Epoch in rpm_packages table (osquery#5248)

Summary: code for issue: osquery#5202 Pull Request resolved: osquery#5248 Differential Revision: D13677333 Pulled By: fmanco fbshipit-source-id: e245c3733bb73a1d4d6ab61e007c1cf274c29e59
akindyakov · Jan 16, 2019 · 6fe7b4c · 6fe7b4c
1 parent f5645b9
commit 6fe7b4c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/osquery/tables/system/linux/rpm_packages.cpp b/osquery/tables/system/linux/rpm_packages.cpp
@@ -149,6 +149,7 @@ QueryData genRpmPackages(QueryContext& context) {
     r["size"] = getRpmAttribute(header, RPMTAG_SIZE, td);
     r["sha1"] = getRpmAttribute(header, RPMTAG_SHA1HEADER, td);
     r["arch"] = getRpmAttribute(header, RPMTAG_ARCH, td);
+    r["epoch"] = INTEGER(getRpmAttribute(header, RPMTAG_EPOCH, td));
 
     rpmtdFree(td);
     results.push_back(r);

diff --git a/specs/linux/rpm_packages.table b/specs/linux/rpm_packages.table
@@ -8,6 +8,7 @@ schema([
     Column("size", BIGINT, "Package size in bytes"),
     Column("sha1", TEXT, "SHA1 hash of the package contents"),
     Column("arch", TEXT, "Architecture(s) supported"),
+    Column("epoch", INTEGER, "Package epoch value"),
 ])
 attributes(cacheable=True)
 implementation("@genRpmPackages")