July 2013 - SCAP-On-Apple - lists.macosforge.org

Re: [SCAP-On-Apple] Mac OS X proposed pkginfo OVAL Test.
by Jacobsen, Jasen W. 24 Jul '13

24 Jul '13

At this year's Developer Days Workshop I presented a briefing to the OVAL developer community proposing an addition to OVAL that would allow querying of the OS X package receipt database as exposed by "pkgutil --pkg-info". During the briefing, I raised the issue – and it was confirmed by the Apple representatives attending – that while, the package receipt database provides historical data of what the Installer did, it does not necessarily represent current system state. E.g an application may have been installed at one time, but the user may have thrown it in the trash and deleted it; the receipt database would not reflect that change. The consensus from the attendees was that it would be preferable for OVAL to have a way to report accurate current system state rather than historical data that may not represent current system state. And until such an accurate reporting feature is available, it would be best to avoid adding a feature that exposes the package receipt database – thus perhaps leading OVAL content authors to write content that would return unreliable results. Based on that guidance, I look forward to working with the SCAP on Apple community to develop OVAL features to provide system auditing capabilities that comply with OS X best practices. Thanks to all who participated in the discussion leading up to the presentation. The insight you provided helped guide the OVAL developer community to make an informed decision. - Jasen.

1 0

Mac OS X proposed pkginfo OVAL Test.
by Jacobsen, Jasen W. 21 Jul '13

21 Jul '13

The Mac OS Installer program writes receipt files to a database after installing software. This receipt information includes version, install time, install volume, install location, and any groups the installed package may be a part of. This receipt information is precisely the type of data OVAL is frequently used to examine. This sort of information is already collected in other component schemas using the dpkginfo, rmpinfo, and other tests. The Apple provided way to get at this information is the "pkgutil" command line tool. It is proposed to create an OVAL test and supporting items based on the "pkgutil --pkg-info" command output. A detailed paper describing this test can be found at https://github.com/OVALProject/Sandbox/blob/master/resources/x-macos-pkginf…<https://github.com/jasenj1/Sandbox/blob/master/resources/x-macos-pkginfo/Ma…> The proposed schema can be viewed at https://github.com/OVALProject/Sandbox/blob/master/x-macos-pkginfo.xsd<https://github.com/jasenj1/Sandbox/blob/master/x-macos-pkginfo.xsd> The Linux rpminfo test is very similar to what is being proposed and provides a good model. http://oval.mitre.org/language/version5.10.1/ovaldefinition/documentation/l… The structure of the proposed test is as follows: pkginfo_object package_id – The ID of the package to examine (volume? - pkgutil allows a different volume to be specified. It's unclear if this would be needed or useful.) pkginfo_state & pkginfo_item package_id – The ID of the package examined version – The version of the package install_time – When the package was installed. Given in seconds since the UNIX epoch. volume – The volume the package is installed on. location – The path where the package was installed, if specified at time of install. group – The group(s) the package is a part of. Element repeats for multiple groups. (filepath?– file(s) associated with the package. See question below for discussion of this.) Questions: Exactly what portions of the information provided by --pkg-info are needed for OVAL? e.g. Volume, location, group, filepath? Is there a public API to get the information provided by pkgutil? Or is calling the command the only way to get it? The rpminfo test has a "filepaths" behavior that will collect all of the files associated with a package. pkgutil supports the same function using the "-- files" command. Should this be added to the pkginfo test?

6 15

Re: [SCAP-On-Apple] [SCAP-On-Apple-Dev] Mac OS X proposed pkginfo OVAL Test.
by Jacobsen, Jasen W. 16 Jul '13

16 Jul '13

"Perhaps a systemprofiler_test is what's really in order, that could accept an XPATH like the OVAL ind:xmlfilecontent_test…" That seems to be where the discussion is headed – that there should be a test (or tests) based on system_profiler. But that does not resolve the discussion of whether there should or shouldn't be a test to examine the package receipt database. - Jasen. From: David Solin <david(a)joval.org<mailto:david@joval.org>> Organization: jOVAL Date: Monday, July 15, 2013 5:35 PM To: "scap-on-apple-dev(a)lists.macosforge.org<mailto:scap-on-apple-dev@lists.macosforge.org>" <scap-on-apple-dev(a)lists.macosforge.org<mailto:scap-on-apple-dev@lists.macosforge.org>> Subject: Re: [SCAP-On-Apple-Dev] [SCAP-On-Apple] Mac OS X proposed pkginfo OVAL Test. The system profiler has been the go-to authority for inventory information on OSX for as long as I can remember. So long, in fact, that I'd forgotten about it! (I once used it as the data source for an OSX Mac inventory solution for a demo). Perhaps a systemprofiler_test is what's really in order, that could accept an XPATH like the OVAL ind:xmlfilecontent_test... Regards, --David Solin

1 0

Re: [SCAP-On-Apple] [SCAP-On-Apple-Dev] Mac OS X proposed pkginfo OVAL Test.
by Jacobsen, Jasen W. 16 Jul '13

16 Jul '13

What about non application things like libraries, printer drivers or browser plug-ins? And can you elaborate a little on "use a metadata query and launch services to locate the apps"? Perhaps there are other OS X capabilities that OVAL should make available to system auditors. - Jasen. From: Josh Wisenbaker <dubs(a)apple.com<mailto:dubs@apple.com>> Date: Friday, July 12, 2013 11:44 AM To: Shane Shaffer <shane.shaffer(a)g2-inc.com<mailto:shane.shaffer@g2-inc.com>> Cc: MITRE Employee <jasenj1(a)mitre.org<mailto:jasenj1@mitre.org>>, oval-developer-list OVAL Developer List/Closed Public Discussion <oval-developer-list(a)lists.mitre.org<mailto:oval-developer-list@lists.mitre.org>>, "scap-on-apple(a)lists.macosforge.org<mailto:scap-on-apple@lists.macosforge.org>" <scap-on-apple(a)lists.macosforge.org<mailto:scap-on-apple@lists.macosforge.org>>, "scap-on-apple-dev(a)lists.macosforge.org<mailto:scap-on-apple-dev@lists.macosforge.org>" <scap-on-apple-dev(a)lists.macosforge.org<mailto:scap-on-apple-dev@lists.macosforge.org>> Subject: Re: [SCAP-On-Apple-Dev] [SCAP-On-Apple] Mac OS X proposed pkginfo OVAL Test. As for finding installed applications I’ve always found the best option is to use a metadata query and launch services to locate the apps, and then simply read the Info.plist from the bundle to get the version. You could then compare this to the installer DB to find any missing software that was claiming to be installed.

4 8