Title
#general
s

Sean Bowles

07/10/2020, 8:10 PM
Hi, I'm new to osquery. Can you change configuration via osquery? I see some hints that it's possible from Slack here, but the official docs seem to say you can't (https://osquery.readthedocs.io/en/stable/introduction/sql/#sql-as-understood-by-osquery). Thanks!
Mike Myers

Mike Myers

07/10/2020, 8:44 PM
Yes but only with osquery extensions. In an extension, a table can/could be implemented that changes the host configuration.
theopolis

theopolis

07/10/2020, 10:51 PM
Welcome! What do you mean by “change configuration”? Can you describe at a high level what you are looking to accomplish?
s

Sean Bowles

07/10/2020, 11:24 PM
Mike may have answered it. Consider something like the hosts file (https://osquery.io/schema/4.4.0/#etc_hosts) Can I "INSERT INTO etc_hosts "myhostname" "10.0.0.1"" and update the system's hosts file? (ignoring invalid SQL syntax)
theopolis

theopolis

07/10/2020, 11:48 PM
Got it, yeap! There should be some example extensions that do INSERTs. @Mike Myers know of any we can link Sean to?
Mike Myers

Mike Myers

07/15/2020, 3:51 PM
Hey, I just got back from PTO. Yes, we have the code at https://github.com/trailofbits/osquery-extensions/tree/master/fwctl that demonstrates a table that implements an
INSERT
and
DELETE