craSH
03/27/2020, 11:38 PMpid
column of the table listening_ports
to be populated? I've identified that in my environment we're definitely not providing the needed capability to get that data (it just returns -1
), but in debugging if i give all capabilities it works. Just not super clear to me based on capabilities/kernel docs or the osquery source code (https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/networking/linux/process_open_sockets.cpp#L43 -ish?) which one it needsCAP_DAC_READ_SEARCH
and CAP_SYS_PTRACE