Wes
11/10/2021, 7:34 PMlist<map<string,string>>
data structures that represent the tables independently of sqlite. In particular, I'm looking into how JOIN
works. Any pointers would be much appreciated! Is there a primer on how tables work under the hood?zwass
11/10/2021, 7:42 PMseph
11/10/2021, 9:25 PMWes
11/11/2021, 2:11 AMbackdoor@backdoor-virtual-machine:~$ sudo osqueryi --line 'select * from disk_encryption where encrypted=1'
Configuration setting "devices/scan_lvs" unknown.
Configuration setting "devices/allow_mixed_block_sizes" unknown.
name = /dev/dm-0
uuid = 1dEYER-a40T-nn7k-UJ9V-PuYw-fTNI-WypOyE
encrypted = 1
type = aes-xts-plain64
encryption_status = encrypted
name = /dev/dm-1
uuid = 6da0cb49-fecc-4a12-877f-fa69428189c3
encrypted = 1
type = aes-xts-plain64
encryption_status = encrypted
name = /dev/dm-2
uuid = 7503f0bf-233e-4fd1-8e37-061b815669f0
encrypted = 1
type = aes-xts-plain64
encryption_status = encrypted
sda
├─sda1
├─sda2 vfat FAT32 F120-674E 506.8M 1% /boot/efi
├─sda3 ext4 1.0 41fddf5d-7746-48e7-a527-c2fe57a0e5b2 398.2M 36% /boot
└─sda4 crypto_LUKS 2 126b908d-9a06-4c0c-af65-8ebf6bd1988f
└─sda4_crypt LVM2_member LVM2 001 1dEYER-a40T-nn7k-UJ9V-PuYw-fTNI-WypOyE
├─vgubuntu-root ext4 1.0 6da0cb49-fecc-4a12-877f-fa69428189c3 10.8G 33% /
└─vgubuntu-swap_1 swap 1 7503f0bf-233e-4fd1-8e37-061b815669f0 [SWAP]
This query is interesting to me -- it returns one row!
$ sudo osqueryi --line 'select encrypted from disk_encryption as d join mounts as m on m.device_alias = d.name where d.name in (select name from disk_encryption where encrypted=1)'
Configuration setting "devices/scan_lvs" unknown.
Configuration setting "devices/allow_mixed_block_sizes" unknown.
encrypted = 0
But the more obvious query returns zero:
$ sudo osqueryi --line 'select name,d.type,encrypted from disk_encryption as d join mounts as m on m.device_alias = d.name where encrypted=1'|wc -l
Configuration setting "devices/scan_lvs" unknown.
Configuration setting "devices/allow_mixed_block_sizes" unknown.
0
seph
11/11/2021, 2:39 AMWes
11/11/2021, 6:26 PM