facebook/osquery — pull request #562 by theopolis (2014-12-24 04:16:21+00:00)
Title: Plugins Refactor: Towards external plugins

This is a refactor of CMake and libosquery (statically complied library including symbols from third party library dependencies). At the base this allows a compile of libosquery without table-specific link/header requirements.

It's possible to build a FAT libosquery statically linking most dependencies as well ALL osquery core and ALL osquery core tables. It will be recommended to build a LEAN libosquery statically linking most dependencies, ALL osquery core, and ONLY the utility tables.

osquery distributions will include the FAT libosquery + the ability to late-load (aka load plugins). Development environments MAY include a LEAN libosquery + the spec and implementation specific to the external table or set of plugins under development. The main change so far is a selective generate/build of the these spec/impl codes. Adding more logic to CMake will allow the external plugin developer to build using the core osquery build tooling and "trigger" on a well-formed path to their tables directory.

Note: config/logger plugins must still be written within the osquery code codebase. Logic to modify their respective registries will come organically with the table registry modifications but building in an external directory/repo is not yet encouraged/planned.