-
Notifications
You must be signed in to change notification settings - Fork 431
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add team_identifier to macOS software
- Loading branch information
Showing
14 changed files
with
414 additions
and
69 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| * Added `team_identifier` to Apple macOS software. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| //go:build darwin | ||
| // +build darwin | ||
|
|
||
| // Package codesign implements an extension osquery table | ||
| // to get signature information of macOS applications. | ||
| package codesign | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "bytes" | ||
| "context" | ||
| "errors" | ||
| "os/exec" | ||
| "strings" | ||
|
|
||
| "github.com/osquery/osquery-go/plugin/table" | ||
| "github.com/rs/zerolog/log" | ||
| ) | ||
|
|
||
| // Columns is the schema of the table. | ||
| func Columns() []table.ColumnDefinition { | ||
| return []table.ColumnDefinition{ | ||
| // path is the absolute path to the app folder. | ||
| // It's required and only supports the equality operator. | ||
| table.TextColumn("path"), | ||
| // team_identifier is the "Team ID", aka "Signature ID", "Developer ID". | ||
| // The value is "" if the app doesn't have a team identifier set. | ||
| // (this is the case for example for builtin Apple apps). | ||
| // | ||
| // See https://developer.apple.com/help/account/manage-your-team/locate-your-team-id/. | ||
| table.TextColumn("team_identifier"), | ||
| } | ||
| } | ||
|
|
||
| // Generate is called to return the results for the table at query time. | ||
| // | ||
| // Constraints for generating can be retrieved from the queryContext. | ||
| func Generate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) { | ||
| constraints, ok := queryContext.Constraints["path"] | ||
| if !ok || len(constraints.Constraints) == 0 { | ||
| return nil, errors.New("missing path") | ||
| } | ||
|
|
||
| var paths []string | ||
| for _, constraint := range constraints.Constraints { | ||
| if constraint.Operator != table.OperatorEquals { | ||
| return nil, errors.New("only supported operator for 'path' is '='") | ||
| } | ||
| paths = append(paths, constraint.Expression) | ||
| } | ||
|
|
||
| var rows []map[string]string | ||
| for _, path := range paths { | ||
| row := map[string]string{ | ||
| "path": path, | ||
| "team_identifier": "", | ||
| } | ||
| output, err := exec.CommandContext(ctx, "/usr/bin/codesign", | ||
| // `codesign --display` does not perform any verification of executables/resources, | ||
| // it just parses and displays signature information read from the `Contents` folder. | ||
| "--display", | ||
| // If we don't set verbose it only prints the executable path. | ||
| "--verbose", | ||
| path, | ||
| ).CombinedOutput() // using CombinedOutput because output is in stderr and stdout is empty. | ||
| if err != nil { | ||
| // Logging as debug to prevent non signed apps to generate a lot of logged errors. | ||
| log.Debug().Err(err).Str("output", string(output)).Str("path", path).Msg("codesign --display failed") | ||
| rows = append(rows, row) | ||
| continue | ||
| } | ||
| info := parseCodesignOutput(output) | ||
| row["team_identifier"] = info.teamIdentifier | ||
| rows = append(rows, row) | ||
| } | ||
|
|
||
| return rows, nil | ||
| } | ||
|
|
||
| type parsedInfo struct { | ||
| teamIdentifier string | ||
| } | ||
|
|
||
| func parseCodesignOutput(output []byte) parsedInfo { | ||
| const teamIdentifier = "TeamIdentifier=" | ||
|
|
||
| scanner := bufio.NewScanner(bytes.NewReader(output)) | ||
| var info parsedInfo | ||
| for scanner.Scan() { | ||
| line := scanner.Text() | ||
| if strings.HasPrefix(line, teamIdentifier) { | ||
| info.teamIdentifier = strings.TrimSpace(strings.TrimPrefix(line, teamIdentifier)) | ||
| // "not set" is usually displayed on Apple builtin apps. | ||
| if info.teamIdentifier == "not set" { | ||
| info.teamIdentifier = "" | ||
| } | ||
| } | ||
| } | ||
| return info | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| name: codesign | ||
| platforms: | ||
| - darwin | ||
| description: Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command. | ||
| columns: | ||
| - name: path | ||
| type: text | ||
| required: true | ||
| description: Path is the absolute path to the app folder. | ||
| - name: team_identifier | ||
| type: text | ||
| required: false | ||
| description: Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and builtin Apple applications. | ||
| notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)). | ||
| evented: false |
23 changes: 23 additions & 0 deletions
23
server/datastore/mysql/migrations/tables/20241110152838_AddTeamIdentifierToSoftware.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| package tables | ||
|
|
||
| import ( | ||
| "database/sql" | ||
| "fmt" | ||
| ) | ||
|
|
||
| func init() { | ||
| MigrationClient.AddMigration(Up_20241110152838, Down_20241110152838) | ||
| } | ||
|
|
||
| func Up_20241110152838(tx *sql.Tx) error { | ||
| if _, err := tx.Exec(` | ||
| ALTER TABLE software ADD COLUMN team_identifier VARCHAR(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT ''`, | ||
| ); err != nil { | ||
| return fmt.Errorf("failed to add team_identifier to software table: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func Down_20241110152838(tx *sql.Tx) error { | ||
| return nil | ||
| } |
Oops, something went wrong.