Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update shared_resources table to add type names, fix type/maximum_allowed handling #7645

Conversation

alessandrogario
Copy link
Member

No description provided.

@alessandrogario alessandrogario force-pushed the alessandro/bugfix/fix-invalid-value-handling-in-shared_resources branch from 3085f70 to b1f6124 Compare June 23, 2022 17:29
@alessandrogario alessandrogario changed the title shared_resources: Add human readable type, fix type/maximum_allowed handling shared_resources: Add type names, fix type/maximum_allowed handling Jun 23, 2022
@alessandrogario alessandrogario marked this pull request as ready for review June 23, 2022 17:30
@alessandrogario alessandrogario requested review from a team as code owners June 23, 2022 17:30
@directionless directionless changed the title shared_resources: Add type names, fix type/maximum_allowed handling Update shared_resources table to add type names, fix type/maximum_allowed handling Jun 24, 2022
Comment on lines +30 to +31
{3, "IPC"},
{2147483648, "Disk Drive Admin"},
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:eyeroll: so what happened to the other numbers. Ha.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:eyeroll: so what happened to the other numbers. Ha.

It is strange! I haven't found a define for it in the documentation, so I ended up using the raw numbers

row["allow_maximum"] = INTEGER(status.ok() ? allow_maximum : -1);

long raw_maximum_allowed_value{};
status = wmi_item.GetLong("MaximumAllowed", raw_maximum_allowed_value);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm fine either way. But does it even make sense to populate this field if AllowMaximum is set?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was about to go down the same route, but I noticed that this field is always populated and retrieved correctly regardless of what AllowMaximum has been set to

@Smjert Smjert merged commit 31cf236 into osquery:master Jul 3, 2022
@Smjert Smjert deleted the alessandro/bugfix/fix-invalid-value-handling-in-shared_resources branch July 3, 2022 16:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants