https://github.com/osquery/osquery logo
Title
d

Daniel Cross

03/16/2023, 5:17 AM
Anyone know if there is an
rpm --verify
type of capability with OSQuery? I think not but maybe I’m missing a way to do this. Could be a good first contribution task for me 🤔 http://ftp.rpm.org/max-rpm/ch-rpm-verify.html
s

seph

03/18/2023, 2:44 AM
I don’t know if there’s a table quite like rpm verify. There is a
rpm_package_files
and a
rpm_packages
table. I suspect one could construct SQL to use the sha from
rpm_package_files
, the file table, and the
hash
table to create that functionality. I have no idea how performant it would be. As a side note, osquery does not shell out to collect information.
d

Daniel Cross

03/20/2023, 4:34 AM
I’ll have a play and see what I can do. Mostly collecting that info into OpenSearch so may be able to pull together similar or better using this plus FIM.