osquery-1/specs/users.table

table_name("users")
description("Local system users.")
schema([
    Column("uid", BIGINT, "User ID", index=True),
    Column("gid", BIGINT, "Group ID (unsigned)"),
    Column("uid_signed", BIGINT, "User ID as int64 signed (Apple)"),
    Column("gid_signed", BIGINT, "Default group ID as int64 signed (Apple)"),
    Column("username", TEXT, "Username"),
    Column("description", TEXT, "Optional user description"),
    Column("directory", TEXT, "User's home directory"),
    Column("shell", TEXT, "User's configured default shell"),
    Column("uuid", TEXT, "User's UUID (Apple)"),
])
implementation("users@genUsers")
examples([
  "select * from users where uid = 1000",
  "select * from users where username = 'root'",
  "select count(*) from users u, user_groups ug where u.uid = ug.uid",
])
Adding vtable for users 2014-10-09 19:50:34 +00:00			`table_name("users")`
Add more table descriptions for API generation 2015-02-09 01:40:35 +00:00			`description("Local system users.")`
Adding vtable for users 2014-10-09 19:50:34 +00:00			`schema([`
Use SQLite 3.14.0 to support LIKE and EQUALS (#2137) This commit bumps the third-party SQLite to the 3.14.0 pre-release (18:59). With 3.14.0 the LIKE and EQUALS constraint operators may be mixed within a query. Previously these would fail to produce a valid set. As part of the support, each virtual table should choose to bypass rowid-based deduplication using the new "WITHOUT ROWID" create table epilog. This will be appended to the schema if the table defines a PRIMARY KEY using index=True. 2016-06-06 16:36:53 +00:00			`Column("uid", BIGINT, "User ID", index=True),`
Add more table descriptions for API generation 2015-02-09 01:40:35 +00:00			`Column("gid", BIGINT, "Group ID (unsigned)"),`
			`Column("uid_signed", BIGINT, "User ID as int64 signed (Apple)"),`
Move specs to a top-level path, add query examples 1. Example queries will run with an (optional) integration test. 2. Fix bad accesses with OS X package BOMs 3. Move spec files from ./osquery/tables/specs to ./specs 4. Remove server parsers (netlib) from client builds. 2015-06-01 22:53:52 +00:00			`Column("gid_signed", BIGINT, "Default group ID as int64 signed (Apple)"),`
Adding description to all the missing table fields 2015-07-16 06:23:42 +00:00			`Column("username", TEXT, "Username"),`
Add more table descriptions for API generation 2015-02-09 01:40:35 +00:00			`Column("description", TEXT, "Optional user description"),`
			`Column("directory", TEXT, "User's home directory"),`
			`Column("shell", TEXT, "User's configured default shell"),`
[#1800] Adds `uuid` and `user_uuid` columns to the `users` table and `disk_encryption` table on Darwin, respectively. 2016-02-10 21:11:29 +00:00			`Column("uuid", TEXT, "User's UUID (Apple)"),`
Adding vtable for users 2014-10-09 19:50:34 +00:00			`])`
Removing old code for generating virtual tables 2014-10-14 04:58:26 +00:00			`implementation("users@genUsers")`
Move specs to a top-level path, add query examples 1. Example queries will run with an (optional) integration test. 2. Fix bad accesses with OS X package BOMs 3. Move spec files from ./osquery/tables/specs to ./specs 4. Remove server parsers (netlib) from client builds. 2015-06-01 22:53:52 +00:00			`examples([`
			`"select * from users where uid = 1000",`
			`"select * from users where username = 'root'",`
			`"select count(*) from users u, user_groups ug where u.uid = ug.uid",`
			`])`