https://github.com/osquery/osquery logo
Powered by
Title
o

oneiroi

05/02/2023, 9:50 AM
Hello all, Apple have released a Rapid Security update this applies the fixes but does not bump the 
os_version.version
in the application of the RSR, my query is, where might this be tracked ? I'll be looking at the 
os_version.build
though I am not certain this will change either, has anyone had the opportunity to review the RSR's introduced in macOS > 13.x (Ventura) as yet ? Many thanks!
sudo softwareupdate -ai
Downloading macOS Security Response 13.3.1 (a)
Will be re-checking the 
os_version
table after application to see what (if anything) changes
➜  ~ ~/osqueryi --line
Using a virtual database. Need help, type '.help'
osquery> select * from os_version;
         name = macOS
      version = 13.3.1
        major = 13
        minor = 3
        patch = 1
        build = 22E261
     platform = darwin
platform_like = darwin
     codename = 
         arch = arm64
Downloading: 100.00%
Downloaded: macOS Security Response 13.3.1 (a)
a

allister

05/02/2023, 11:23 AM
It won’t see it, it’s checking the SystemVersion plist. MDM could inventory it
I’d be surprised if there wasn’t already a feature request in to find a way to grab it without shelling out… or use an extension to shell out, it’s pretty easy to get at from e.g. sw_vers
s

seph

05/02/2023, 1:15 PM
Hrm. One of my coworkers observes this is not in the 
os_version
table. I wonder if we can expose that 
osquery> SELECT * FROM os_version;
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+
| name  | version | major | minor | patch | build  | platform | platform_like | codename | arch  |
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+
| macOS | 13.3.1  | 13    | 3     | 1     | 22E261 | darwin   | darwin        |          | arm64 |
+-------+---------+-------+-------+-------+--------+----------+---------------+----------+-------+
Oh. Because, as allister said, osquery is reading this from 
/System/Library/CoreServices/SystemVersion.plist
I can’t break out the debugger this morning, but I wonder where 
sw_vers
is pulling from
Dumped some info into https://github.com/osquery/osquery/issues/8008
g

grahamgilbert

05/04/2023, 7:36 PM
Threw this up quick in case anyone needs it prior to it being added to osquery proper https://github.com/macadmins/osquery-extension/pull/31
s

seph

05/04/2023, 8:15 PM
One quick hack is to use pure sql using the plist table.
4 Views
#macosJoin Slack
Powered by