Add macOS plugins#1727
Conversation
…ptor where not used
| """macOS contents info plugin.""" | ||
|
|
||
| PATHS = ( | ||
| "/Applications/*/*.app/Contents/Info.plist", |
There was a problem hiding this comment.
What about apps in /Applications/*.app?
Might be nice to add a utility for iterating applications and kexts. It could yield paths for every .app and .kext it finds (within known locations), as well as perform some basic nested plugin/bundle checks for each one. That way, you don't end up with an evergrowing list of glob patterns scattered over different plugins. Plugins that act on these packages would then just look into path / "Contents/Info.plist" for every path the helper returns.
I.e. search within certain paths for *.app, .kext, .framework (/Applications, /System/Library/CoreServices, /System//Library/Extensions etc), then for each of those paths, recursively check for Contents/PlugIns and Contents/Resources and additional apps, kexts, frameworks, plugins and bundles in here.
A applications plugin could utilize this information too (as we also have them for Linux and Windows).
Some suggestions:
- I forget the exact nomenclature, but I believe Apple generally calls these "bundles", so you could make a
bundles.py - Within there, you could add some exports (or
@internal, which are plugin functions that are solely meant to be used by other plugins, not tools liketarget-query) for some of the individual types of bundles, and something to iterate over them all - This plugin and e.g. the code signature one would simple iterate over the results of that plugin
There was a problem hiding this comment.
I have added a find_bundle_files helper function in macos/helpers/build_paths.py, but I'm not quite satisfied with the performance yet.
…ences.py Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
3 participants
Added various macOS plugins.
Parsers for install, system, wifi, fsck_apfs, asl logs and fs events
Locale parsers for timezone, language, install date & location services
Plist parsers for: LaunchAgents, LaunchDaemons, Login Items, Airport Preferences, Code Signature Coderesources, Contents Info, Contents Version, Global User Preferences, Groups, Installation History, Keyboard Layout, Login Window, Resources Info Strings, User Password Hashes (Shadow), Software Update Preferences, System Preferences, Time Machine, Safari Per Site Zoom Preferences, Safari Downloads, Safari Recently Closed Tabs & Safari User Notification Permissions
SQLite parsers for: Authorization Rules, Call History, Directory Services Local Nodes, Duet Activity Scheduler, Duet KnowledgeC, Duet InteractionC, Gatekeeper Opaque, Identity Services, Keychain, Notes, TCC, Text Replacements, User Accounts, Safari Favicons & Safari Per Site Preferences
Parsers for macOS cron tabs, at jobs & periodic functions
Added parser for Resources Localizable Strings, but it still has some issues (new records do not always begin on a new line). Also have not written tests for this artifact yet. Not sure how valuable the artifact is considering it appears to just contain a list of translations.
Added build_records.py helper file to build SQLite and Plist records and match them to the provided record descriptors
This PR was initially based on #1637
ASL & fs events plugins are based on #1717
This PR includes #1753