[ 87%] Building CXX object osquery/events/CMakeFiles/osquery_events.dir/darwin/openbsm.cpp.o /Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:179:35: error: no member named 'global_seq_num' in 'es_message_t' ec->global_seq_num = message->global_seq_num; ~~~~~~~ ^ /Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:213:57: error: no member named 'cwd' in 'es_event_exec_t' ec->cwd = getStringFromToken(&message->event.exec.cwd->path); ~~~~~~~~~~~~~~~~~~~ ^ 2 errors generated.
sharvil05/20/2021, 5:15 PM
cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.12 .. cmake --build . -j $(sysctl -n hw.ncpu)
sharvil05/20/2021, 5:33 PM
miniseph:build seph$ xcode-select -p /Applications/Xcode.app/Contents/Developer
sort of thing fixes bugs.
mv ./build ./build2; mkdir build; cd build; cmake ..
sharvil05/20/2021, 6:49 PM
puffycid05/20/2021, 8:54 PM
puffycid05/20/2021, 9:09 PM
Mike Myers05/20/2021, 10:56 PM
I think that field specifically was added in Big Sur, so, this might be an issue of linking or building with Catalina
no member named 'global_seq_num' in 'es_message_t'
— maybe something like that is needed for whether it captures
if (__builtin_available(macos 10.15, *))
or not (except
sharvil05/21/2021, 10:27 AM
and confirmed that it runs and gives expected results, no matter what macOS version osqueryd is compiled on
is pointing to.
field is only present on big sur, so the
error makes more sense on catalina (which is why we need 10.12 as minimum and full XCode for building on catalina) -- As Teddy suggested, I am guessing this is a stale
no member name
guards are there so that osquery built on catalina and newer, continues to run on 10.14 mojave and earlier (where ESF doesn't exists) and doesn't complain for missing symbols