osquery/osquery

extended_attributes on directories (macos )

Opened this issue · 0 comments

Feature request

What new feature do you want?

It seems like the extended attributes table for mac can't actually grab folder extended attributes (I mean on the actual folder itself not in the folder)
Steps to repro:

xattr -w com.apple.icloud.desktoptest test /Users/testuser/Desktop 
xattr -w com.apple.icloud.desktoptest test /Users/testuser/Documents


%xattr -l /Users/testuser/Desktop
    com.apple.icloud.desktoptest: test
%xattr -l /Users/testuser/Documents
    com.apple.icloud.desktoptest: test

I can't see osq 5.9.1 returning any folder xattrs
tried various combiations of like for path , or parent path and or specific xattr but no results

SELECT * FROM extended_attributes
where (path = '/Users/testuser/Desktop' OR path = '/Users/testuser/Documents')
SELECT * FROM extended_attributes
where (path LIKE '/Users/%/Desktop' OR path LIKE '/Users/%/Documents')
SELECT * FROM extended_attributes
where (directory LIKE '/Users/%/') --AND key='com.apple.icloud.desktoptest'

How is this new feature useful?

Useful to determine is desktop/documents sync is on for Icloud for some reason I don't see this reflected in Mobile Documents folders when this feature in icloud sync is on
https://www.brunerd.com/blog/2022/09/30/determining-icloud-drive-and-desktop-and-documents-sync-status-in-macos/
https://github.com/brunerd/macAdminTools/blob/main/Scripts/iCloudDriveDesktopSync_func%20min.sh

How can this be implemented?