Title
#general
k

Kuzma Fesenko

01/16/2020, 3:48 PM
Hi everyone, an old employee in my organization had set up an installer for Macs which included the flags file, and installed the service, etc. I was able to build an OSX package, but having trouble figuring out how to include my osquery.flags file. Can't seem to find any information in the documentation on this, and have also tried searching here in Slack.
theopolis

theopolis

01/16/2020, 3:52 PM
We removed the old package building scripts when we switched to using CPack because the old scripts had a few bugs and were prone to regressions. You could add a line to the code here and install a .flags file https://github.com/osquery/osquery/blob/master/cmake/packaging.cmake#L256 it's hacky proposal (sorry about that)
k

Kuzma Fesenko

01/16/2020, 3:57 PM
Would it be better to install osquery with a script that sets up the flags file afterwards?
Stefano Bonicatti

Stefano Bonicatti

01/16/2020, 3:58 PM
In theory you can plug other CMake scripts to be run when CPack runs the local install phase https://cmake.org/cmake/help/v3.15/variable/CPACK_INSTALL_SCRIPT.html
k

Kuzma Fesenko

01/16/2020, 3:59 PM
I could try that out
theopolis

theopolis

01/16/2020, 4:04 PM
I really like the idea for an after-install script that does site-specific configuration
k

Kuzma Fesenko

01/16/2020, 4:07 PM
Does the pre-built installer found on the website install the service as well?
4:07 PM
Also, because I'm a novice with Macs, what's the easiest way to check that the service is running?
theopolis

theopolis

01/17/2020, 1:34 AM
For macos it does not install the service automatically. But a launch daemon is provided and you can start the service with:
sudo osqueryctl start
1:34 AM
that is a bash script, so if you look at the
start()
implementation you can see how it starts the service
1:36 AM
similarly you can use
sudo osqueryctl status
or
sudo launchctl list | grep com.facebook.osqueryd
s

seph

01/17/2020, 3:23 AM
If you're custom making packages I wouldn't use scripts from the repo. I'd look at the Mac packaging tools and go from there.
3:24 AM
(But I have huge biases)
k

Kuzma Fesenko

01/17/2020, 4:51 PM
I ended up creating a bash script that downloads/installs the pre-built osquery package, then dumps the flags file, config, and secret then copies the launchdaemon and then loads that. Seems to be working fine for what I needed it to do without much headache.