general question: There isn't really a way for osquery to read a file, correct?

Generally no. It’s a loose design goal to avoid that. There are some exceptions: 1. the carver 2. plist files 3. augeas may provide access 4. others??? And, of course, various extensions

I never heard of Augeas, is that built-into osquery? I didn't think the carver read contents of a file, so much as the contents of a directory.

You mean though, arbitrarily read a file? Because everything in osquery read files, what changes is what we display and the control you have to decide which files are read

not arbirtarily, but given a file path, yes read it

@Zach Zeid arbitrary file read is explicitly avoided where possible

augeus is a 3rd party lib that will parse a file according to a “lens”. You can feed lenses arbitrary files. but they might not parse. There is, at least one. lens that allows arbitrary text file parsing. Whether you have those installed on your machines or not I don’t know

seph outlined the majority of point to a path and read its contents cases

carver is built into osquery but requires fairly specific server support. It’s not a simple live query

hmm, how come with

augeas

it doesn't read the

/home/

directory?

I don't use augeas, I can't quickly speak to whether there's a bug or a misusage in your sql.

🤦 I should've began w/ my use case, instead of asking "can osquery read files." and going from there.

Arbitrary file read is also a common question. But, yeah. :)

I can see how arbitrary file read is a dangerous situation for data exfil too