Is anyone else seeing errors when querying the `di...
# macos
r
Is anyone else seeing errors when querying the
disk_encryption
table on macOS?
Copy code
osquery> select encrypted, path from mounts m
    ...>     join disk_encryption de ON m.device_alias = de.name
    ...>     join block_devices bd ON bd.name = de.name
    ...>     where m.path = '/';
E0602 18:54:30.425967 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.427382 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.428400 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.429446 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.595276 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.596128 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.596863 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.598112 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
+-----------+------+
| encrypted | path |
+-----------+------+
| 1         | /    |
+-----------+------+
I get this same message when I install from homebrew or the osquery.io download page. FWIW the error occurs even when I just run a simple select:
Copy code
select * from disk_encryption;
(I'm on macOS 10.13.4)