Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new values to kolide_remotectl #1783

Merged
merged 2 commits into from
Jul 17, 2024

Conversation

Micah-Kolide
Copy link
Contributor

With MacOS 15 there are some new values returned from remotectl dumpstate. This broke the parser, but fortunately it's a small change to fix. The new EncryptedRemoteXPCPopulatedOIDs is the same format as Features, so I could use that parse method. However, Identity was also added with a slightly different data format which I added a new method for.

I've added my test data for this change, but it shouldn't change how it worked prior to this PR.

@Micah-Kolide
Copy link
Contributor Author

osquery> SELECT * FROM kolide_remotectl WHERE parent IN ('Local device/Properties/EncryptedRemoteXPCPopulatedOIDs', 'Local device/Identity');
+-----------------------------------------------------------+---------------------------------------------------------+-------------------+----------------------------------------------+-------+
| fullkey                                                   | parent                                                  | key               | value                                        | query |
+-----------------------------------------------------------+---------------------------------------------------------+-------------------+----------------------------------------------+-------+
| Local device/Identity/Public key SHA256                   | Local device/Identity                                   | Public key SHA256 | /3829hunfe927fh972eht972efhjeo82hfo2ehgo2ru= | *     |
| Local device/Properties/EncryptedRemoteXPCPopulatedOIDs/0 | Local device/Properties/EncryptedRemoteXPCPopulatedOIDs | 0                 | 1.2.111.000000.100.6.22                      | *     |
| Local device/Properties/EncryptedRemoteXPCPopulatedOIDs/1 | Local device/Properties/EncryptedRemoteXPCPopulatedOIDs | 1                 | 1.2.111.000000.100.6.23                      | *     |
+-----------------------------------------------------------+---------------------------------------------------------+-------------------+----------------------------------------------+-------+

@Micah-Kolide Micah-Kolide added this pull request to the merge queue Jul 17, 2024
Merged via the queue into main with commit 5a86aab Jul 17, 2024
32 checks passed
@Micah-Kolide Micah-Kolide deleted the micah/add_new_values_to_kolide_remotectl branch July 17, 2024 20:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants