Are fleetd/osqueryd protected processes? https://www.linkedin.com/posts/activity-7080586930937073664-dy2k

No. Osquery has never made any effort towards doing this. On most systems this has historically meant being a kernel extension which comes with its own security and stability concerns. On macOS these days it might be possible to do something with the endpointsecurity framework?

Got it. @sharvil any ideas? This would be a great thing to document in a FAQ so we can link folks (comes up from time to time- not often, but enough that I’ve always just forgotten the answer)

(I can’t see the linkedin post because I don’t have linkedin) but..

Protected Process

is windows specific, which I believe means it’s “code-signed” (iirc windows calls it

CodeIntegrity

) which makes it harder to tamper and hook into the process. On macOS code-signatures are quite heavily used, and

osqueryd

is code signed, notarized, and we have enabled

hardened runtime

on it. These all make it quite tamper-proof on macOS

Ah I was interpreting it as a process that can't be terminated

The

SystemExtension

part of EndpointSecurity on macOS, gives it a higher boot priority (and I believe harder to kill the process) — this is something we don’t do now for osquery (requires another entitlement, and moving

<http://osquery.app|osquery.app>

to /Applications)

I love this discussion. I'd really be interested to see

orbit

and/or

osqueryd

move into the "Anti-Tampering" style of process

fyi @Mo Zhu