fix(OSQUERY-002-2): CU-86aknprfh getSystemBootTime/getProcUptimeContents throw std::runtime_error instead of returning Status

[flamingo]

Closes findings from rule OSQUERY-002-2 — getSystemBootTime/getProcUptimeContents throw std::runtime_error instead of returning Status.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 85 medium	getSystemBootTime/getProcUptimeContents throw std::runtime_error instead of returning Status	osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp:37

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 116a6ce1-ae2a-4217-a4a6-046396b5281c

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86aknprfh Osquery review findings sweep (14 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🔴 getSystemBootTime/getProcUptimeContents throw std::runtime_error instead of returning Status

Changed getProcUptimeContents() and getSystemBootTime() in the anonymous namespace (bpfprocesseventstable.cpp) from throwing std::runtime_error to returning osquery::Status, with the computed value passed back via an output reference parameter. Updated the sole caller, BPFProcessEventsTable::generate(), to check the returned Status and return an empty TableRows on failure instead of letting an exception propagate out of the table generator. This removes the only two throw sites tied to this finding within the file; no other code path in this file now relies on exceptions for these failure cases.

🤖 Prompt for AI agents

In osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp around line 37, review and complete this code-review fix: getSystemBootTime/getProcUptimeContents throw std::runtime_error instead of returning Status.
What the draft fix changed: Changed `getProcUptimeContents()` and `getSystemBootTime()` in the anonymous namespace (bpfprocesseventstable.cpp) from throwing `std::runtime_error` to returning `osquery::Status`, with the computed value passed back via an output reference parameter. Updated the sole caller, `BPFProcessEventsTable::generate()`, to check the returned `Status` and return an empty `TableRows` on failure instead of letting an exception propagate out of the table generator. This removes the only two throw sites tied to this finding within the file; no other code path in this file now relies on exceptions for these failure cases.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer