mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 01:55:20 +00:00
28 lines
1.2 KiB
Plaintext
28 lines
1.2 KiB
Plaintext
table_name("authorizations")
|
|
description("OS X Authorization rights database.")
|
|
schema([
|
|
Column("label", TEXT, "Item name, usually in reverse domain format",
|
|
index=True),
|
|
Column("modified", TEXT, "Label top-level key"),
|
|
Column("allow_root", TEXT, "Label top-level key"),
|
|
Column("timeout", TEXT, "Label top-level key"),
|
|
Column("version", TEXT, "Label top-level key"),
|
|
Column("tries", TEXT, "Label top-level key"),
|
|
Column("authenticate_user", TEXT, "Label top-level key"),
|
|
Column("shared", TEXT, "Label top-level key"),
|
|
Column("comment", TEXT, "Label top-level key"),
|
|
Column("created", TEXT, "Label top-level key"),
|
|
Column("class", TEXT, "Label top-level key"),
|
|
Column("session_owner", TEXT, "Label top-level key"),
|
|
])
|
|
implementation("system/darwin/authorizations@genAuthorizations")
|
|
examples([
|
|
"select * from authorizations;",
|
|
"select * from authorizations where label = 'system.login.console';",
|
|
"select * from authorizations where label = 'authenticate';",
|
|
"select * from authorizations where label = 'system.preferences.softwareupdate';"
|
|
])
|
|
fuzz_paths([
|
|
"/System/Library/Security/authorization.plist",
|
|
])
|