Channels
  • Hugh (Zercurity)

    Hugh (Zercurity)

    2 years ago
    On 4.3.0 there is the new
    screenlock
    table
  • terracatta

    terracatta

    2 years ago
    FYI this table only works when osquery is run from a user context (you can still run it as root, but _not_ via
    launchctl asuser 0

    sadly, there is no way around this because of how the underlying API works
  • Hugh (Zercurity)

    Hugh (Zercurity)

    2 years ago
    good to know, thanks 👍
  • terracatta

    terracatta

    2 years ago
    the other thing to note is even if you run osquery with the right user id context, that user must be currently logged in otherwise the query still won't work
  • a

    Artem

    2 years ago
    @terracatta so, will this table work via next version of kolide fleet using osquery with root priveleges on endpoints?
    Thank you for previous answer!
  • s

    seph

    2 years ago
    I suspect the data is stored in a keychain, or similar protected context. So unless the user is logged in, the data is inaccessible. (At least, that’s how the undocumented APIs seem)