https://github.com/osquery/osquery logo
Join Slack
Powered by
This problem was actually brought up in the breako...
# general
m
This problem was actually brought up in the breakout chats at Querycon last year
t
Nice to know. Was there any suggestion on this?
m
It wasn't clear to us at the time if it was a Thrift problem or our problem, and I guess nobody acted on it. I think we could look at it now. Is there an issue to track it?
I can't find one, so I'll make one
t
Interesting, this is pretty serious as by design the API would allow anyone to stop osquery or alter its data.
g
Hello guys, is there a workaround or process on this issue? Thanks!
t
I don't think there is, but I think a first step is to update the Thrift version we use and check if the Windows pipe integration applies the intended permissions.
👍 1
m
It doesn't look like the Thrift API object used by osquery, TPipe, is able to specify access controls on the pipe. https://github.com/osquery/osquery/blob/224423fb7581b9e7c4d60e084065238a8601e246/osquery/extensions/impl_thrift.cpp#L49
Maybe it ought to be using CreateNamedPipe as described here https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights
But I'll have to step through it in a debugger to confirm
g
Latest thrift added a constructor that takes security descriptor on server side
m
Nice, good find. I'll see if I can build with a newer Thrift
👍 1
5 Views
Open in Slack
PreviousNext
Powered by