{"action":"closed","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/3083","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/3083/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/3083/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/3083/events","html_url":"https://github.com/facebook/osquery/issues/3083","id":215014610,"number":3083,"title":"darwin preferences table not reading values enforced by profiles","user":{"login":"groob","id":1526945,"avatar_url":"https://avatars0.githubusercontent.com/u/1526945?v=3","gravatar_id":"","url":"https://api.github.com/users/groob","html_url":"https://github.com/groob","followers_url":"https://api.github.com/users/groob/followers","following_url":"https://api.github.com/users/groob/following{/other_user}","gists_url":"https://api.github.com/users/groob/gists{/gist_id}","starred_url":"https://api.github.com/users/groob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/groob/subscriptions","organizations_url":"https://api.github.com/users/groob/orgs","repos_url":"https://api.github.com/users/groob/repos","events_url":"https://api.github.com/users/groob/events{/privacy}","received_events_url":"https://api.github.com/users/groob/received_events","type":"User","site_admin":false},"labels":[{"id":165050666,"url":"https://api.github.com/repos/facebook/osquery/labels/API%20change","name":"API change","color":"eb6420","default":false},{"id":117911471,"url":"https://api.github.com/repos/facebook/osquery/labels/bug","name":"bug","color":"fc2929","default":true},{"id":118805366,"url":"https://api.github.com/repos/facebook/osquery/labels/macOS","name":"macOS","color":"d4c5f9","default":false},{"id":118805314,"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"207de5","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-03-17T14:11:00Z","updated_at":"2017-07-03T01:29:23Z","closed_at":"2017-07-03T01:29:23Z","body":"I am using the `preferences` table to check for certain keys to be set on user machines. Unfortunately, I've discovered that when the preference is managed with a profile (.mobileconfig), the key is no longer accurately reported through the `preferences`. \r\n\r\nOn a new mac(when the preference is not managed):\r\n```\r\nsudo osqueryi --line 'select * from preferences where domain = \"com.apple.security.firewall\"';\r\n```\r\n\r\nI install [this profile](https://raw.githubusercontent.com/opragel/profiles/efd3ef34a23af821983ff318186a802cd225fd84/macOS%20-%20Force%20Enable%20Firewall.mobileconfig): \r\n\r\nWhich enforces the following keys:\r\n```\r\n\t\t\t<key>BlockAllIncoming</key>\r\n\t\t\t<true/>\r\n\t\t\t<key>EnableFirewall</key>\r\n\t\t\t<true/>\r\n\t\t\t<key>EnableStealthMode</key>\r\n\t\t\t<true/>\r\n```\r\n\r\nStill no output from osquery even though the key is now managed:\r\n```\r\nsudo osqueryi --line 'select * from preferences where domain = \"com.apple.security.firewall\"';\r\n```\r\n\r\nI use `defaults` to set the `EnableFirewall` key to false:\r\n```sudo defaults write com.apple.security.firewall EnableFirewall -bool false```\r\n```\r\nsudo osqueryi --line 'select * from preferences where domain = \"com.apple.security.firewall\"';\r\ndomain = com.apple.security.firewall\r\n   key = EnableFirewall\r\nsubkey =\r\n value = false\r\nforced = 1\r\n  path =\r\n```\r\n\r\nUsing defaults should not have an effect since the profile is still enforcing the actual preferences. Worse though, it's now reporting an incorrect value. \r\n\r\n@headmin has a related issue open to create a profiles table -https://github.com/facebook/osquery/issues/2990. The issue is categorized as a feature request, but IMO this is a bug."}}
{"actor":{"display_login":"theopolis"}}