seph
08/16/2021, 1:29 AMminiseph:o seph$ /usr/sbin/spctl -a -vvv --ignore-cache opt/osquery/lib/osquery.app
opt/osquery/lib/osquery.app: code has no resources but signature indicates they must be present
code has no resources but signature indicates they must be present. Most probably structural damage, which should be referred to the developer(says https://eclecticlight.co/2019/06/28/a-primer-on-code-signing-errors/)
.app
. The notarized it. Now it shows as signed and entitled.
I’m less sure how to fix the build to handle this,
I think we’re dumping raw stuff into package-data, which is then signed, and then packaged. And the packaging step converts it to a .app.
But I think that ordering is probably wrong. Instead, we should be shoving the .app into the package data. Which can then be signed, and packaged into to the tar.gz and pkg. (I’d probably say the package-data should basically be identical to the tar.gz)theopolis
08/16/2021, 2:43 AMalessandrogario
08/16/2021, 11:42 AMsharvil
08/16/2021, 11:46 AMseph
08/16/2021, 1:28 PMAre we OK if we sign the binary, then the app bundle?From what I can tell, signing the app bundle overwrites the sig on the plain macho binary.
sharvil
08/16/2021, 1:55 PMspctl
output is a red-herring of sorts (while not ideal)... since our app bundle is a minimal set of things required for it to work
I took the osquery-a08056b68ef64b23d163fafdfe6f0e1681c80a5c.pkg
from the test s3 bucket, installed it on a fresh macOS 11 VM, and things are working fine. It is picking up the entitlements and also the provisioning profile correctly, and I can see es_process_events
flowing inseph
08/16/2021, 1:58 PMosqueryd
from the the bundle, but all the signature verification tools I have say it’s a bad sig. Which makes me think we’re asking for trouble,sharvil
08/16/2021, 2:00 PMseph
08/16/2021, 2:01 PMsharvil
08/16/2021, 2:01 PMroot@osquerytests-Mac # codesign -vvv --strict --deep --display /opt/osquery/lib/osquery.app
Executable=/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
Identifier=osqueryd
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20500 size=311860 flags=0x10000(runtime) hashes=9737+5 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=870a7d77eabc2d12c410060aed030bbe940a81fc
CandidateCDHashFull sha256=870a7d77eabc2d12c410060aed030bbe940a81fc94241ab9824f21f9a96f7348
Hash choices=sha256
CMSDigest=870a7d77eabc2d12c410060aed030bbe940a81fc94241ab9824f21f9a96f7348
CMSDigestType=2
CDHash=870a7d77eabc2d12c410060aed030bbe940a81fc
Signature size=9021
Authority=Developer ID Application: OSQUERY A Series of LF Projects, LLC (3522FA9PXF)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Aug 15, 2021 at 5:52:53 PM
Info.plist=not bound
TeamIdentifier=3522FA9PXF
Runtime Version=11.1.0
Sealed Resources=none
Internal requirements count=1 size=168
root@osquerytests-Mac _CodeSignature #
seph
08/16/2021, 2:05 PMdover:osq5 seph$ codesign -vvv --strict --deep opt/osquery/lib/osquery.app
opt/osquery/lib/osquery.app: code has no resources but signature indicates they must be present
sharvil
08/16/2021, 2:06 PM_CodeSignature/CodeResources
file in the signed app bundleroot@osquerytests-Mac Desktop # find ~/Desktop/osquery.app
/Users/osquerytest/Desktop/osquery.app
/Users/osquerytest/Desktop/osquery.app/Contents
/Users/osquerytest/Desktop/osquery.app/Contents/_CodeSignature
/Users/osquerytest/Desktop/osquery.app/Contents/_CodeSignature/CodeResources
