https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi folks - anyone else having issues with the `bre...
# general
e
Hi folks - anyone else having issues with the 
brew
cask for osquery? Installs are working on macOS, but the symlink in /usr/local/bin (on 2021 MacBook Pro M1, macOS 14) points to an empty directory where it seems to expect osquery.app
s
Where does it point?
We don’t maintain the brew cask
e
Totally - just curious if anyone else is having issues with it or it's just me.
Points to... One sec
Points to /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
Interestingly, /opt/osquery/lib/ is empty
s
I think that symlink is created by the osquery package, not by brew
hrm. Decompiling the 
pkg
cask is using, it clearly has 
/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
👍 1
e
Interesting - because a 
brew uninstall --cask osquery
removes that symlink
s
I would expect brew uninstall to remove whatever files the pkg creates. But I have no idea what’s happening here.
e
Just tried reinstalling with the .pkg from osquery.io and same problem
s
Do you have any idea where it put the app bundle?
e
(after uninstalling with brew)
No... I can poke around
s
Huh. I feel like I must be missing something obvious. Where did it put the app?
e
Let me see if I can find that
Hmm - not even finding it. Clearly should be /opt/osquery/lib/
I’ll look more tomorrow. Thanks for your help!
s
From a terminal, what’s 
tree /opt/osquery
show?
e
Just 
/lib/
, even with a 
sudo ls -A
s
Let’s see… Can you: 
pkgutil --pkgs | grep osquery
it should get a package id. Then 
pkgutil --files <whatever that id is>
I’m guessing that your machine is installing packages to some other relocated path. So the symlink is pointing at the wrong place. And I don’t really know enough macos pkg stuff to know more
👆 1
s
If you have any osquery.app laying around, the .pkg will upgrade that. We should disable the relocation in the bundle with BundleIsRelocatable to false to avoid that.
7 Views
Open in Slack
PreviousNext
Powered by