seph
[ 87%] Building CXX object osquery/events/CMakeFiles/osquery_events.dir/darwin/openbsm.cpp.o
/Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:179:35: error: no member named 'global_seq_num' in 'es_message_t'
ec->global_seq_num = message->global_seq_num;
~~~~~~~ ^
/Users/seph/checkouts/osquery/osquery/osquery/events/darwin/endpointsecurity.cpp:213:57: error: no member named 'cwd' in 'es_event_exec_t'
ec->cwd = getStringFromToken(&message->event.exec.cwd->path);
~~~~~~~~~~~~~~~~~~~ ^
2 errors generated.
sharvil
05/20/2021, 5:15 PMseph
cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.12 ..
cmake --build . -j $(sysctl -n hw.ncpu)
sharvil
05/20/2021, 5:33 PMseph
miniseph:build seph$ xcode-select -p
/Applications/Xcode.app/Contents/Developer
theopolis
mv ./build ./build2; mkdir build; cd build; cmake ..
sort of thing fixes bugs.seph
sharvil
05/20/2021, 6:49 PMseph
puffycid
05/20/2021, 8:54 PMseph
puffycid
05/20/2021, 9:09 PMMike Myers
05/20/2021, 10:56 PMno member named 'global_seq_num' in 'es_message_t'
I think that field specifically was added in Big Sur, so, this might be an issue of linking or building with Catalinaif (__builtin_available(macos 10.15, *))
— maybe something like that is needed for whether it captures global_seq_num
or not (except macOS 11
)sharvil
05/21/2021, 10:27 AMosqueryd
and confirmed that it runs and gives expected results, no matter what macOS version osqueryd is compiled onxcode-select -p
is pointing to.global_seq_num
field is only present on big sur, so the no member name
error makes more sense on catalina (which is why we need 10.12 as minimum and full XCode for building on catalina) -- As Teddy suggested, I am guessing this is a stale build
or ccache
somewhere.__builtin_available
guards are there so that osquery built on catalina and newer, continues to run on 10.14 mojave and earlier (where ESF doesn't exists) and doesn't complain for missing symbols