Hello, is there a configuration parameter that den...
# generalj
JanRC
08/16/2023, 10:33 AMHello, is there a configuration parameter that denies osquery to use any extensions?
s
sharvil
08/16/2023, 10:38 AMthere is the
--disable_extensionsj
JanRC
08/16/2023, 10:39 AMthanks
JanRC
08/16/2023, 10:40 AMCan access to extension be managed? I mean some extension may provide sensitive data that shouldn't be accessible to anybody performing a query against osquery.
s
sharvil
08/16/2023, 10:51 AMApologies, I am not sure I follow your question exactly..osquery by itself doesn’t bundle or link any extensions. If one is linking other external extensions, then it’s upto the person linking the extension to determine whether it provides any sensitive data
j
JanRC
08/16/2023, 10:53 AMas osquery is used by a multitude of applications, you may have several extensions installed on one server, each extension for different app. So the apps shouldn't be allowed to peek into data tables of other apps.
s
sharvil
08/16/2023, 10:58 AMas osquery is used by a multitude of applicationsthat kinda depends on the vendor bundling the osquery inside of their apps
sharvil
08/16/2023, 10:59 AMif you control the configuration, then you can use the
--disable_extensions--disable_tables--enable_tablesj
JanRC
08/16/2023, 11:00 AMi was rather thinking about some authentication mechanism to query particular tables.
s
sharvil
08/16/2023, 11:02 AMosquery itself doesn’t have any way to do that
sharvil
08/16/2023, 11:03 AMthe TLS server/manager could potentially have that logic, but again I am not aware of any
j
JanRC
08/16/2023, 11:16 AMthanks
s
seph
08/16/2023, 11:26 AM
Osquery does have have any internal users, acls, rbac, or similar. Access is to everything or nothing.