Stefano Bonicatti10/28/2019, 7:15 PM
columns, indeed require all of them in a WHERE clause? Though testing
works fine, though
select * from extended_attributes where path = '/usr'
gives an empty result (but if we confront the result from the first query, directory is '/'). So either way I would expect both query to fail, due to the
select * from extended_attributes directory = '/'
, or both to succeed and return something.
packetzero10/28/2019, 7:23 PM
Stefano Bonicatti10/28/2019, 7:28 PM
only if all the required constraint are present? Also below I see: https://github.com/osquery/osquery/blob/0c06658e45b493583d55ec2486456e3ce44dfa35/osquery/sql/virtual_table.cpp#L938-L941 So the warning that should come out but that it doesn't in any case. Time to open an issue I guess.
required_satisfied = true
packetzero10/28/2019, 7:55 PM
Stefano Bonicatti10/28/2019, 7:56 PM
packetzero10/28/2019, 8:23 PM
Stefano Bonicatti10/28/2019, 8:36 PM
packetzero10/28/2019, 8:38 PM
Stefano Bonicatti10/28/2019, 8:39 PM
Error: no query solution
packetzero10/28/2019, 8:39 PM
Stefano Bonicatti10/28/2019, 8:41 PM
packetzero10/28/2019, 8:44 PM