Sadly, I closed this PR because I realized I only had the right version numbers because the build machine was running Big Sur. I think the only fix for this will be to upgrade the build servers on Osquery to use Big Sur.
terracatta
12/21/2020, 6:58 PM
there is probably an ugly hack that can be employed
terracatta
12/21/2020, 6:59 PM
but for whatever reason setting the magic ENV var from within the process itself is not the same as the caller setting the ENV var when invoking osquery. I don't understand why that is the case... I tried setting the ENV at osquery startup in init.cpp and right before the plist is queried...but no love.
terracatta
12/21/2020, 7:00 PM
I gave up because I couldn't be sure how my Mac being on Big Sur was impacting my ENV experimentation. Whatever magic Apple is employing...it's something in the kernel itself and I don't think that source is available