Skip to content

README.md

Latest commit

 

History

History
62 lines (52 loc) · 2.33 KB

README.md

File metadata and controls

62 lines (52 loc) · 2.33 KB

ossql-rs

Minimal osquery-inspired SQL shell in Rust, backed by Apache DataFusion.

Current scope:

  • REPL mode (cargo run)
  • piped SQL mode (echo "select * from system_info;" | cargo run --quiet)
  • local core system tables:
    • system_info, os_version, platform_info, kernel_info, uptime
    • cpu_info, cpuid, memory_info, memory_devices
  • snapshot runtime tables:
    • processes
    • process_envs
    • process_open_files
    • process_open_sockets
    • process_memory_map
    • process_namespaces
    • listening_ports
  • local networking metadata tables:
    • interface_details, interface_addresses, interface_ipv6
    • routes, arp_cache, dns_resolvers
    • etc_hosts, etc_protocols, etc_services
  • cloud metadata tables:
    • ec2_instance_metadata, ec2_instance_tags
    • azure_instance_metadata, azure_instance_tags
    • ycloud_instance_metadata
  • local identity/security tables:
    • users, groups, user_groups, logged_in_users
    • user_ssh_keys, ssh_configs, authorized_keys, known_hosts
    • sudoers, shell_history

All tables are snapshot-oriented and built from live system state when queried. Runtime snapshot table implementations are organized one table per file under src/runtime_tables/. Network table implementations are organized one table per file under src/network_tables/. Cloud metadata tables are opt-in and only query provider endpoints when OSSQL_ENABLE_CLOUD_METADATA=1.

Network Table OS Notes

  • Linux:
    • interface_details, interface_addresses, interface_ipv6, routes, arp_cache, dns_resolvers are populated from /sys, /proc, ip, and /etc/* sources.
    • Unavailable values are emitted as nulls (or osquery-style numeric defaults where expected, such as last_change = -1 for interface_details).
  • macOS:
    • interface_details, interface_addresses, interface_ipv6, routes, arp_cache use native command/system outputs when available.
    • Fields unavailable from native output are returned as null/default sentinel values to keep osquery-like schema compatibility.
  • Other OSes:
    • Tables are registered with stable schemas; unsupported row collectors return empty snapshots.

Quick start

cargo run
ossql> select * from system_info;

Or with piped input:

echo "select * from cpu_info;" | cargo run --quiet