}
+
+std::vector<std::string> OsqueryManager::tablesInternal(void) const noexcept
{
return SQL::getTableNames();
}
-std::vector<std::string> OsqueryManager::columns(const std::string& table) const noexcept
+std::vector<std::string> OsqueryManager::columnsInternal(const std::string& table) const noexcept
{
std::stringstream query;
query << "SELECT * FROM " << table;
class ManagerTests : public testing::Test {};
-TEST_F(ManagerTests, test_manager_load) {
- auto manager = OsqueryManager::Load();
- EXPECT_TRUE(manager != nullptr);
-}
-
TEST_F(ManagerTests, test_manager_execute) {
- auto manager = OsqueryManager::Load();
-
std::string query = "SELECT * FROM time";
- auto rows = manager->execute(query);
+ auto rows = OsqueryManager::execute(query);
EXPECT_EQ(rows.size(), 1);
VLOG(1) << "[Test] time table rows:";
}
TEST_F(ManagerTests, test_manager_tables) {
- auto manager = OsqueryManager::Load();
- auto tables = manager->tables();
+ auto tables = OsqueryManager::tables();
EXPECT_TRUE(tables.size() > 0);
VLOG(1) << "[Test] Enabled tables:";
}
TEST_F(ManagerTests, test_manager_columns) {
- auto manager = OsqueryManager::Load();
- auto columns = manager->columns("time");
+ auto columns = OsqueryManager::columns("time");
EXPECT_TRUE(columns.size() > 0);
VLOG(1) << "[Test] Enabled columns of time table:";