Altaf
09/19/2022, 3:49 AM/bin/bash -c '/usr/local/bin/osqueryi --json "select * from uptime"'
I get this error:
/bin/bash /usr/local/bin/osqueryi: Operation not permitted
exit code 126
But when I run the exact same thing on the same Mac from the terminal, it works as expected. Any pointers ?sharvil
09/19/2022, 5:34 AMseph
09/19/2022, 1:23 PMAltaf
09/19/2022, 1:51 PMMike Myers
09/19/2022, 4:01 PMWhy are you using bash there?I'm guessing someone is subprocessing
osqueryi
to use it in their productseph
09/19/2022, 4:04 PMAltaf
09/20/2022, 4:29 AMseph
09/22/2022, 5:59 PM/usr/local/bin/osqueryi
a symlink?osqueryi
can you invoked osqueryd -S
?Altaf
09/22/2022, 6:01 PMseph
09/22/2022, 6:02 PMAltaf
09/22/2022, 6:04 PMseph
09/22/2022, 6:04 PMsharvil
09/22/2022, 6:06 PM/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd -S --json "select * from uptime"
the other thing I can think of if you are using Xcode (again not too familiar with it myself), maybe try turning the hardened-runtime and sandbox thingies off in the build target..?let path = URL(fileURLWithPath: "/usr/local/bin/osqueryi")
and then calling Process.run(path, args,…)
Altaf
09/22/2022, 6:10 PMsharvil
09/22/2022, 6:16 PMMike Myers
09/23/2022, 3:27 AMhello world
executable first. I think this is a Swift programming question or API call quirkAltaf
09/23/2022, 6:24 PM