-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Tightening up the eventing publisher #3917
Conversation
osquery/events/darwin/event_taps.cpp
Outdated
EventFactory::fire<EventTappingEventPublisher>(ec); | ||
return event; | ||
EventFactory::fire<EventTappingEventPublisher>(createEventContext()); | ||
/// If you change from listenOnly, return event or you will drop all events |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You don't need ///
just //
osquery/events/darwin/event_taps.cpp
Outdated
CFRunLoopRemoveSource(run_loop_, run_loop_source_, kCFRunLoopCommonModes); | ||
CFRelease(run_loop_source_); | ||
run_loop_source_ = nullptr; | ||
if (runLoopSource_ != nullptr) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You should use snake case for local member variables, but we don't enforce it.
osquery/events/darwin/event_taps.cpp
Outdated
kCGEventTapOptionListenOnly, | ||
(1 << kCGEventKeyDown), | ||
eventCallback, | ||
NULL); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should the NULL
be a nullptr
?
osquery/events/darwin/event_taps.cpp
Outdated
run_loop_ = nullptr; | ||
|
||
if (eventTap_ != nullptr) { | ||
CGEventTapEnable(eventTap_, false); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should you do this "disable" before removing the source? Not sure, just curious?
6bf2afa
to
2dd3222
Compare
@obelisk has updated the pull request. |
2dd3222
to
5c8e5cf
Compare
@obelisk has updated the pull request. |
5c8e5cf
to
2ae754f
Compare
@obelisk has updated the pull request. |
Tighten up the event tapping event publisher code. This should hopefully make the code more stable and better equip it to handle edge cases.