https://github.com/osquery/osquery logo
Title
j

Julian Scala

06/09/2020, 5:33 PM
Hey does anyone know why I can get results running
SELECT * FROM screenlock
from
osqueryi
but when the daemon runs it as scheduled query I get none results?
s

sundsta

06/09/2020, 5:34 PM
It will only return results when running under the user’s context. See https://github.com/osquery/osquery/pull/6243
j

Julian Scala

06/09/2020, 5:36 PM
I am logged in, wondering if the reason is because I am logged in as a user using
osqueryi
but
osqueryd
runs as root and it is not logged in?
Nice
thanks!
f

fritz

06/09/2020, 5:45 PM
Exactly right @Julian Scala
j

Julian Scala

06/09/2020, 5:48 PM
Cool! Thanks for the help! 😮squery:
k

Kyle

07/16/2020, 12:13 AM
Saw there was some work being done with
kolide_screenlock
table… is there any way to get screenlock info from the current version of launcher/osquery?
f

fritz

07/16/2020, 12:57 PM
Hi @Kyle! Yes you can use launcher and the
kolide_screenlock
table to query the screenlock settings remotely:
osquery> SELECT * FROM kolide_screenlock WHERE user = 'fritz-imac';
+---------+--------------+------------+
| enabled | grace_period | user       |
+---------+--------------+------------+
| 1       | 0            | fritz-imac |
+---------+--------------+------------+
k

Kyle

07/17/2020, 12:13 AM
@fritz Works like a charm, cheers!
a

Artem

03/31/2021, 8:27 AM
@fritz hello! Do I understand correctly that this is a proprietary Kolide table and there is no plan to do something similar in the generic version of osquery? (now it is not possible to use the screenlock table remotely) Is it allowed to use kolide_screenlock table without Launcher? For example, to make a standalone extension with this table.
t

terracatta

03/31/2021, 12:44 PM
Hey Artem, none of the work is proprietary it is released under the MIT license feel free to use the code in any manner you choose including in your own extensions.
a

Artem

04/05/2021, 3:15 PM
Got it! Thanks!