https://github.com/osquery/osquery logo
Title
a

alessandrogario

09/12/2018, 12:11 AM
Hey @thor ! Is Michael Lynn here on Slack? This may be what he was talking about during the last office hours? https://osquery.slack.com/archives/C08VA8R6F/p1536688765000100
t

thor

09/12/2018, 12:41 AM
Yeah @frogor :)
๐ŸŽ‰ 1
f

frogor

09/12/2018, 12:42 AM
๐Ÿ‘‹
Hmmm. The only thing in that query that ... osquery isn't raw accessing /var/db/dslocal record files is it?
'cause that is a no-no now
too bad the traceback doesn't have the path in question
a

alessandrogario

09/12/2018, 12:47 AM
I don't know if this is what you were looking for, hope I didn't have Nick highlight you for nothing ๐Ÿ˜„
f

frogor

09/12/2018, 12:47 AM
That's exactly the kind of thing
๐ŸŽ‰ 2
I spun up another b10 machine today
I'll try the same query
g

groob

09/12/2018, 1:11 AM
@obelisk is tracking Mojave issues here https://github.com/facebook/osquery/issues/4493
on b10 I dont get a crash, I just get no results
maybe I am missing something in the query
eh, i even get results
now that I have an ssh key
i can see that @spookerlabs has this issue on 10.13, so my guess itโ€™s another problem
s

sharvil

09/12/2018, 7:26 AM
Maybe boost::fs issue similar to this one? https://github.com/facebook/osquery/pull/5208 โ€” I know thatโ€™s a windows issue, but maybe there is an unhandled boost exception here too.
And maybe relatedly https://github.com/facebook/osquery/issues/3279 which @zwass has encountered before