-
Notifications
You must be signed in to change notification settings - Fork 431
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add
team_identifier to macOS software (#23766)
Changes to add `team_identifier` signing information to macOS applications on the `/api/latest/fleet/hosts/:id/software` API endpoint. Docs: #23743 - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [X] Added/updated tests - [X] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes - [X] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ X Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [X] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [X] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [X] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [X] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). --------- Co-authored-by: Tim Lee <[email protected]> Co-authored-by: Ian Littman <[email protected]>
- Loading branch information
3 people
authored
Nov 15, 2024
1 parent
97bb941
commit 4b4fc97
Showing
20 changed files
with
455 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * Added `team_identifier` signature information to Apple macOS applications to the `/api/latest/fleet/hosts/:id/software` API endpoint. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * Added `codesign` table to provide the "Team identifier" of macOS applications. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| //go:build darwin | ||
| // +build darwin | ||
|
|
||
| // Package codesign implements an extension osquery table | ||
| // to get signature information of macOS applications. | ||
| package codesign | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "bytes" | ||
| "context" | ||
| "errors" | ||
| "os/exec" | ||
| "strings" | ||
|
|
||
| "github.com/osquery/osquery-go/plugin/table" | ||
| "github.com/rs/zerolog/log" | ||
| ) | ||
|
|
||
| // Columns is the schema of the table. | ||
| func Columns() []table.ColumnDefinition { | ||
| return []table.ColumnDefinition{ | ||
| // path is the absolute path to the app bundle. | ||
| // It's required and only supports the equality operator. | ||
| table.TextColumn("path"), | ||
| // team_identifier is the "Team ID", aka "Signature ID", "Developer ID". | ||
| // The value is "" if the app doesn't have a team identifier set. | ||
| // (this is the case for example for builtin Apple apps). | ||
| // | ||
| // See https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/. | ||
| table.TextColumn("team_identifier"), | ||
| } | ||
| } | ||
|
|
||
| // Generate is called to return the results for the table at query time. | ||
| // | ||
| // Constraints for generating can be retrieved from the queryContext. | ||
| func Generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) { | ||
| constraints, ok := queryContext.Constraints["path"] | ||
| if !ok || len(constraints.Constraints) == 0 { | ||
| return nil, errors.New("missing path") | ||
| } | ||
|
|
||
| var paths []string | ||
| for _, constraint := range constraints.Constraints { | ||
| if constraint.Operator != table.OperatorEquals { | ||
| return nil, errors.New("only supported operator for 'path' is '='") | ||
| } | ||
| paths = append(paths, constraint.Expression) | ||
| } | ||
|
|
||
| var rows []map[string]string | ||
| for _, path := range paths { | ||
| row := map[string]string{ | ||
| "path": path, | ||
| "team_identifier": "", | ||
| } | ||
| output, err := exec.CommandContext(ctx, "/usr/bin/codesign", | ||
| // `codesign --display` does not perform any verification of executables/resources, | ||
| // it just parses and displays signature information read from the `Contents` folder. | ||
| "--display", | ||
| // If we don't set verbose it only prints the executable path. | ||
| "--verbose", | ||
| path, | ||
| ).CombinedOutput() // using CombinedOutput because output is in stderr and stdout is empty. | ||
| if err != nil { | ||
| // Logging as debug to prevent non signed apps to generate a lot of logged errors. | ||
| log.Debug().Err(err).Str("output", string(output)).Str("path", path).Msg("codesign --display failed") | ||
| rows = append(rows, row) | ||
| continue | ||
| } | ||
| info := parseCodesignOutput(output) | ||
| row["team_identifier"] = info.teamIdentifier | ||
| rows = append(rows, row) | ||
| } | ||
|
|
||
| return rows, nil | ||
| } | ||
|
|
||
| type parsedInfo struct { | ||
| teamIdentifier string | ||
| } | ||
|
|
||
| func parseCodesignOutput(output []byte) parsedInfo { | ||
| const teamIdentifierPrefix = "TeamIdentifier=" | ||
|
|
||
| scanner := bufio.NewScanner(bytes.NewReader(output)) | ||
| var info parsedInfo | ||
| for scanner.Scan() { | ||
| line := scanner.Text() | ||
| if strings.HasPrefix(line, teamIdentifierPrefix) { | ||
| info.teamIdentifier = strings.TrimSpace(strings.TrimPrefix(line, teamIdentifierPrefix)) | ||
| // "not set" is usually displayed on Apple builtin apps. | ||
| if info.teamIdentifier == "not set" { | ||
| info.teamIdentifier = "" | ||
| } | ||
| } | ||
| } | ||
| return info | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| name: codesign | ||
| platforms: | ||
| - darwin | ||
| description: Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command. | ||
| columns: | ||
| - name: path | ||
| type: text | ||
| required: true | ||
| description: Path is the absolute path to the app folder. | ||
| - name: team_identifier | ||
| type: text | ||
| required: false | ||
| description: Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and built-in Apple applications. | ||
| notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). | ||
| evented: false |
23 changes: 23 additions & 0 deletions
23
...e/mysql/migrations/tables/20241110152839_AddTeamIdentifierToHostSoftwareInstalledPaths.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| package tables | ||
|
|
||
| import ( | ||
| "database/sql" | ||
| "fmt" | ||
| ) | ||
|
|
||
| func init() { | ||
| MigrationClient.AddMigration(Up_20241110152839, Down_20241110152839) | ||
| } | ||
|
|
||
| func Up_20241110152839(tx *sql.Tx) error { | ||
| if _, err := tx.Exec(` | ||
| ALTER TABLE host_software_installed_paths ADD COLUMN team_identifier VARCHAR(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT ''`, | ||
| ); err != nil { | ||
| return fmt.Errorf("failed to add team_identifier to host_software_installed_paths table: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func Down_20241110152839(tx *sql.Tx) error { | ||
| return nil | ||
| } |
Oops, something went wrong.