On linux it looks like the process_open_sockets implementation (https://github.com/osquery/osquery/blob/master/osquery/tables/networking/linux/process_open_sockets.cpp#L21-L29) does support pid as a constraint. So the question might just be how to get sqlite to use it.