valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #743 from theopolis/env_ele_apps

Browse Source 
Add environment/element to OS X apps
This commit is contained in:
Teddy Reed 2015-02-11 18:38:11 -08:00
commit 65e0da4790
3 changed files with 31 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
osquery/tables/specs/darwin/apps.table
View File

@ -3,19 +3,29 @@ description("OS X applications installed in known search paths (e.g., /Applicati
schema([
Column("name", TEXT, "Name of the Name.app folder"),
Column("path", TEXT, "Absolute and full Name.app path"),
Column("bundle_executable", TEXT, "Info properties CFBundleExecutable label"),
Column("bundle_identifier", TEXT, "Info properties CFBundleIdentifier label"),
Column("bundle_executable", TEXT,
"Info properties CFBundleExecutable label"),
Column("bundle_identifier", TEXT,
"Info properties CFBundleIdentifier label"),
Column("bundle_name", TEXT, "Info properties CFBundleName label"),
Column("bundle_short_version", TEXT, "Info properties CFBundleShortVersionString label"),
Column("bundle_short_version", TEXT,
"Info properties CFBundleShortVersionString label"),
Column("bundle_version", TEXT, "Info properties CFBundleVersion label"),
Column("bundle_package_type", TEXT, "Info properties CFBundlePackageType label"),
Column("bundle_package_type", TEXT,
"Info properties CFBundlePackageType label"),
Column("environment", TEXT, "Application-set environment variables"),
Column("element", TEXT, "Does the app identify as a background agent"),
Column("compiler", TEXT, "Info properties DTCompiler label"),
Column("development_region", TEXT, "Info properties CFBundleDevelopmentRegion label"),
Column("development_region", TEXT,
"Info properties CFBundleDevelopmentRegion label"),
Column("display_name", TEXT, "Info properties CFBundleDisplayName label"),
Column("info_string", TEXT, "Info properties CFBundleGetInfoString label"),
Column("minimum_system_version", TEXT, "Info properties LSMinimumSystemVersion label"),
Column("category", TEXT, "Info properties LSApplicationCategoryType label"),
Column("applescript_enabled", TEXT, "Info properties NSAppleScriptEnabled label"),
Column("minimum_system_version", TEXT,
"Minimum version of OS X required for the app to run"),
Column("category", TEXT,
"The UTI that categorizes the app for the App Store"),
Column("applescript_enabled", TEXT,
"Info properties NSAppleScriptEnabled label"),
Column("copyright", TEXT, "Info properties NSHumanReadableCopyright label"),
])
implementation("apps@genApps")

13
osquery/tables/system/darwin/apps.cpp
View File

@ -30,6 +30,8 @@ const std::map<std::string, std::string> kAppsInfoPlistTopLevelStringKeys = {
{"CFBundleShortVersionString", "bundle_short_version"},
{"CFBundleVersion", "bundle_version"},
{"CFBundlePackageType", "bundle_package_type"},
{"LSEnvironment", "environment"},
{"LSUIElement", "element"},
{"CFBundleDevelopmentRegion", "development_region"},
{"CFBundleDisplayName", "display_name"},
{"CFBundleGetInfoString", "info_string"},
@ -103,9 +105,16 @@ Row parseInfoPlist(const std::string& path, const pt::ptree& tree) {
for (const auto& it : kAppsInfoPlistTopLevelStringKeys) {
try {
r[it.second] = tree.get<std::string>(it.first);
// Change boolean values into integer 1, 0.
if (r[it.second] == "true" || r[it.second] == "YES" ||
r[it.second] == "Yes") {
r[it.second] = INTEGER(1);
} else if (r[it.second] == "false" || r[it.second] == "NO" ||
r[it.second] == "No") {
r[it.second] = INTEGER(0);
}
} catch (const pt::ptree_error& e) {
VLOG(1) << "Error retrieving " << it.first << " from " << path << ": "
<< e.what();
// Expect that most of the selected keys are missing.
r[it.second] = "";
}
}

2
osquery/tables/system/darwin/apps_tests.cpp
View File

@ -78,6 +78,8 @@ TEST_F(AppsTests, test_parse_info_plist) {
{"bundle_short_version", "6.0"},
{"bundle_version", "517"},
{"bundle_package_type", "APPL"},
{"environment", ""},
{"element", ""},
{"compiler", "com.apple.compilers.llvm.clang.1_0"},
{"development_region", "English"},
{"display_name", ""},