mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 01:55:20 +00:00
a105924804
1. Example queries will run with an (optional) integration test. 2. Fix bad accesses with OS X package BOMs 3. Move spec files from ./osquery/tables/specs to ./specs 4. Remove server parsers (netlib) from client builds.
16 lines
683 B
Plaintext
16 lines
683 B
Plaintext
table_name("package_bom")
|
|
description("OS X package bill of materials (BOM) file list.")
|
|
schema([
|
|
Column("filepath", TEXT, "Package file or directory"),
|
|
Column("uid", INTEGER, "Expected user of file or directory"),
|
|
Column("gid", INTEGER, "Expected group of file or directory"),
|
|
Column("mode", INTEGER, "Expected permissions"),
|
|
Column("size", INTEGER, "Expected file size"),
|
|
Column("modified_time", INTEGER, "Timestamp the file was installed"),
|
|
Column("path", TEXT, "Path of package bom", required=True),
|
|
])
|
|
implementation("packages@genPackageBOM")
|
|
examples([
|
|
"select * from package_bom where path = '/var/db/receipts/com.apple.pkg.MobileDevice.bom'"
|
|
])
|