Adrian Junge

02/07/2023, 4:32 PM
Hello everyone, currently I'm trying to get osqueryd running with the custom table from I start osqueryd with
sudo osqueryd --ephemeral --disable_logging --disable_database --extensions_socket /home/adrian/.osquery/osqueryd.sock --config_path=./osquery/osquery.conf --disable_extensions false
and I start the table with
python3 --socket /home/adrian/.osquery/osqueryd.sock
. But sadly an error "Could not connect to any of ['/home/adrian/.osquery/osqueryd.sock']" is raised every time in my logs. What am I doing wrong? Or do I have to bind the table in a different way?


02/07/2023, 4:50 PM
I'm going to guess it's a permission issue. Osquery is running as root and opening the socket with root perms but Python is running as non-root.

Adrian Junge

02/08/2023, 10:10 AM
I ran python as root but it's still the same issue. Is there any way to load the python table directly with osqueryd?