Hey all, I’m having a problem in fleet where if I run the following query from the web UI I get no result:

SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';

But if I run locally from osqueryi:

osquery> SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';
+-------------------------------------+------------------------------------------------------------------+
| path                                | sha256                                                           |
+-------------------------------------+------------------------------------------------------------------+
| /Users/foo/Downloads/bar.zip        | e478ed02172cbc0bac68fd4a1073a247edf3b7da7a832a4f7c1d3884edb26f8b |
+-------------------------------------+------------------------------------------------------------------+

Am I missing something? Thanks!

Hey @George! This is a permissions issue. Because you're running

osqueryi

as a local user, you've got the correct access permissions. osqueryd doesn't inherit the same permissions since it's running as a system process. You can get around that by granting Full Disk Access to osqueryd if you're using plain osquery or Orbit if you're using fleetd installers.

doh, thanks Kathy, I thought I’d done this already facepalm

I've noticed that when doing it manually as a user, settings tend to get unset when there's a major update.