https://github.com/osquery/osquery logo
Title
s

sundsta

03/03/2020, 5:28 PM
I have installed the
.pkg
from osquery.io on macOS 10.15, but it does not register the plist with launchctl. Additionally, attempting to start the service or check the configuration with
osqueryctl
has a segfault. Has anyone here run into this?
z

zwass

03/03/2020, 5:30 PM
@seph @groob? I'm still on 10.14
g

groob

03/03/2020, 5:31 PM
I can take a look
@sundsta the 4.1.1.pkg?
Or 4.2.0?
This pkg is weird
s

sundsta

03/03/2020, 5:33 PM
4.2.0
g

groob

03/03/2020, 5:35 PM
The package has no install scripts
Idk if that's intentional, but office hours is soon
s

sundsta

03/03/2020, 5:47 PM
Can you link me to docs on inspecting a pkg? I’d like to be able to investigate this myself in the future
g

groob

03/03/2020, 5:59 PM
pkgutil --expand is one
👍 1
Another is a tool called Suspicious Package, which works nicely and has a GUI
👍 1
s

seph

03/03/2020, 6:02 PM
I use
tar
to expand them.
g

groob

03/03/2020, 6:03 PM
Which is coincidentally bugged on 10.15 (idk the details)
s

seph

03/03/2020, 6:03 PM
I did notice some issues there. But I haven’t dig into it. ¯\_(ツ)_/¯
g

groob

03/03/2020, 6:08 PM
In any case, this looks like a bug / unintentional
@sundsta can you file an issue with the repo?
s

sundsta

03/03/2020, 6:09 PM
Sure
s

samuel

03/05/2020, 12:27 AM
that's expected behavior, the package has never installed a service for as long as i can remember
👍 1
commented on the issue
👍 1