Oops. 5.10 broke `magic`:
```pemberton:updates sep...
# cores
seph
10/25/2023, 2:37 PM
Oops. 5.10 broke `magic`:
Copy code
pemberton:updates seph$ ./osqueryd/5.9.1/osqueryd -S 'SELECT * FROM magic WHERE path="/bin/ls"'
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
| path | magic_db_files | data | mime_type | mime_encoding |
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
| /bin/ls | /usr/share/file/magic.mgc:/usr/share/misc/magic.mgc | Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e] | application/x-mach-binary | (null)(null)binary |
+---------+-----------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------+---------------------------+--------------------+
pemberton:updates seph$ ./osqueryd/5.10.2/osqueryd -S 'SELECT * FROM magic WHERE path="/bin/ls"'
/usr/share/file/magic.mgc, 1: Warning: offset `?' invalid
Version=' invalidagic.mgc, 2: Warning: offset `
/usr/share/file/magic.mgc, 3: Warning: offset `' invalid
/usr/share/file/magic.mgc, 6: Warning: offset `Firmware v' invalid
/usr/share/file/magic.mgc, 12: Warning: offset `' invalid
Corel Corporation' invalid 13: Warning: offset `s
Stefano Bonicatti
10/25/2023, 2:38 PMNot really, the magic table is sort of broken since a while
Stefano Bonicatti
10/25/2023, 2:38 PMthe problem is that the magic file we have to use is not from the system, because its format is connected to the libmagic version
Stefano Bonicatti
10/25/2023, 2:39 PMThe magic table has to be changed to enable a custom path for magic files, and then we have to ship the magic file that comes with the library
Stefano Bonicatti
10/25/2023, 2:39 PMThere should be an issue open already
Stefano Bonicatti
10/25/2023, 2:40 PM(oh you've found it)
s
seph
10/25/2023, 2:46 PM
Yeah,. that issue made it pretty clear that the underlying cause is that our statically linked libmagic diverges from the OS distributed database.
seph
10/25/2023, 2:47 PM
I wonder what the right answer is. The only other table that requires something outside the bare osquery binary is augeas. So it feels a little weird to suddenly require a separate DB.
seph
10/25/2023, 2:48 PM
I wonder if we want to prepend an osquery path to the stock path. Then either you get the osquery one, or you get the system one, if it works
seph
10/25/2023, 2:48 PM
Yuck.
seph
10/25/2023, 2:52 PM
This file 🙄 It has entries to identify what area your Quake 1 save file is from.
👌 1
s
Stefano Bonicatti
10/25/2023, 2:52 PMAh yeah, it's a collection of everything and more haha
Stefano Bonicatti
10/25/2023, 3:40 PMI forgot that the table already accepts
magic_db_filesStefano Bonicatti
10/25/2023, 3:40 PMPutting them under our
shareStefano Bonicatti
10/25/2023, 3:53 PMThe alternative is less battery included (if we fear that people will question that dependency); we can still ship the file but to work the table then needs that constraint to pass the files (or a flag that points to a folder). Meaning there's no default file being used. That is obviously a breaking change.
s
seph
10/26/2023, 12:08 PM
I think we should follow the pattern from augeas. And also move conversation to GitHub 🙂
5 Views