Allow querying of kernel and filesystem drivers

[joshdhart]

Fixes #6852

Windows "Services" can be created as drivers too.
Currently osquery has no way to query info about File System Drivers or Kernel Drivers that are registered as "Services".
As the "drivers" table, rightly only includes Device Drivers.

Local testing done:

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT * FROM services WHERE name LIKE 'wof';"
+------+--------------------+-------------------------------------------+---------+-----+------------+-----------------+-------------------+------+-------------+-------------+--------------+
| name | service_type       | display_name                              | status  | pid | start_type | win32_exit_code | service_exit_code | path | module_path | description | user_account |
+------+--------------------+-------------------------------------------+---------+-----+------------+-----------------+-------------------+------+-------------+-------------+--------------+
| Wof  | FILE_SYSTEM_DRIVER | Windows Overlay File System Filter Driver | RUNNING | 0   | BOOT_START | 0               | 0                 |      |             |             |              |
+------+--------------------+-------------------------------------------+---------+-----+------------+-----------------+-------------------+------+-------------+-------------+--------------+

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT * FROM services WHERE name LIKE 'ws2ifsl';"
+---------+---------------+-----------------------------------------------------------------+---------+-----+--------------+-----------------+-------------------+------------------------------------------+-------------+--------------------+--------------+
| name    | service_type  | display_name                                                    | status  | pid | start_type   | win32_exit_code | service_exit_code | path                                     | module_path | description        | user_account |
+---------+---------------+-----------------------------------------------------------------+---------+-----+--------------+-----------------+-------------------+------------------------------------------+-------------+--------------------+--------------+
| ws2ifsl | KERNEL_DRIVER | Windows Socket 2.0 Non-IFS Service Provider Support Environment | RUNNING | 0   | SYSTEM_START | 0               | 0                 | \SystemRoot\system32\drivers\ws2ifsl.sys |             | Winsock IFS Driver |              |
+---------+---------------+-----------------------------------------------------------------+---------+-----+--------------+-----------------+-------------------+------------------------------------------+-------------+--------------------+--------------+

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT count(*) FROM services;"
+----------+
| count(*) |
+----------+
| 619      |
+----------+

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT count(*) FROM services WHERE service_type LIKE '%PROCESS%';"
+----------+
| count(*) |
+----------+
| 252      |
+----------+

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT count(*) FROM services WHERE service_type LIKE '%DRIVER%';"
+----------+
| count(*) |
+----------+
| 367      |
+----------+

C:\Source\osquery\build\osquery\RelWithDebInfo>osqueryi.exe "SELECT count(*) FROM services WHERE service_type LIKE 'unknown';"
+----------+
| count(*) |
+----------+
| 0        |
+----------+

• [?] Ensure your PR contains tests for the changes you're submitting.
  • all tests for the services table seem disabled. https://github.com/osquery/osquery/blob/master/tests/integration/tables/services.cpp

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: joshdhart / name: Josh Hartwell (c40493d, 62dfe36, 9707b1b, 9fffa6f)

[sharvilshah]

hey @joshdhart thanks for the PR! can you please run clang-format on the file? Once that check passes, that will make the CI trigger the other workflows.

[joshdhart]

hey @joshdhart thanks for the PR! can you please run clang-format on the file? Once that check passes, that will make the CI trigger the other workflows.

@sharvilshah CI checks are now passing.

[sharvilshah]

hey @joshdhart thanks for the PR! can you please run clang-format on the file? Once that check passes, that will make the CI trigger the other workflows.

@sharvilshah CI checks are now passing.

@joshdhart I have added this to the 5.10.0 milestone, and I will try and get this reviewed in a few days.

[joshdhart]

hey @joshdhart thanks for the PR! can you please run clang-format on the file? Once that check passes, that will make the CI trigger the other workflows.

@sharvilshah CI checks are now passing.

@joshdhart I have added this to the 5.10.0 milestone, and I will try and get this reviewed in a few days.

Any update on the review?