osquery
osquery copied to clipboard
Don't add ATC table name to registry until after sqlite DB initialization
Fixes #8232
I'm not sure if there are nuances I'm missing or if there is a good way to test this section of code, but this fixes a bug where the first ATC table specified in a conf file is attached twice and the second attempt fails.
The committers listed above are authorized under a signed CLA.
- :white_check_mark: login: astrocox / name: Julia Cox (c0a28d248fea15638d672a5ee51d4bcdee6f19f9)
We discussed this in office hours today. The conclusion is that no one understands why this bug is present, but this fix seems okay.
Thanks for reviewing/merging! Sorry I missed the office hours agenda. If anyone is curious, this bug was happening because Registry::call()
calls getConnection()
on the SQLliteDBInstance
, which calls attachVirtualTables()
if the db has not previously been initialized. The attachVirtualTables()
function then iterates over every table in the registry and calls Registry::call()
for each one. So if you add to the list of tables before that first DB initialization happens, that first table will have attachTableInternal()
called on it twice.
Bad screenshot of the offending stack trace:
Thank you so much for contributing the patch!
I was having the same issue for moz_bookmarks:
E0301 11:34:47.283597 -640033728 virtual_table.cpp:1115] Error creating named virtual table: firefox_bookmarks (1)
And I was guessing this could be due to the path in the ATC file:
{
"auto_table_construction": {
"firefox_bookmarks": {
"platform": "darwin",
"query": "SELECT * FROM moz_bookmarks;",
"path": "/Users/%/Library/Application Support/Firefox/Profiles/%/places.sqlite",
"columns": [
"id",
"type",
"fk",
"parent",
"position",
"title",
"keyword_id",
"folder_type",
"dateAdded",
"lastModified",
"guid",
"syncStatus",
"syncChangeCounter"
]
}
}
There are two (or probably more) profiles in the Profiles
folder, so here comes the problem. I guess the fix will also be solving this, right?
Thanks!
Heads up, this may have broken something around ATC table creation via plugins. We're still debugging