{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/913","labels_url":"https://api.github.com/repos/facebook/osquery/issues/913/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/913/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/913/events","html_url":"https://github.com/facebook/osquery/pull/913","id":65270275,"number":913,"title":"[#911] Implement FDE status","user":{"login":"sharvilshah","id":819943,"avatar_url":"https://avatars.githubusercontent.com/u/819943?v=3","gravatar_id":"","url":"https://api.github.com/users/sharvilshah","html_url":"https://github.com/sharvilshah","followers_url":"https://api.github.com/users/sharvilshah/followers","following_url":"https://api.github.com/users/sharvilshah/following{/other_user}","gists_url":"https://api.github.com/users/sharvilshah/gists{/gist_id}","starred_url":"https://api.github.com/users/sharvilshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharvilshah/subscriptions","organizations_url":"https://api.github.com/users/sharvilshah/orgs","repos_url":"https://api.github.com/users/sharvilshah/repos","events_url":"https://api.github.com/users/sharvilshah/events{/privacy}","received_events_url":"https://api.github.com/users/sharvilshah/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/needs%20response","name":"needs response","color":"f7c6c7"},{"url":"https://api.github.com/repos/facebook/osquery/labels/os%20x","name":"os x","color":"d4c5f9"},{"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"bfd4f2"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-03-30T18:17:45Z","updated_at":"2015-04-02T22:23:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/913","html_url":"https://github.com/facebook/osquery/pull/913","diff_url":"https://github.com/facebook/osquery/pull/913.diff","patch_url":"https://github.com/facebook/osquery/pull/913.patch"},"body":"(**Work in progress**)\r\n\r\n##### TODO:\r\n\r\n- [x] ~~Implement `encrypted` column for OS X in `block_devices`~~\r\n- [x] Move OS X is_encrypted to a separate virtual table\r\n- [ ] Linux implementation\r\n- [ ] Add/update Tests\r\n- [ ] Documentation\r\n \r\nHey @theopolis,\r\n\r\nThis change adds `encrypted` column to the `block_devices` table.\r\n\r\nTurns out `CoreStorage` is sub-class of  `IOMedia` (not a surprise), so this is a straightforward change, since there is already a `DASession`.\r\n\r\n```bash\r\n❯ echo \"select name, uuid, encrypted from block_devices where encrypted == 1;\"  \\\r\n| ./osqueryi\r\n\r\n+------------+--------------------------------------+-----------+\r\n| name       | uuid                                 | encrypted |\r\n+------------+--------------------------------------+-----------+\r\n| /dev/disk1 | ABCF88F5-629A-4DE9-9D30-91EFA68149E8 | 1         |\r\n+------------+--------------------------------------+-----------+\r\n```\r\n\r\n```bash\r\n❯ echo \"select name, uuid, encrypted from block_devices where encrypted == 1;\" \\\r\n | ./osqueryi\r\n\r\n+--------------+--------------------------------------+-----------+\r\n| name         | uuid                                 | encrypted |\r\n+--------------+--------------------------------------+-----------+\r\n| /dev/disk0   |                                      | 0         |\r\n| /dev/disk0s1 | 9E103246-DCFF-4ED7-ACA0-60F81F0A3E2A | 0         |\r\n| /dev/disk0s2 | 107602D7-927A-47D7-B59E-9A72C7E47742 | 0         |\r\n| /dev/disk0s3 | A3BBDEE1-437A-4C52-93D4-CFB9D1F6B4F6 | 0         |\r\n| /dev/disk2   |                                      | 0         |\r\n+--------------+--------------------------------------+-----------+\r\n```\r\n\r\n##### Questions:\r\n\r\n* The UUIDs are logical volume ones, and not the LVF one (see #911 discussion), does it matter here?\r\n* Since sqlite doesn't have a BOOLEAN type, what is the standard for the boolean valued columns? INTEGER 1 (true) and 0 (false) or TEXT true or false? I saw both being used in the table specs, I went with the INTEGER.\r\n* Do we want to another another table for encryption status if we add encryption type and recovery key information? Or just add columns to `block_devices`? Or is `block_devices` already getting too cluttered?\r\n"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/89062578","html_url":"https://github.com/facebook/osquery/pull/913#issuecomment-89062578","issue_url":"https://api.github.com/repos/facebook/osquery/issues/913","id":89062578,"user":{"login":"sharvilshah","id":819943,"avatar_url":"https://avatars.githubusercontent.com/u/819943?v=3","gravatar_id":"","url":"https://api.github.com/users/sharvilshah","html_url":"https://github.com/sharvilshah","followers_url":"https://api.github.com/users/sharvilshah/followers","following_url":"https://api.github.com/users/sharvilshah/following{/other_user}","gists_url":"https://api.github.com/users/sharvilshah/gists{/gist_id}","starred_url":"https://api.github.com/users/sharvilshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharvilshah/subscriptions","organizations_url":"https://api.github.com/users/sharvilshah/orgs","repos_url":"https://api.github.com/users/sharvilshah/repos","events_url":"https://api.github.com/users/sharvilshah/events{/privacy}","received_events_url":"https://api.github.com/users/sharvilshah/received_events","type":"User","site_admin":false},"created_at":"2015-04-02T22:23:54Z","updated_at":"2015-04-02T22:23:54Z","body":"Thanks @theopolis, updated and squashed my commits.\r\n\r\nRan the Instruments wrapper script:\r\n```\r\nAnalyzing leaks in query: select * from disk_encryption\r\n  definitely: 0 leaks for 0 total leaked bytes.\r\n```"}}