I’m testing a deployment of Osquery 5.0.1 on Mac OS 10.15. Under osquery 4.9 I was able to attach an ATC to the /Users/%/Library/Safari/History.db via Full Disk Access. Under the new scheme (https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#automatically-granting-permissions-silent-installs) my safari_browser_history ATC fails to return any results. ATC config hasn’t changed, and my other ATCs for Chrome, Firefox, etc. continue to work, though of course those History DBs are in another path. Is there something more that needs to be configured to re-establish this access?

Can you add

--verbose

flag to your query and paste the logs?

sure; i’m deploying through Fleet, so I’ll have to take a minute to get the ATC locally to feed into osqueryi and make it verbose

Yeah, I don't see any obvious errors in the logs or the PPPC profile

How did you grant FDE access? Did the codesigning and/or path change impact this?

FDE access was granted through the above PPPC via JAMF per the online docs

just to confirm u not able to attach the ATC table to the safari history.db file? is config file correct? i just updated safari to version 15 and it seems to work fine?

osquery> select * from safari_history;
                                 path = /Users/puffycid/Library/Safari/History.db
                                   id = 94
                                  url = <https://www.google.com/search?client=safari&rls=en&q=safari+15+history&ie=UTF-8&oe=UTF-8>
                     domain_expansion = google
                          visit_count = 2
                   daily_visit_counts = d
                  weekly_visit_counts =
                autocomplete_triggers =
should_recompute_derived_visit_counts = 0
                    visit_count_score = 100
                          status_code = 0
osquery> select * from safari_history;
                                 path = /Users/puffycid/Library/Safari/History.db
                                   id = 94
                                  url = <https://www.google.com/search?client=safari&rls=en&q=safari+15+history&ie=UTF-8&oe=UTF-8>
                     domain_expansion = google
                          visit_count = 2
                   daily_visit_counts = d
                  weekly_visit_counts =
                autocomplete_triggers =
should_recompute_derived_visit_counts = 0
                    visit_count_score = 100
                          status_code = 0

                                 path = /Users/puffycid/Library/Safari/History.db
                                   id = 95
                                  url = <https://www.google.com/search?q=safari+15+forensics&client=safari&rls=en&ei=y8NbYfP7DZGu5NoP2N6aiAc&ved=0ahUKEwizjc_Cp7LzAhURF1kFHVivBnEQ4dUDCA0&uact=5&oq=safari+15+forensics&gs_lcp=Cgdnd3Mtd2l6EAMyBQghEKABOgcIABBHELADOgUIABCABDoJCAAQyQMQFhAeOgcIIRAKEKABSgQIQRgAUKtZWJZhYKRiaARwAngAgAFpiAHEBZIBAzguMZgBAKABAcgBCMABAQ&sclient=gws-wiz>
                     domain_expansion = google
                          visit_count = 2
                   daily_visit_counts = d
                  weekly_visit_counts =
                autocomplete_triggers =
should_recompute_derived_visit_counts = 0
                    visit_count_score = 100
                          status_code = 0

                                 path = /Users/puffycid/Library/Safari/History.db
                                   id = 96
                                  url = <https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/>
                     domain_expansion =
                          visit_count = 1
                   daily_visit_counts = d
                  weekly_visit_counts =
                autocomplete_triggers =
should_recompute_derived_visit_counts = 0
                    visit_count_score = 100
                          status_code = 0

i haven't done a deep dive into the db, but a quick glance on twitter/forensic/dfir chats i dont see anything related about db changes for version 15 (doesn't mean there aren't any changes) my device is not under MDM so not 100% sure if its related to that or something else?

No, this is on me. I had a trailing comma in my SELECT from a recent change to the ATC. It broke the table quietly. So I wasn’t correctly remembering when my last successful query was vs. when I had changed the file