/Users/osquerytest/Desktop/osquery.app/Contents/MacOS
/Users/osquerytest/Desktop/osquery.app/Contents/MacOS/osqueryd
/Users/osquerytest/Desktop/osquery.app/Contents/Resources
/Users/osquerytest/Desktop/osquery.app/Contents/Resources/osqueryctl
/Users/osquerytest/Desktop/osquery.app/Contents/embedded.provisionprofile
/Users/osquerytest/Desktop/osquery.app/Contents/Info.plist
/Users/osquerytest/Desktop/osquery.app/Contents/PkgInfo
root@osquerytests-Mac Desktop # find /opt/osquery/lib/osquery.app
/opt/osquery/lib/osquery.app
/opt/osquery/lib/osquery.app/Contents
/opt/osquery/lib/osquery.app/Contents/MacOS
/opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd
/opt/osquery/lib/osquery.app/Contents/Resources
/opt/osquery/lib/osquery.app/Contents/Resources/osqueryctl
/opt/osquery/lib/osquery.app/Contents/embedded.provisionprofile
/opt/osquery/lib/osquery.app/Contents/Info.plist
/opt/osquery/lib/osquery.app/Contents/PkgInfo
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<http://www.apple.com/DTDs/PropertyList-1.0.dtd>">
<plist version="1.0">
<dict>
<key>files</key>
<dict>
<key>Resources/osqueryctl</key>
<data>
cfmKsVPNeZNg+/+Phdj1bSeUOE4=
</data>
</dict>
<key>files2</key>
<dict>
<key>Resources/osqueryctl</key>
<dict>
<key>hash2</key>
<data>
XK+14UzR5NpyldAfI3YrGoH2v0L1pzZLt/Hb6yBA5ko=
</data>
</dict>
<key>embedded.provisionprofile</key>
<dict>
<key>hash2</key>
<data>
X1tITOEGCKY4oqba+4SFfq3vhZW3rGSe8gjNcIk9t1M=
</data>
</dict>
</dict>
<key>rules</key>
<dict>
<key>^Resources/</key>
<true/>
<key>^Resources/.*\.lproj/</key>
<dict>
<key>optional</key>
<true/>
<key>weight</key>
<real>1000</real>
</dict>
<key>^Resources/.*\.lproj/locversion.plist$</key>
<dict>
<key>omit</key>
<true/>
<key>weight</key>
<real>1100</real>
</dict>
<key>^Resources/Base\.lproj/</key>
<dict>
<key>weight</key>
<real>1010</real>
</dict>
<key>^version.plist$</key>
<true/>
</dict>
<key>rules2</key>
<dict>
<key>.*\.dSYM($|/)</key>
<dict>
<key>weight</key>
<real>11</real>
</dict>
<key>^(.*/)?\.DS_Store$</key>
<dict>
<key>omit</key>
<true/>
<key>weight</key>
<real>2000</real>
</dict>
<key>^(Frameworks|SharedFrameworks|PlugIns|Plug-ins|XPCServices|Helpers|MacOS|Library/(Automator|Spotlight|LoginItems))/</key>
<dict>
<key>nested</key>
<true/>
<key>weight</key>
<real>10</real>
</dict>
<key>^.*</key>
<true/>
<key>^Info\.plist$</key>
<dict>
<key>omit</key>
<true/>
<key>weight</key>
<real>20</real>
</dict>
<key>^PkgInfo$</key>
<dict>
<key>omit</key>
<true/>
<key>weight</key>
<real>20</real>
</dict>
<key>^Resources/</key>
<dict>
<key>weight</key>
<real>20</real>
</dict>
<key>^Resources/.*\.lproj/</key>
<dict>
<key>optional</key>
<true/>
<key>weight</key>
<real>1000</real>
</dict>
<key>^Resources/.*\.lproj/locversion.plist$</key>
<dict>
<key>omit</key>
<true/>
<key>weight</key>
<real>1100</real>
</dict>
<key>^Resources/Base\.lproj/</key>
<dict>
<key>weight</key>
<real>1010</real>
</dict>
<key>^[^/]+$</key>
<dict>
<key>nested</key>
<true/>
<key>weight</key>
<real>10</real>
</dict>
<key>^embedded\.provisionprofile$</key>
<dict>
<key>weight</key>
<real>20</real>
</dict>
<key>^version\.plist$</key>
<dict>
<key>weight</key>
<real>20</real>
</dict>
</dict>
</dict>
</plist>
Which is a plist of all files and "hashes".app
bundle tooseph
08/16/2021, 2:14 PMsharvil
08/16/2021, 2:14 PMseph
08/16/2021, 2:15 PMalessandrogario
08/16/2021, 2:45 PMseph
08/16/2021, 4:06 PMsharvil
08/16/2021, 5:35 PMosquery/osquery
https://github.com/osquery/osquery/pull/7263