Hello all, Apple have released a Rapid Security update this applies the fixes but does not bump the

os_version.version

in the application of the RSR, my query is, where might this be tracked ? I'll be looking at the

os_version.build

though I am not certain this will change either, has anyone had the opportunity to review the RSR's introduced in macOS > 13.x (Ventura) as yet ? Many thanks!

It won’t see it, it’s checking the SystemVersion plist. MDM could inventory it

Hrm. One of my coworkers observes this is not in the

os_version

table. I wonder if we can expose that

osquery> SELECT * FROM os_version;
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+
| name  | version | major | minor | patch | build  | platform | platform_like | codename | arch  |
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+
| macOS | 13.3.1  | 13    | 3     | 1     | 22E261 | darwin   | darwin        |          | arm64 |
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+

Threw this up quick in case anyone needs it prior to it being added to osquery proper https://github.com/macadmins/osquery-extension/pull/31

One quick hack is to use pure sql using the plist table.

@seph I've been hunting for the plist file to query, would this be

/System/Library/CoreServices/SystemVersion.plist

or some other path ? Additional to update this thread; please be aware that Apple have recalled the 13.4.1a update with 13.4.1b noted to be available "soon"

Are you looking for

/System/Cryptexes/OS/System/Library/CoreServices/SystemVersion.plist

?

If that's what contains the RSR revisions, then, yes; though looks like my 13.4.1a got pulled if that is the correct path

That’s what’s running on the machine. I think, I don’t totally understand all the details

I see this GH PR Thread where this is also discussed back in may, a mute point right now as the RSR has been recalled, until such time we need to track the (b) (or whatever naming convention Apple finally settle on) 😓

Isn’t there a new RSR now?

Indeed, apple noted they are recalling the RSR in this and looking at my system right now, /System/Cryptexes/OS/System/Library/CoreServices/SystemVersion.plist is showing

<string>macOS</string>
        <key>ProductUserVisibleVersion</key>
        <string>13.4.1</string>
        <key>ProductVersion</key>
        <string>13.4.1</string>

I don’t understand what apple’s rollback has to do with how osquery reports what the machine is running

Not sure anything in oquery would be affected, only any checks / queries anyone has implemented looking for 13.4.1a vs 13.4.1 of course; so if a query / pack is in place that checks for the "latest" 13.4.1a version that would start to fail.

Oh. Yes. I had “fun” with that yesturday

13.4.1(c) is now out; I've been working on a query against the

plist

table that uses `/System/Cryptexes/OS/System/Library/CoreServices/SystemVersion.plist`; though looks like this does not exist on macOS version 12.6.7 there is this plist file

/System/Library/CoreServices/SystemVersion.plist

though sadly does not carry the

ProductVersionExtra

was hoping to not need to introduce an

IF

however seems that I may need to do so, as RSR's were introduced after 13.4.1 iirc thus to support both 12.6.x and 13.4.x versions in the query I don't see another approach, any thoughts on this ?

As I understand it

/System/Library/CoreServices/SystemVersion.plist

will never have the RSR. If the RSR is installed,

/System/Cryptexes/OS/System/Library/CoreServices/SystemVersion.plist

will be correct. Or you could just use osquery 5.9.1, we declared it stable last night, but haven’t updated the web site.

awesome, I'll t.a.l at the updated osquery. Thanks!

🦜 looking forward to ripping the table out of the macadmins extension