https://github.com/osquery/osquery logo
Join Slack
Powered by
For macOS, the software/titles query for `Safari` ...
# fleet
b
For macOS, the software/titles query for 
Safari
returns both Safari and Safari extensions. However some extensions just report their name as 
Safari
and not as the extension name. In this case the extension is AdGuard mini. I see other extensions that are reporting their real name. How do we get AdGuard mini to report it's correct name here?
u
Hi @Bruce Banner! Can you try running this query to grab Extensions so we can see exactly what's being returned?
Copy code
SELECT * FROM safari_extensions
Feel free to narrow down the returned data to just the extension we're looking at, I didn't want to do any conditional checks since there's a chance the name is returning oddly from osquery.
Can you also let me know what version of Fleet you're running?
b
Copy code
osquery> SELECT * FROM safari_extensions;
W0304 16:28:47.896507 166847040 virtual_table.cpp:1005] The safari_extensions table returns data based on the current user by default, consider JOINing against the users table
W0304 16:28:47.896571 166847040 virtual_table.cpp:1022] Please see the table documentation: <https://osquery.io/schema/#safari_extensions>
osquery>
osquery is version 5.20.0. Fleet 4.80.1 • Go go1.25.6
running that query from fleet returns the same -- no results
This query in fleet does return results
Copy code
SELECT * FROM users CROSS JOIN safari_extensions USING (uid);
and here i redacted some info
Copy code
select 'h' as Host, bundle_version, identifier, name, uuid, version FROM users CROSS JOIN safari_extensions USING (uid);
New Query - Results (03-04-26 04-43-00).csv
probably should have included path, which is 
/Applications/AdGuard <http://Mini.app/Contents/PlugIns/%.appex/Contents/Info.plist|Mini.app/Contents/PlugIns/%.appex/Contents/Info.plist>
There are 7 such files and one of them contains the plain string 
Safari
, and is the only one with 
CFBundleIdentifier
of 
com.adguard.safari.AdGuard.Extension
(which is the in the 
identifier
column of the query results. So I guess that's on those guys that they have a bad name? Would it be useful for fleet/osquery to take the name from whatever's in 
/Applications
instead, if the name in the Info.plist == Safari?
Copy code
$ pwd
/Applications/AdGuard <http://Mini.app/Contents/PlugIns|Mini.app/Contents/PlugIns>
$ ls */Contents/Info.plist
CustomContentBlocker.appex/Contents/Info.plist   OtherContentBlocker.appex/Contents/Info.plist    PrivacyContentBlocker.appex/Contents/Info.plist  SocialContentBlocker.appex/Contents/Info.plist
GeneralContentBlocker.appex/Contents/Info.plist  PopupExtension.appex/Contents/Info.plist         SecurityContentBlocker.appex/Contents/Info.plist
$ grep Safari */Contents/Info.plist
CustomContentBlocker.appex/Contents/Info.plist:         <string>com.apple.Safari.content-blocker</string>
CustomContentBlocker.appex/Contents/Info.plist:         <key>SFSafariWebsiteAccess</key>
GeneralContentBlocker.appex/Contents/Info.plist:                <string>com.apple.Safari.content-blocker</string>
GeneralContentBlocker.appex/Contents/Info.plist:                <key>SFSafariWebsiteAccess</key>
OtherContentBlocker.appex/Contents/Info.plist:          <string>com.apple.Safari.content-blocker</string>
OtherContentBlocker.appex/Contents/Info.plist:          <key>SFSafariWebsiteAccess</key>
PopupExtension.appex/Contents/Info.plist:       <string>Safari</string>
PopupExtension.appex/Contents/Info.plist:               <string>com.apple.Safari.extension</string>
PopupExtension.appex/Contents/Info.plist:               <string>PopupExtension.SafariExtensionHandler</string>
PopupExtension.appex/Contents/Info.plist:               <key>SFSafariContentScript</key>
PopupExtension.appex/Contents/Info.plist:               <key>SFSafariToolbarItem</key>
PopupExtension.appex/Contents/Info.plist:               <key>SFSafariWebsiteAccess</key>
PrivacyContentBlocker.appex/Contents/Info.plist:                <string>com.apple.Safari.content-blocker</string>
PrivacyContentBlocker.appex/Contents/Info.plist:                <key>SFSafariWebsiteAccess</key>
SecurityContentBlocker.appex/Contents/Info.plist:               <string>com.apple.Safari.content-blocker</string>
SecurityContentBlocker.appex/Contents/Info.plist:               <key>SFSafariWebsiteAccess</key>
SocialContentBlocker.appex/Contents/Info.plist:         <string>com.apple.Safari.content-blocker</string>
SocialContentBlocker.appex/Contents/Info.plist:         <key>SFSafariWebsiteAccess</key>
đź‘€ 1
r
Hi Bruce! Unfortunately, we can't get osquery reports for 
name
without modifying the extension’s Info.plist or introducing an osquery patch that special‑cases this extension. The current behavior is “correct” from osquery’s perspective, just not helpful for you. Maybe the AdGuard team would be open to fixing their bug. From Fleet's GUI though, you are able to modify the name in the GUI if you have a software installer attached to it. That name will appear across all of Fleet's GUI as whatever you change it to.
ty 1
if you have a software installer attached to it
These belong to teams which is a premium feature
b
we do have a teams instance. we install this out of band though, not via fleet. i'll figure out how to contact adguard
r
Oh sweet, yeah, you can add an installer and target it to no hosts, then go to edit appearance and update the display name to whatever you like. At least in the GUI it'll show the display name everywhere!
âś… 1
Screenshot 2026-03-06 at 9.20.11 AM.png
10 Views
Open in Slack
PreviousNext
Powered by