Hello everyone 👋 I'm looking to validate if the osquery agent has been granted fulldisk permissions on macOS; Is there a method to do this, I ask as I have one which would rely on an error / lack of a result to determin if there is the needed permission configured however I am hopefull there is a cleaner solution. Thanks in advance.

if you use fleet, there is a dedicated table to expose this:

SELECT * FROM tcc_access WHERE service = 'kTCCServiceSystemPolicyAllFiles';

Thanks @FG interesting I've needed to use ATC to expose tcc_ tables as noted here oddly, as I cannot see tcc_* without using this methodology when there is fulldisk permissions granted; the osquery returns a result where there is not nothing returns; perhaps inescapable that there may be a need to consider a 'zero' result response as indicator of missing permission.

as you mentioned, i typically relied on the error message approach as well, not sure if there is amore elegant way to handle it other than relying on that yes i can/no i can't logic from the agent.