Skip to content

Conversation

@lucasmrod
Copy link
Contributor

@lucasmrod lucasmrod commented Sep 24, 2024

Fixes #8395, with three columns marked as not supported (details documented in genALFFromSystemProfiler):

// Currently on macOS 15+ osquery supports the following 'alf' columns:
//
// 'global_state', 'stealth_enabled', 'logging_enabled', and 'version'.
// These columns are populated from information gathered from system_profiler's
// "SPFirewallDataType".
//
// 'alf' columns that are not supported (returned empty) on macOS 15+:
//
//  - 'allow_signed_enabled': (As of September 24th, 2024) This setting is only
//  exposed through
//    executing '/usr/libexec/ApplicationFirewall/socketfilterfw
//    --getallowsigned'.
//  - 'logging_option': Quote from https://support.apple.com/en-jo/121011: "The
//  EnableLogging and
//    LoggingOption keys in the Firewall payload are deprecated and no longer
//    necessary. Application Firewall logging is increased by default for the
//    socketfilterfw process."
//  - 'firewall_unload': This does not seem available on system_profiler's
//  "SPFirewallDataType"
//    or the socketfilterfw command.

Tables alf_exceptions and alf_explicit_auths are also not returning results on macOS 15+ (because they read from the same plist that doesn't exist anymore). I wanted to keep this PR as small as possible because the main alf table is probably the most important setting to support. Issues:

@zwass
Copy link
Member

zwass commented Sep 25, 2024

The approach lgtm. Let's add a test and merge it!

@lucasmrod
Copy link
Contributor Author

@zwass Sanity test added.

pt::ptree tree;
auto s = genALFTreeFromFilesystem(tree);
if (!s.ok()) {
const auto& qd = SQL::selectAllFrom("os_version");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My memory is that there's some effort to avoid calling SQL select from within tables -- it's part of some long range issue around test size, and include files. But since I know we do it a bunch, and I don't offhand know the alternative, I'm not blocking over it

Copy link
Member

@Smjert Smjert Oct 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The better alternative is to export the common logic needed from the tables in utility functions, instead of using SQL and the tables.
In some cases it's a matter of performance, in other it's a matter of unnecessary (or even problematic) dependencies among tables or other parts of codes.

The worse offender is the core depending on tables. It's a dependency loop and affects that necessity we have to include all symbols from archive files when linking, even if actually unused, which in turn causes test binaries to be unnecessarily big, slowing down compilation and hitting disk limits.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like some overall effort is needed to refactor all of them. Otherwise people like me will keep mimicking existing code :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah it's a process that I started multiple times, arriving also at seeing the improvements in size (3x reduction was the minimum), but time is an issue when doing it all together.

That being said, converting tables one by one can still be done, and then a policy to avoid getting more.
It's mostly a matter on the reviewers being on the same page on what's the direction.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

alf table returns no results on macOS 15 Sequoia

4 participants