Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
macOS preferences not checking the by-host level. #3501
If a preference is set at the "Current Host"(as opposed to AnyHost), then osquery will miss it.
If a preference was set with
In a document on preferences, apple notes that preferences could exist in any of the following domains.
Using the script below, we'll set the preference as
Run osqueryi. The reported value is the one set for
An additional note. I was just tinkering with the
CFPreferences reports that they key is set in the ByHost level when checked in the GUI.
I am not sure, but it's likely that this behavior is default for many of the system GUI panes that the user interacts with. If so, having osquery read the CurrentHost domain seems very important if we're to rely on the table for compliance.
Much here boils down to:
1 is more thorough, but there's potentially a lot of noise there. 2 is probably what most people want to know if they are querying prefs for compliance monitoring.