infomaniac
12/16/2020, 12:56 PMselect tbl_name FROM sqlite_temp_master WHERE type = "table";
pragma table_info("<table name>")
returns all the columnstheopolis
12/16/2020, 1:47 PMinfomaniac
12/16/2020, 1:55 PMosquery_registry
returns a lot more tables though.select sql.name AS 'from sqlite', reg.name as 'from osquery registry' FROM osquery_registry reg
LEFT JOIN sqlite_temp_master sql ON reg.name = sql.name
WHERE reg.active = 1
AND internal = 0
AND registry = 'table'
pragma table_info("<table>")
works for tables not included in sqlite_temp_master
- so I'll just use osquery_registry
then. thanks a lot!theopolis
12/16/2020, 2:25 PMosquery_tables
that structures the schema info.infomaniac
12/16/2020, 2:37 PMtheopolis
12/16/2020, 2:39 PMinfomaniac
12/16/2020, 2:40 PMtheopolis
12/16/2020, 2:41 PMinfomaniac
12/16/2020, 2:43 PMgetQueryColumns
to solve thattheopolis
12/16/2020, 2:43 PMinfomaniac
12/16/2020, 2:43 PMosquery_registry
for now, but will cover osquery_tables
(or whatever) in the future?osquery_
prefixzwass
12/16/2020, 4:38 PMinfomaniac
12/16/2020, 4:40 PMzwass
12/16/2020, 4:53 PM.schema table
. I wonder if that works via the API?infomaniac
12/16/2020, 4:54 PM.schema
and .tables
are exactly what i need, but those do not work via the Thrift API, so I have to revert to plain ol' SQLseph
12/16/2020, 5:13 PM.table
and .schema
can be queried.infomaniac
12/16/2020, 5:31 PMseph
12/16/2020, 5:39 PMzwass
12/16/2020, 5:40 PMinfomaniac
12/16/2020, 5:40 PM.tables
or .schema
over that API unless i'm mistakenseph
12/16/2020, 5:42 PMselect name from osquery_registry where registry = 'table' and active = 1
to fetch the active tables for tab completion. Not sure it uses colunmnsinfomaniac
12/16/2020, 5:48 PMPRAGMA
seems to be the only way to describe tables without using the shell builtins. how feasible is it to whitelist the table_info
pragma in light of that PR you linked earlier?
if it weakens the security stance then i can live without itseph
12/16/2020, 5:49 PMzwass
12/16/2020, 5:49 PMinfomaniac
12/16/2020, 5:51 PMpragma
👍
thanks a lot!seph
12/16/2020, 5:58 PM.schema
does not work on the thrift socket.zwass
12/16/2020, 5:58 PMinfomaniac
12/16/2020, 5:59 PMpragma
whitelistings - or the fact that the shell builtins don't work via Thrift?seph
12/16/2020, 5:59 PMinfomaniac
12/16/2020, 6:00 PMseph
12/16/2020, 6:01 PMsqlite_schema
should contain this. But does not. OTOH, I’m not really a sqlite expert.sqlite_schema
tableinfomaniac
12/16/2020, 6:12 PM