tables: implement `password_policy` table for macOS #7594

sharvilshah · 2022-05-18T09:08:28Z

Uses OpenDirectory and output is similar to apple's built-in pwpolicy command.

osquery> select * from password_policy;
+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+
| policy_identifier                                                       | policy_attribute                                               | policy_description                                        |
+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+
| ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:minLength           | policyAttributePassword matches '.{10,}'                       | Contain at least 10 characters.                           |
| com.apple.defaultpasswordpolicy.fde                                     | policyAttributePassword matches '.{4,}+'                       | Enter a password that is four characters or more.         |
| ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:requireAlphanumeric | policyAttributePassword matches '^(?=.*[0-9])(?=.*[a-zA-Z]).+' | Contain at least one number and one alphabetic character. |
+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+

This covers default policy (com.apple.defaultpasswordpolicy.fde in the example above) as well as ones pushed by MDM profiles.

directionless · 2022-06-11T02:16:34Z

specs/darwin/password_policy.table

@@ -0,0 +1,11 @@
+table_name("password_policy")


At least on my mac, this is documented both as having global policies, as well as per-user policies. Any thoughts about how to handle that?

Yes, the reason I used ODNodeCopyAccountPolicies API call is to get both global and per-user policies. I am not sure on other platform, but windows has NetUserModalsGet in it's win32 API, from their description:

The NetUserModalsGet function retrieves global information for all users and global groups in the security database, which is the security accounts manager (SAM) database or, in the case of domain controllers, the Active Directory.

From: https://docs.microsoft.com/en-us/windows/win32/api/lmaccess/nf-lmaccess-netusermodalsget?redirectedfrom=MSDN

I am guessing that should cover it? I am not sure on Linux

My windows internals knowledge is lacking, but based on above it seems we can continue with password_policy as the table name

If there is both global, and per-user policy, how is that reflected in this schema? Can users have different polices? How is that represented.

On macOS, the concept of user policies and global policies has been deprecated for a while now. From the man page:

Account Policies
Account policies are the replacement for the deprecated legacy global and user policies. Account policies are specified as a dictionary containing three keys, one key for each policy category. Note that the dictionary is
not required to contain all of the policy categories

The policy_identifier is something that a user can set (either manually or via MDM). Apple supplied policy has identifiers that start with com.apple., and currently Apple only supplies one policy by default -- where if filevault gets enabled, the password has to be 4 characters or more.

For other platforms, if there is a clear user/global distinction, I guess one can use the extended schema for the table.

osquery/utils/conversions/darwin/cfdictionary.cpp

osquery/tables/system/darwin/password_policy.cpp

sharvilshah · 2022-06-22T23:08:27Z

Added one more column to make it easy to show the relevant data:

osquery> select * from password_policy;
+-------------------------------------------------------------------------+---------------------+----------------------------------------------------------------+-----------------------------------------------------------+
| policy_identifier                                                       | policy_attribute    | policy_content                                                 | policy_description                                        |
+-------------------------------------------------------------------------+---------------------+----------------------------------------------------------------+-----------------------------------------------------------+
| ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:minLength           | minLength           | policyAttributePassword matches '.{10,}'                       | Contain at least 10 characters.                           |
| com.apple.defaultpasswordpolicy.fde                                     |                     | policyAttributePassword matches '.{4,}+'                       | Enter a password that is four characters or more.         |
| ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:requireAlphanumeric | requireAlphanumeric | policyAttributePassword matches '^(?=.*[0-9])(?=.*[a-zA-Z]).+' | Contain at least one number and one alphabetic character. |
+-------------------------------------------------------------------------+---------------------+----------------------------------------------------------------+-----------------------------------------------------------+

Final review @directionless?

sharvilshah · 2022-06-28T21:12:49Z

Hey @directionless,

Did a little bit more digging and testing, there is another obscure-ish API to grab account policies for the user, in case there is a per-user policy. I have implemented that too, and I added a uid column when that's the case.

