Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

hey, I’m at a loss with not being able to run queries that access tables requiring full disk access (e.g. `select * from file where path like '/Users/%/Desktop/%'`) via the fleet UI and looking for some guidance. i’ve followed the <https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#full-disk-access|osquery docs> to silently push out FDA access with our MDM (JAMF)

osqueryd is running as root…
```〰 ~ 🌷 ps aux | grep osquery
root             59875   0.6  0.2 409986736  41904   ??  SN    3:22PM   0:39.19 /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd 
root             59874   0.0  0.1 409227552  13088   ??  SNs   3:22PM   0:01.11 /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd --flagfile=/private/var/osquery/osquery.flags```

and that example query returns results in `sudo osqueryi`, just not in fleet

Screenshot 2024-03-07 at 5.08.50 PM.png

can confirm laptop is receiving TCC policy

So, I am not having any trouble running that kind of query on my test Mac with a Fleet live query. Are you running into this problem with live or saved queries?

:wave:  i’m having trouble with both live and scheduled queries that require FDA

Screenshot 2024-03-12 at 8.25.02 AM.png

maybe it's a symlink issue? I tried allowing by bundle identifier like this:

any reason for using the vanilla osquery agent instead of the fleetd?

hmm, i’m not sure. we push out osquery 5.8.2 currently with JAMF to macOS and use the free version of Fleet. I’ve used fleetctl and osqueryctl, but not fleetd. I have looked a little bit into orbit but we are not deploying osquery/fleet with it yet. is fleetd an option in my environment?

<@UETN1MG2J> for sure, checkout <https://fleetdm.com/docs/using-fleet/enroll-hosts#osquery-installer>

unfortunately changing the identifier to `io.osquery.agent` did not enable me to query protected tables via Fleet  with our current config :confused:

<@UETN1MG2J> are you codesigning with `io.osquery.agent` as the bundle id?

i codesigned like so
```&gt; codesign  -dr - /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
Executable=/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
Executable=/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
designated =&gt; identifier "io.osquery.agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "3522FA9PXF"```