Title
#general
p

Praveen Kumar

09/03/2022, 2:38 PM
Another Query !... How to write the C++ Query to get fetch the list of users from the system ? like select uid from users; (edited) require a help for even the above issue.
Mike Myers

Mike Myers

09/06/2022, 5:00 PM
I am surprised we don't have any SDK example of reading from an osquery core table using an extension. This is possible, right? @Stefano Bonicatti
s

sharvil

09/06/2022, 5:16 PM
I think it is possible by doing something like
osquery::SQL::selectFrom
Stefano Bonicatti

Stefano Bonicatti

09/06/2022, 5:22 PM
Yeah in general anything that gets translated to a registry call then can travel through the thrift connection. In the past as far as I recall we had the, problematic, ability to write the rocksdb database from extensions
5:24 PM
https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/sql/sql.cpp#L126-L135 This is a more advanced view of what you can do and need more digging in the source code (I cannot too list the things you can do ^^’)
p

Praveen Kumar

09/06/2022, 6:41 PM
Another query related to same issue:
6:42 PM
auto sw_vers = SQL:😒electAllFrom("plist", "path", EQUALS, kVersionPath); kVersionPath = '/System/Library/CoreServices/SystemVersion.plist' fetchs the empty data. please look into this
6:44 PM
please find the screenshot from the xcode
Mike Myers

Mike Myers

09/06/2022, 7:43 PM
Is this in osquery's code, or in your extension?
8:34 PM
Building from the latest code, on macOS 12.5.1, osquery reports the correct values in the
os_version
table
p

Praveen Kumar

09/07/2022, 3:50 AM
see my xcode hierarchy:
3:52 AM
verify the macosx deployment target from xcode
10:34 AM
Any resolution on my questions!.....
4:01 PM
Even I got same issue after upgrading my xcode to 13.4.1.
Mike Myers

Mike Myers

09/09/2022, 7:33 PM
How are you querying the
os_version
table? When I tested it, it was
select * from os_version;
in
osqueryi