Title
#macos
a

alessandrogario

09/12/2018, 12:11 AM
Hey @thor ! Is Michael Lynn here on Slack? This may be what he was talking about during the last office hours? https://osquery.slack.com/archives/C08VA8R6F/p1536688765000100
thor

thor

09/12/2018, 12:41 AM
Yeah @frogor ๐Ÿ˜ƒ
frogor

frogor

09/12/2018, 12:42 AM
๐Ÿ‘‹
12:44 AM
Hmmm. The only thing in that query that ... osquery isn't raw accessing /var/db/dslocal record files is it?
12:45 AM
'cause that is a no-no now
12:47 AM
too bad the traceback doesn't have the path in question
a

alessandrogario

09/12/2018, 12:47 AM
I don't know if this is what you were looking for, hope I didn't have Nick highlight you for nothing ๐Ÿ˜„
frogor

frogor

09/12/2018, 12:47 AM
That's exactly the kind of thing
12:48 AM
I spun up another b10 machine today
12:48 AM
I'll try the same query
g

groob

09/12/2018, 1:11 AM
@obelisk is tracking Mojave issues here https://github.com/facebook/osquery/issues/4493
1:13 AM
on b10 I dont get a crash, I just get no results
1:19 AM
maybe I am missing something in the query
1:21 AM
eh, i even get results
1:21 AM
now that I have an ssh key
1:22 AM
i can see that @spookerlabs has this issue on 10.13, so my guess itโ€™s another problem
s

sharvil

09/12/2018, 7:26 AM
Maybe boost::fs issue similar to this one? https://github.com/facebook/osquery/pull/5208 โ€” I know thatโ€™s a windows issue, but maybe there is an unhandled boost exception here too.
8:20 AM
And maybe relatedly https://github.com/facebook/osquery/issues/3279 which @zwass has encountered before