Channels
pirxthepilot
4 years agoquick q: does the
table also show setgid binaries?setuid_bin- w
Woogs
4 years agohttps://github.com/facebook/osquery/blob/master/osquery/tables/system/posix/suid_bin.cpp Based on my novice reading of the code, seems like it's looking at setgid binaries.r["permissions"] = ""; if ((perms & 04000) == 04000) { r["permissions"] += "S"; } if ((perms & 02000) == 02000) { r["permissions"] += "G"; }
I _think_
View count: 2