Has anyone seen this problem before where you can run a quer

Question

Has anyone seen this problem before where you can run a query locally using osqueryi I get results `SELECT path FROM mdfind WHERE mdfind query = kMDItemFSName == ovpn ` but if I run the same query via fleet and it comes back with nothing If I just query the path directly on the file table it finds the file so it s something specific about the `mdfind` table any ideas FWIW it seems to work on some computers that are using launcher but I am using orbit if that matters

ryan · Answer

Same goes for this query works in osqueryi but not from fleet `select from file where path like Users Downloads ovpn ` if I remove the wildcards it works fine on both `where path like Users rhuddleston Downloads foo ovpn `

zwass · Answer

This sounds like a permissions issue See <https osquery readthedocs io en stable deployment process auditing full disk access>