Hello, is there a configuration parameter that den...
# general
j
Hello, is there a configuration parameter that denies osquery to use any extensions?
s
there is the
--disable_extensions
flag — which disables the extension APIs in osquery
j
thanks
Can access to extension be managed? I mean some extension may provide sensitive data that shouldn't be accessible to anybody performing a query against osquery.
s
Apologies, I am not sure I follow your question exactly..osquery by itself doesn’t bundle or link any extensions. If one is linking other external extensions, then it’s upto the person linking the extension to determine whether it provides any sensitive data
j
as osquery is used by a multitude of applications, you may have several extensions installed on one server, each extension for different app. So the apps shouldn't be allowed to peek into data tables of other apps.
s
as osquery is used by a multitude of applications
that kinda depends on the vendor bundling the osquery inside of their apps
if you control the configuration, then you can use the
--disable_extensions
and
--disable_tables
and
--enable_tables
flags to fine tune it
j
i was rather thinking about some authentication mechanism to query particular tables.
s
osquery itself doesn’t have any way to do that
the TLS server/manager could potentially have that logic, but again I am not aware of any
j
thanks
s
Osquery does have have any internal users, acls, rbac, or similar. Access is to everything or nothing.