Magneto
01/27/2021, 7:02 PM~ ❯ sudo /usr/bin/codesign -vvvv --display --entitlements - ~/Downloads/osqueryd
Executable=/Users/user/Downloads/osqueryd
Identifier=osqueryd
Format=Mach-O thin (x86_64)
<snip>
Signature size=9077
Authority=Developer ID Application: Theodore Reed (B89LNTUADM)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Dec 16, 2020 at 10:34:40 PM
Info.plist=not bound
TeamIdentifier=B89LNTUADM
Runtime Version=10.14.0
Sealed Resources=none
Internal requirements count=1 size=168
Mike Myers
01/27/2021, 9:45 PMcom.facebook.osqueryd
elsewhereMagneto
01/27/2021, 9:55 PMMike Myers
01/27/2021, 9:59 PM<key>PayloadDescription</key>
<string>Allow osquery agent to have Full Disk Access</string>
CodeRequirement
fieldI think the certificate fields are wrong.Whatever this says, is what's needed for that field.
codesign -dr - /path/to/osqueryd
Everything after the *`=>` *characters, that is. No leading or trailing spaces.Magneto
01/27/2021, 10:08 PMidentifier osqueryd and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = B89LNTUADM
launchd
URI... I've gone through every release macOS build back to 3.3.2 and the identifier on the final binary is unchanged from osqueryd
Mike Myers
01/27/2021, 11:12 PMallister
01/28/2021, 12:24 AMMike Myers
01/28/2021, 12:40 AMMagneto
01/28/2021, 12:42 AMseph
01/28/2021, 1:16 AMGavin
01/28/2021, 1:50 AM<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<http://www.apple.com/DTDs/PropertyList-1.0.dtd>">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDescription</key>
<string>Osquery + Kolide Launcher FDE</string>
<key>PayloadDisplayName</key>
<string>io.osquery.launcher.fde</string>
<key>PayloadIdentifier</key>
<string>A2E777C7-76EE-429E-AC2B-6C444C9906BD</string>
<key>PayloadOrganization</key>
<string>Example</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>DDB83349-7AC0-40D8-AD46-699A7085600C</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Allowed</key>
<true/>
<key>CodeRequirement</key>
<string>identifier launcher and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = YZ3EM74M78</string>
<key>Comment</key>
<string></string>
<key>Identifier</key>
<string>/usr/local/launcher/bin/launcher</string>
<key>IdentifierType</key>
<string>path</string>
</dict>
<dict>
<key>Allowed</key>
<true/>
<key>CodeRequirement</key>
<string>identifier osqueryd and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = B89LNTUADM</string>
<key>Comment</key>
<string></string>
<key>Identifier</key>
<string>/usr/local/launcher/bin/osqueryd</string>
<key>IdentifierType</key>
<string>path</string>
</dict>
</array>
</dict>
</dict>
</array>
<key>PayloadDescription</key>
<string>Kolide Launcher FDE</string>
<key>PayloadDisplayName</key>
<string>io.osquery.launcher.fde</string>
<key>PayloadIdentifier</key>
<string>io.osquery.launcher.fde</string>
<key>PayloadOrganization</key>
<string>Example</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>D3F2BC82-B1FE-4A08-9ACD-DB72CFDD4F71</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>payloadScope</key>
<string>system</string>
</dict>
</plist>
theopolis
01/28/2021, 2:14 AM