zwass
08/05/2021, 1:16 AMosquery> select version, build_platform from osquery_info;
version = 4.9.0
build_platform = 1
osquery>
Shouldn't build_platform
be linux
or similar on Linux?osqueryi --line 'select version, build_platform, build_distro from osquery_info;'
version = 4.9.0
build_platform = darwin
build_distro = 10.12
docker run --rm -it dactiv/osquery:3.3.2-ubuntu20.04 osqueryi --line 'select version, build_platform, build_distro from osquery_info;'
version = 3.3.2
build_platform = ubuntu
build_distro = xenial
Stefano Bonicatti
08/05/2021, 10:31 AM-DOSQUERY_BUILD_PLATFORM=linux
, then it’s used in code as r["build_platform"] = STR(OSQUERY_BUILD_PLATFORM)
linux
is a macro too, so instead of expanding to the string linux, it also expands that macro and the result is 1const std::string kOsqueryBuildPlatform = @OSQUERY_BUILD_PLATFORM@
and then that OSQUERY_BUILD_PLATFORM it’s actually a CMake variable that is substituted using configure_file
-DOSQUERY_BUILD_PLATFORM=\"linux\"
and then remove the stringification, since it’s already a string (otherwise it would print "linux"
verbatim).