https://github.com/osquery/osquery logo
Join Slack
Powered by
I want to launch an osquery with no native tables ...
# core
s
I want to launch an osquery with no native tables registered. Is there a way to do this, or prior art?
z
@groob did this at some point
j
Does 
--disable_tables VALUE                           Comma-delimited list of table names to be disabled
achieve this?
s
Empirically not. The table is still registered. For an extension to register it. I need to stop it earlier
g
there’s a build flag for this
i hope you’re not doing this as a hack to generate schemas, because there’s a better way
(which was the initial reason I looked into it)
it was called 
SKIP_TABLES=true
not sure if it’s still there
s
Not schemas. I remember there’s something else for that.
Did SKIP_TABLES merge anywhere I can find it?
g
yeah, for schemas there’s a nice thrift api that gives you the columns for any query
my worry is that it got deleted https://github.com/osquery/osquery/issues/4308
s
g
that’s old
s
Yes, yes it is
g
github needs codesearch /offtopic
I wonder if commenting this line out is enough to achieve the same https://github.com/osquery/osquery/blob/master/osquery/CMakeLists.txt#L18
the old file had this:
Copy code
if(NOT SKIP_TABLES)
  add_subdirectory(tables)
s
Not really, because there are possibly references to the targets created by that subfolder. One would either have to conditionally link to them or create an INTERFACE target, which does nothing.. so the other referencing it are happy and do not try to link something that doesn't exists. This still doesn't guarantee it compiles though, there might be code referencing those tables?
s
Poking around, AFAICT the existing disable_table mechanism ends up preventing the xConnect and xCreate from ever triggering. 
virtual_table.cpp:1057
has a check against it. If the table is disabled, then it’s not loaded. But it’s already loaded in the registry, and sqlite has a basic schema? Clearly I’m missing something.
Ah… The REGISTER call is in the codegen, but the plumbing them happens virtual_table.cpp. Which makes me wonder why the blacklist is only in virtual_table.
Poking around, it’s somewhat hard to move it. codegen adds a REGISTER macro, which expands into a AutoRegisterInterface::autoloadPlugin call (in registry_interface.cpp). I can hardcode skipping tables from being registered there. but it looks like the flags and blacklist aren’t parsed yet.
So it’s hard to do something based on those. I’m not yet sure if this is an easy fix or not.
Making a compile-time mechanism is, obviously, easy
7 Views
Open in Slack
PreviousNext
Powered by