That’s my guess we as well. osqueryd usually runs ...
# core
s
That’s my guess we as well. osqueryd usually runs as root, and often queries user controlled tables