mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 09:58:54 +00:00
1621213813
Summary: Pull Request resolved: https://github.com/facebook/osquery/pull/5438 currently the magic table is broken. libmagic which is used to generate this information needs a database/configuration file that it usually auto-finds. Our libmagic library tries to open the following file ```open("/usr/local/osquery/Cellar/libmagic/5.32_200/share/misc/magic.mgc", O_RDONLY) = -1 ENOENT (No such file or directory)``` (you can generate this by using strace like ```trace -q -e trace=open ./buck-out/debug/gen/xplat/osquery/oss/osquery/osqueryd#gcc-5-glibc-2.23-clang -verbose -S "select * from magic where path = '/etc/passwd'"```). How it auto-finds it I don't know 100%, but I guess it has something to with how the libmagic.so is actually build and installed. Basically this never works unless you are a developer on mac and used our previous build system. I've updated the table to be able to specify the path to magic database file. If you don't specify it, I tried to check if one of the default files (files that should be present under /usr/share/ exists and use the first found). If all fail, I try the default one, but that most likely will fail. Reviewed By: guliashvili Differential Revision: D14066467 fbshipit-source-id: d9d2aca4829b2275e6792f974de1f2a7808dc321
11 lines
659 B
Plaintext
11 lines
659 B
Plaintext
table_name("magic")
|
|
description("Magic number recognition library table.")
|
|
schema([
|
|
Column("path", TEXT, "Absolute path to target file", required=True, index=True),
|
|
Column("magic_db_files", TEXT, "Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc", additional=True),
|
|
Column("data", TEXT, "Magic number data from libmagic"),
|
|
Column("mime_type", TEXT, "MIME type data from libmagic"),
|
|
Column("mime_encoding", TEXT, "MIME encoding data from libmagic"),
|
|
])
|
|
implementation("system/magic@genMagicData")
|