I'm writing a Mac app in Swift. When I try running osqueryi from within this app, by calling:

/bin/bash -c '/usr/local/bin/osqueryi --json "select * from uptime"'

I get this error: /bin/bash /usr/local/bin/osqueryi: Operation not permitted exit code 126 But when I run the exact same thing on the same Mac from the terminal, it works as expected. Any pointers ?

@Altaf That sounds like a bash exit code — does osqueryi have executable permissions?

Why are you using bash there?

@sharvil yes, osqueryi has permissions, that's why when I run the exact same thing on the same MAc from the terminal, it works as expected

Why are you using bash there?

I'm guessing someone is subprocessing

osqueryi

to use it in their product

But why have bash in the exec? Ignoring whether it’s a good idea, just invoke osqueryi

@seph I tried without bash, ie. I invoked a process with launchpath = '/usr/local/bin/osqueryi' with a command line query using --json, and this is the error: exception caught Error Domain=NSCocoaErrorDomain Code=4 "The file “osqueryd” doesn’t exist." UserInfo={NSFilePath=/usr/local/bin/osqueryi}

Is

/usr/local/bin/osqueryi

a symlink?

@seph yes, it's a symlink like this: /usr/local/bin/osqueryi -> /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd

This seems like some oddness in how your environment execs stuff, I don’t know much about it

no worries @seph. can you tell me if osqueryd daemon can be invoked from within a Mac app ?

I don’t know any reason it can’t be. But I’d have said the same about osqueryi. 🙂

just spitballing here: might be worth trying the full path instead of symlink

/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd -S --json "select * from uptime"

the other thing I can think of if you are using Xcode (again not too familiar with it myself), maybe try turning the hardened-runtime and sandbox thingies off in the build target..?

Just turned off sandbox and hardened runtime, and issued what you mentioned in your previous commend. This is what I get now: /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd: /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd: cannot execute binary file termination status 126

hmm..sorry, I am not sure what else is going on..

I would test this out launching a simple

hello world

executable first. I think this is a Swift programming question or API call quirk

Thanks @Mike Myers I figured out the issue and resolved it. I just had to use Process object with launchPath = '/usr/local/bin/osqueryi' and pass it parameters