-
Notifications
You must be signed in to change notification settings - Fork 450
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Cherry pick PR #23766 into RC v4.60.0 Co-authored-by: Tim Lee <timlee@fleetdm.com> Co-authored-by: Ian Littman <iansltx@gmail.com>
- Loading branch information
3 people
authored
Nov 15, 2024
1 parent
13ca79f
commit 468a5b8
Showing
20 changed files
with
455 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * Added `team_identifier` signature information to Apple macOS applications to the `/api/latest/fleet/hosts/:id/software` API endpoint. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * Added `codesign` table to provide the "Team identifier" of macOS applications. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| //go:build darwin | ||
| // +build darwin | ||
|
|
||
| // Package codesign implements an extension osquery table | ||
| // to get signature information of macOS applications. | ||
| package codesign | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "bytes" | ||
| "context" | ||
| "errors" | ||
| "os/exec" | ||
| "strings" | ||
|
|
||
| "github.com/osquery/osquery-go/plugin/table" | ||
| "github.com/rs/zerolog/log" | ||
| ) | ||
|
|
||
| // Columns is the schema of the table. | ||
| func Columns() []table.ColumnDefinition { | ||
| return []table.ColumnDefinition{ | ||
| // path is the absolute path to the app bundle. | ||
| // It's required and only supports the equality operator. | ||
| table.TextColumn("path"), | ||
| // team_identifier is the "Team ID", aka "Signature ID", "Developer ID". | ||
| // The value is "" if the app doesn't have a team identifier set. | ||
| // (this is the case for example for builtin Apple apps). | ||
| // | ||
| // See https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/. | ||
| table.TextColumn("team_identifier"), | ||
| } | ||
| } | ||
|
|
||
| // Generate is called to return the results for the table at query time. | ||
| // | ||
| // Constraints for generating can be retrieved from the queryContext. | ||
| func Generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) { | ||
| constraints, ok := queryContext.Constraints["path"] | ||
| if !ok || len(constraints.Constraints) == 0 { | ||
| return nil, errors.New("missing path") | ||
| } | ||
|
|
||
| var paths []string | ||
| for _, constraint := range constraints.Constraints { | ||
| if constraint.Operator != table.OperatorEquals { | ||
| return nil, errors.New("only supported operator for 'path' is '='") | ||
| } | ||
| paths = append(paths, constraint.Expression) | ||
| } | ||
|
|
||
| var rows []map[string]string | ||
| for _, path := range paths { | ||
| row := map[string]string{ | ||
| "path": path, | ||
| "team_identifier": "", | ||
| } | ||
| output, err := exec.CommandContext(ctx, "/usr/bin/codesign", | ||
| // `codesign --display` does not perform any verification of executables/resources, | ||
| // it just parses and displays signature information read from the `Contents` folder. | ||
| "--display", | ||
| // If we don't set verbose it only prints the executable path. | ||
| "--verbose", | ||
| path, | ||
| ).CombinedOutput() // using CombinedOutput because output is in stderr and stdout is empty. | ||
| if err != nil { | ||
| // Logging as debug to prevent non signed apps to generate a lot of logged errors. | ||
| log.Debug().Err(err).Str("output", string(output)).Str("path", path).Msg("codesign --display failed") | ||
| rows = append(rows, row) | ||
| continue | ||
| } | ||
| info := parseCodesignOutput(output) | ||
| row["team_identifier"] = info.teamIdentifier | ||
| rows = append(rows, row) | ||
| } | ||
|
|
||
| return rows, nil | ||
| } | ||
|
|
||
| type parsedInfo struct { | ||
| teamIdentifier string | ||
| } | ||
|
|
||
| func parseCodesignOutput(output []byte) parsedInfo { | ||
| const teamIdentifierPrefix = "TeamIdentifier=" | ||
|
|
||
| scanner := bufio.NewScanner(bytes.NewReader(output)) | ||
| var info parsedInfo | ||
| for scanner.Scan() { | ||
| line := scanner.Text() | ||
| if strings.HasPrefix(line, teamIdentifierPrefix) { | ||
| info.teamIdentifier = strings.TrimSpace(strings.TrimPrefix(line, teamIdentifierPrefix)) | ||
| // "not set" is usually displayed on Apple builtin apps. | ||
| if info.teamIdentifier == "not set" { | ||
| info.teamIdentifier = "" | ||
| } | ||
| } | ||
| } | ||
| return info | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| name: codesign | ||
| platforms: | ||
| - darwin | ||
| description: Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command. | ||
| columns: | ||
| - name: path | ||
| type: text | ||
| required: true | ||
| description: Path is the absolute path to the app folder. | ||
| - name: team_identifier | ||
| type: text | ||
| required: false | ||
| description: Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and built-in Apple applications. | ||
| notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). | ||
| evented: false |
23 changes: 23 additions & 0 deletions
23
...e/mysql/migrations/tables/20241110152839_AddTeamIdentifierToHostSoftwareInstalledPaths.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| package tables | ||
|
|
||
| import ( | ||
| "database/sql" | ||
| "fmt" | ||
| ) | ||
|
|
||
| func init() { | ||
| MigrationClient.AddMigration(Up_20241110152839, Down_20241110152839) | ||
| } | ||
|
|
||
| func Up_20241110152839(tx *sql.Tx) error { | ||
| if _, err := tx.Exec(` | ||
| ALTER TABLE host_software_installed_paths ADD COLUMN team_identifier VARCHAR(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT ''`, | ||
| ); err != nil { | ||
| return fmt.Errorf("failed to add team_identifier to host_software_installed_paths table: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func Down_20241110152839(tx *sql.Tx) error { | ||
| return nil | ||
| } |
Oops, something went wrong.