slevchenko
01/08/2022, 5:16 PMpath
field, this field is kinda reserved or something, so ATC table can't contain such field in any form not path
nor Path
or PATH
. If custom ATC table contains path
osqueryd returns:
E0108 18:52:27.938575 33708 virtual_table.cpp:584] Error creating virtual table: trusted_binaries (1): SQLITE_ERROR
seph
01/08/2022, 5:18 PMslevchenko
01/08/2022, 5:19 PMseph
01/08/2022, 5:20 PMslevchenko
01/08/2022, 5:21 PMError creating virtual table: trusted_binaries (1): SQLITE_ERROR osqueryd[30983]: I0108 18:37:42.011741 30983 virtual_table.cpp:587] Cannot create virtual table using: CREATE TABLE trusted_binaries(`path` TEXT, `registeredAt` TEXT, `Path` TEXT, `Sha256` TEXT, `VThits` TEXT)
seph
01/08/2022, 5:22 PMslevchenko
01/08/2022, 5:23 PMpath
was injected by osquery, and second Path
is mineseph
01/08/2022, 5:23 PMslevchenko
01/08/2022, 5:23 PMPath
with File
it worksfritz
01/08/2022, 6:50 PMpath
causes issues because it is reservedseph
01/10/2022, 6:44 PMpath
column. You'll get a warning about it being not suported.
2. In osquery, this appears to be a case sensitive set of operations. we check for a path
column, and if found, emit a warning and don't add the osquery defined one.
3. But if you create a Path
column, osquery doesn't know.
4. sqlite appears to be case insensitive.
5. So you can end up with a conflicting Path
and path
.
You could get this by definging both a path
and a Path
column.path
/ Path
conflict is a bug. https://github.com/osquery/osquery/issues/7441slevchenko
01/18/2022, 5:29 PMseph
01/18/2022, 6:02 PM