mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 02:18:53 +00:00
e205458be0
Summary: This PR is the result of the discussion in a previous PR (#5348) after we determined account_policy_data was the wrong place for the column. Add `is_hidden` column to the users and groups tables in macOS. `is_hidden` is populated by looking for the `dsAttrTypeNative:IsHidden` attribute in the OpenDirectory record for the user/group if the value is `1`, `True`, or `Yes` is_hidden is 1. If the value is anything else it's set to 0. Invalid values have the same affect as the attribute not existing at all. The `dsAttrTypeNative:IsHidden` attribute controls whether a user account is is visible in the preferences panel similar to having a uid < 500. One test failed when running buck test: ``` ====STANDARD OUT==== tests/integration/tables/helper.cpp:159: Failure Value of: boost::get<CustomCheckerType>(validator)(value) Actual: false Expected: true Custom validator of the column "mask" with value "" failed ``` This also fails when I ran the test on the current experimental branch as well. Important to note I had to remove the optimization on both the user and group tables that just called `getpwnam` if the query specified the `uid` or `gid` since the struct returned doesn't contain the `IsHidden` attribute. I'm not sure if or how much this will affect performance since I wasn't able to get the profiling to work with the new version (very likely I'm just doing it incorrectly). Pull Request resolved: https://github.com/facebook/osquery/pull/5368 Differential Revision: D13862375 Pulled By: akindyakov fbshipit-source-id: 1fec88a6ba71884f7e611e1d96ea00630c5be655
24 lines
912 B
Plaintext
Executable File
24 lines
912 B
Plaintext
Executable File
table_name("groups")
|
|
description("Local system groups.")
|
|
schema([
|
|
Column("gid", BIGINT, "Unsigned int64 group ID", index=True),
|
|
Column("gid_signed", BIGINT, "A signed int64 version of gid"),
|
|
Column("groupname", TEXT, "Canonical local group name"),
|
|
])
|
|
extended_schema(WINDOWS, [
|
|
Column("group_sid", TEXT, "Unique group ID", index=True),
|
|
Column("comment", TEXT, "Remarks or comments associated with the group"),
|
|
])
|
|
|
|
extended_schema(DARWIN, [
|
|
Column("is_hidden", INTEGER, "IsHidden attribute set in OpenDirectory"),
|
|
])
|
|
implementation("groups@genGroups")
|
|
examples([
|
|
"select * from groups where gid = 0",
|
|
# Group/user_groups is not JOIN optimized
|
|
#"select g.groupname, ug.uid from groups g, user_groups ug where g.gid = ug.gid",
|
|
# The relative group ID, or RID, is used by osquery as the "gid"
|
|
# For Windows, "gid" and "gid_signed" will always be the same.
|
|
])
|