```dover:launcher seph$ ./build/package-builder ma...
# kolides
seph
04/25/2020, 2:06 AM
Copy code
dover:launcher seph$ ./build/package-builder make --hostname=localhost --enroll_secret=secret --insecure --insecure_transport --targets linux-systemd-deb --package_version 1
Built packages in /tmp/launcher-package071939396
dover:launcher seph$ /usr/local/Cellar/binutils/2.33.1/bin/ar -p /tmp/launcher-package071939396/launcher.linux-systemd-deb.deb data.tar.gz | tar tzf - | grep osq
./usr/local/launcher/bin/osqueryd
./usr/local/launcher/bin/osquery-extension.extđź‘Ť 1
k
KryptoNyte
04/25/2020, 10:15 PMThis would actually allow this to be build so that there's even no need to install this as root, e.g. replace the paths to be in the user space I suppose...
KryptoNyte
04/25/2020, 10:16 PMI wonder for example if that would be possible on windows as well, so that the service could be started/stopped by the user without admin rights...
s
seph
04/25/2020, 10:27 PM
A bunch of the things osquery (and launcher) want to read, require root access. So it's most common to run that way
s
sundsta
04/25/2020, 11:03 PM@seph In my experience you don't need root on Linux if you grant the service
CAP_DAC_READ_SEARCHsundsta
04/25/2020, 11:03 PMI did however, run into issues with obtaining any events from the Linux audit framework if I wasn't running as root
s
seph
04/25/2020, 11:05 PM
Yeah, that's true. I forget that a bunch can happen through capabilities. .
k
KryptoNyte
04/26/2020, 5:06 PMI think it's best to require root to avoid problem 🙂
s
seph
04/27/2020, 3:14 PM
depends… Not needing root is a pretty cool security measure, and important to some environments. But, it’s extra work if you don’t need it
2 Views