Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Patch kolide_macos_software_update for MacOS15 #1891

Merged
merged 4 commits into from
Oct 15, 2024

Conversation

Micah-Kolide
Copy link
Contributor

@Micah-Kolide Micah-Kolide commented Oct 15, 2024

MacOS 15 has come with a lot of changes to the software update frameworks. With these changes some methods are still supported, some deprecated, and some are now static.

With this PR, new data is being added. The main thing of note is that we never tracked if "Install OS Updates" was managed, but this PR brings that data in with some other settings as well.

It appears that "Auto Check for Updates" is now static (readonly), so I believe it makes sense to always return true for it being enabled if the os version is on MacOS 15+. There's no way of validating if it's managed unless we figure out how to utilize SUOSUClientProtocol.

The new class does not have a property for if the "App store" auto updates or is managed, so that only relies on the old method.

I'd prefer to use SUOSUClientProtocol, as this class would give us all of the needed software update data, but attempts to initialize it (while returning correct data) ends up returning an error:

SUPreferenceManager: Failed to set object of class: __NSTaggedDate for key: LastSuccessfulDate with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"
SUPreferenceManager: Failed to set object of class: __NSCFConstantString for key: LastRecommendedMajorOSBundleIdentifier with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"

I would like to return to this in the future to try utilizing SUOSUClientProtocol, but for now this PR at least gets us the patches we need for MacOS 15.

@Micah-Kolide
Copy link
Contributor Author

In regards to how the check that uses this table is implemented. Since autoupdate_managed no longer has a way of being validated, we'll probably need to update it.

Copy link
Contributor

@James-Pickett James-Pickett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, worked on my box =) (Sonoma 14.7)

osquery> select * from kolide_macos_software_update;
                  autoupdate_managed = 1
                  autoupdate_enabled = 1
                    download_managed = 1
                            download = 1
                 app_updates_managed = 1
                         app_updates = 0
                  os_updates_managed = 1
                          os_updates = 1
config_data_critical_updates_managed = 0
                 config_data_updates = 1
                    critical_updates = 1
     last_successful_check_timestamp = 1729002002

@Micah-Kolide
Copy link
Contributor Author

Micah-Kolide commented Oct 15, 2024

Wanted to add my computers results as well. Both are on MacOS 15.1.

Managed:

                  autoupdate_managed = 0
                  autoupdate_enabled = 1
                    download_managed = 1
                            download = 1
                 app_updates_managed = 0
                         app_updates = 1
                  os_updates_managed = 1
                          os_updates = 1
config_data_critical_updates_managed = 1
                 config_data_updates = 1
                    critical_updates = 1
     last_successful_check_timestamp = 1729016849

Unmanaged:

                  autoupdate_managed = 0
                  autoupdate_enabled = 1
                    download_managed = 0
                            download = 1
                 app_updates_managed = 0
                         app_updates = 1
                  os_updates_managed = 0
                          os_updates = 0
config_data_critical_updates_managed = 0
                 config_data_updates = 1
                    critical_updates = 1
     last_successful_check_timestamp = 1729018450

@Micah-Kolide Micah-Kolide added this pull request to the merge queue Oct 15, 2024
Merged via the queue into main with commit 5027715 Oct 15, 2024
29 checks passed
@Micah-Kolide Micah-Kolide deleted the micah/fix_autoupdate_managed_table branch October 15, 2024 21:31
@RebeccaMahany RebeccaMahany added the component:table Table Changes label Oct 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:table Table Changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants