'I can't list disk encrypted on osquery 5.0.1
I have this query to list all machine without disk encrypted in my pack.
SELECT m.device, m.device_alias, m.path, m.type, de.encryption_status
FROM mounts m
LEFT JOIN disk_encryption de ON de.name = m.device_alias
WHERE m.path LIKE '/'
ORDER BY m.device;
But, when I've started to install the new osquery version(5.0.1) in some machines, I've started to receive alerts that those machines were not encrypted. The machines with old version(my old version is 4.5.1) I didn't problem, just at new version.
So I started this simple query to analyze the difference of both version(5.0.1 and 4.0.9). First with the version 5.0.1
SELECT * FROM disk_encryption
The result was:
machine0101 1 encrypted /dev/dm-0 LUKS1-aes-xts-plain64
machine0101 1 encrypted /dev/dm-1 LUKS1-aes-xts-plain64
machine0101 1 encrypted /dev/dm-2 LUKS1-aes-xts-plain64
If I put a "where" the result is different. The same table, with only one condition, gives me a different result, saying the disk is not encrypted.
SELECT * FROM disk_encryption where name in ('/dev/dm-0', '/dev/dm-1', '/dev/dm-2')
machine0101 1 encrypted /dev/dm-0 LUKS1-aes-xts-plain64
machine0101 0 not encrypted /dev/dm-1 -
machine0101 0 not encrypted /dev/dm-2
OK, now I run the same query with a old version(4.5.1).
SELECT * FROM disk_encryption
machine0101 1 encrypted /dev/dm-0 aes-xts-plain64
machine0101 1 encrypted /dev/dm-1 aes-xts-plain64
machine0101 1 encrypted /dev/dm-2 aes-xts-plain64
SELECT * FROM disk_encryption where name in ('/dev/dm-0', '/dev/dm-1', '/dev/dm-2')
machine0101 1 encrypted /dev/dm-0 aes-xts-plain64
machine0101 1 encrypted /dev/dm-1 aes-xts-plain64
machine0101 1 encrypted /dev/dm-2 aes-xts-plain64
I don't know what is happening here. Is my last query wrong, or is there a bug in the new osquery version?
This is the result of the lsblk command:
sda 8:0 0 223,6G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
├─sda2 8:2 0 732M 0 part /boot
└─sda3 8:3 0 222,4G 0 part
└─sda3_crypt 253:0 0 222,4G 0 crypt
├─ubuntu--vg-root 253:1 0 221,4G 0 lvm /
└─ubuntu--vg-swap_1
253:2 0 976M 0 lvm [SWAP]
Can someone help me?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|