squery> select * from password_policy;
+-----+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+
| uid | policy_identifier                                                       | policy_content                                                 | policy_description                                        |
+-----+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+
|     | ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:minLength           | policyAttributePassword matches '.{10,}'                       | Contain at least 10 characters.                           |
|     | com.apple.defaultpasswordpolicy.fde                                     | policyAttributePassword matches '.{4,}+'                       | Enter a password that is four characters or more.         |
|     | ProfilePayload:9c546b0a-53f7-4f33-8bc6-84ec075817f5:requireAlphanumeric | policyAttributePassword matches '^(?=.*[0-9])(?=.*[a-zA-Z]).+' | Contain at least one number and one alphabetic character. |
| 502 | com.apple.policy.legacy.minChars                                        | policyAttributePassword matches '.{12,}?'                      | Must be a minimum of 12 characters in length              |
+-----+-------------------------------------------------------------------------+----------------------------------------------------------------+-----------------------------------------------------------+

In this example above, I created a new user, and set that user's account policy to have minimum length of the password to be 12 characters.

osquery/tables/system/darwin/password_policy.cpp

zwass

LGTM unless those objects do need to be released.

osquery/tables/system/darwin/password_policy.cpp

zwass

Sweet!

sharvilshah · 2022-06-30T18:51:11Z

Hooked it up to the profiler, and no leaky objects are detected for password_policy queries!

sharvilshah added 2 commits May 18, 2022 14:34

implement password_policy table for macOS

7d2ebc4

format

be4b0c4

sharvilshah requested review from a team as code owners May 18, 2022 09:08

sharvilshah added macOS feature virtual tables labels May 18, 2022

sharvilshah mentioned this pull request May 18, 2022

Expose password policy information fleetdm/fleet#5384

Closed

3 tasks

directionless reviewed Jun 11, 2022

View reviewed changes

sharvilshah added 3 commits June 22, 2022 09:07

clean up

a3d7d10

add tests

6fd0193

updates

58d4e49

sharvilshah requested a review from zwass June 22, 2022 23:09

grab local/account policies too

cc951c2

sharvilshah requested a review from directionless June 28, 2022 21:12

zwass reviewed Jun 29, 2022

View reviewed changes

osquery/tables/system/darwin/password_policy.cpp Outdated Show resolved Hide resolved

check for constraint

527d5d5

zwass previously approved these changes Jun 30, 2022

View reviewed changes

osquery/tables/system/darwin/password_policy.cpp Show resolved Hide resolved

release records

deeb6a7

sharvilshah dismissed zwass’s stale review via deeb6a7 June 30, 2022 18:11

zwass approved these changes Jun 30, 2022

View reviewed changes

sharvilshah merged commit be644ec into osquery:master Jun 30, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tables: implement `password_policy` table for macOS #7594

tables: implement `password_policy` table for macOS #7594

sharvilshah commented May 18, 2022

directionless Jun 11, 2022

sharvilshah Jun 21, 2022

sharvilshah Jun 22, 2022

directionless Jun 24, 2022

sharvilshah Jun 24, 2022

sharvilshah commented Jun 22, 2022

sharvilshah commented Jun 28, 2022

zwass left a comment

zwass left a comment

sharvilshah commented Jun 30, 2022

tables: implement password_policy table for macOS #7594

tables: implement password_policy table for macOS #7594

Conversation

sharvilshah commented May 18, 2022

directionless Jun 11, 2022

Choose a reason for hiding this comment

sharvilshah Jun 21, 2022

Choose a reason for hiding this comment

sharvilshah Jun 22, 2022

Choose a reason for hiding this comment

directionless Jun 24, 2022

Choose a reason for hiding this comment

sharvilshah Jun 24, 2022

Choose a reason for hiding this comment

sharvilshah commented Jun 22, 2022

sharvilshah commented Jun 28, 2022

zwass left a comment

Choose a reason for hiding this comment

zwass left a comment

Choose a reason for hiding this comment

sharvilshah commented Jun 30, 2022

tables: implement `password_policy` table for macOS #7594

tables: implement `password_policy` table for macOS #7594