https://github.com/osquery/osquery logo
Title
s

seph

10/17/2019, 5:39 PM
I’m watching office hours — what’s up with catalina? I have a test machine, is there something easy I can do to help?
s

sharvil

10/17/2019, 7:07 PM
how long does
system_info
take to run on Catalina? Just want to make sure it’s not endemic to my machine. There were bunch of permissions related on file/folder access, but that was to be expected.
s

seph

10/17/2019, 7:09 PM
Permission-wise, think the common answer most vendors are using is: If you have a MDP, setup an appropriate profile. If not, get the user to grant full disk access. Let me open my catalina machine to time that
s

sharvil

10/17/2019, 7:11 PM
I agree. I just doing a quick and dirty test.
And thanks for helping out.
s

seph

10/17/2019, 7:13 PM
On a test catalina machine, running 4.0.2,
osqueryd -S  'select * from system_info'
takes 0.04s
Thank you! I see you stepping up and helping a bunch.
s

sharvil

10/17/2019, 7:15 PM
Thanks. That’s super interesting, this means it’s just my machine. Which is weird, because it’s instantaneous when I am on 10.14, but takes 5+ seconds on 10.15
s

seph

10/17/2019, 7:15 PM
That is super weird.
Do other things take a long time, or just that one?
what’s
spctl -a -vvv -t install /path/to/osquery
say?
s

sharvil

10/17/2019, 7:16 PM
Can I ask for one more query? what does
power_sensors
table return? Are all the values -1?
s

seph

10/17/2019, 7:16 PM
Yes,
-1.00
across the board
s

sharvil

10/17/2019, 7:17 PM
Ok, filing a bug for that then
spctl
gives rejected, no usable signature. Which is expected, since I build from master
(The
-1.00
is present on 10.13 and 10.14 as well)
s

seph

10/17/2019, 7:23 PM
Well, if you built it, it’s not going to have the quarantine bit set, so it’s not gatekeeper