Title
#linux
c

craSH

03/27/2020, 11:38 PM
Hello! Would anyone happen to know what linux capability (e.g. http://man7.org/linux/man-pages/man7/capabilities.7.html) is required for the
pid
column of the table
listening_ports
to be populated? I've identified that in my environment we're definitely not providing the needed capability to get that data (it just returns
-1
), but in debugging if i give all capabilities it works. Just not super clear to me based on capabilities/kernel docs or the osquery source code (https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/tables/networking/linux/process_open_sockets.cpp#L43 -ish?) which one it needs
12:42 AM
Huzzah.
CAP_DAC_READ_SEARCH
and
CAP_SYS_PTRACE