rmcvey
06/03/2018, 1:57 AMdisk_encryption table on macOS? osquery> select encrypted, path from mounts m
...> join disk_encryption de ON m.device_alias = de.name
...> join block_devices bd ON bd.name = de.name
...> where m.path = '/';
E0602 18:54:30.425967 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.427382 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.428400 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.429446 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.595276 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.596128 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.596863 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
E0602 18:54:30.598112 3052168064 <http://disk_encryption.mm:259]|disk_encryption.mm:259]> Error calling isEncryptedVolume:encrypted:
+-----------+------+
| encrypted | path |
+-----------+------+
| 1 | / |
+-----------+------+
I get this same message when I install from homebrew or the osquery.io download page. FWIW the error occurs even when I just run a simple select: select * from disk_encryption;
(I'm on macOS 10.13.4)