159 lines
8.5 KiB
SQL
159 lines
8.5 KiB
SQL
-- macOS application layer firewall (ALF) service exceptions.
|
|
--
|
|
-- false positives:
|
|
-- * locally built software
|
|
--
|
|
-- tags: persistent state filesystem
|
|
-- platform: darwin
|
|
SELECT
|
|
ae.path,
|
|
ae.state,
|
|
file.mtime,
|
|
file.ctime,
|
|
file.uid,
|
|
file.directory,
|
|
file.size,
|
|
file.type,
|
|
hash.sha256,
|
|
signature.identifier,
|
|
signature.authority,
|
|
CONCAT (
|
|
signature.authority,
|
|
',',
|
|
signature.identifier,
|
|
',',
|
|
ae.path,
|
|
',',
|
|
MIN(file.uid, 501)
|
|
) AS exception_key
|
|
FROM
|
|
alf_exceptions ae
|
|
LEFT JOIN file ON ae.path = file.path
|
|
LEFT JOIN hash ON ae.path = hash.path
|
|
LEFT JOIN signature ON ae.path = signature.path
|
|
WHERE
|
|
-- Filter out stock exceptions to decrease overhead
|
|
ae.path NOT IN (
|
|
'/System/Library/CoreServices/UniversalControl.app/',
|
|
'/System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/readconfig',
|
|
'/System/Library/PrivateFrameworks/EmbeddedOSInstall.framework/Versions/A/XPCServices/EmbeddedOSInstallService.xpc/',
|
|
'/usr/bin/nmblookup',
|
|
'/usr/libexec/bootpd',
|
|
'/usr/libexec/configd',
|
|
'/usr/libexec/discoveryd',
|
|
'/usr/libexec/xartstorageremoted',
|
|
'/usr/sbin/mDNSResponder',
|
|
'/usr/sbin/racoon'
|
|
)
|
|
-- Ignore files that ahve already been removed
|
|
AND file.filename NOT NULL
|
|
AND exception_key NOT IN (
|
|
',a.out,/opt/homebrew/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/bin/kubectl,501',
|
|
',a.out,/opt/homebrew/Cellar/go/1.20.4/libexec/pkg/tool/darwin_arm64/trace,501',
|
|
'Apple Mac OS Application Signing,com.anydo.mac,/Applications/Anydo.app/,0',
|
|
'Apple Mac OS Application Signing,com.apple.garageband10,/Applications/GarageBand.app/,0',
|
|
'Apple Mac OS Application Signing,com.joeallen.teleprompter.mac,/Applications/Teleprompter.app/,0',
|
|
'Apple Mac OS Application Signing,com.utmapp.QEMULauncher,/Applications/UTM.app/Contents/XPCServices/QEMUHelper.xpc/Contents/MacOS/QEMULauncher.app/,0',
|
|
'Apple Mac OS Application Signing,io.tailscale.ipn.macos.network-extension,/Applications/Tailscale.app/Contents/PlugIns/IPNExtension.appex/,0',
|
|
',,/Applications/Google%20Chrome.app/,',
|
|
',,/Applications/IntelliJ%20IDEA.app/,',
|
|
',,/Applications/ProtonMail%20Bridge.app/,',
|
|
',,/Applications/Visual%20Studio%20Code.app/,',
|
|
',,/Applications/Visual%20Studio%20Code.app/Contents/Frameworks/Code%20Helper.app/,',
|
|
'Developer ID Application: Bearly Inc (NK6K4BACCF),com.bearly.app,/Applications/Bearly.app/,501',
|
|
'Developer ID Application: Bohemian Coding (WUGMZZ5K46),com.bohemiancoding.sketch3,/Applications/Sketch.app/,501',
|
|
'Developer ID Application: Bohemian Coding (WUGMZZ5K46),com.bohemiancoding.SketchMirrorHelper,/Applications/Sketch.app/Contents/XPCServices/SketchMirrorHelper.xpc/,501',
|
|
'Developer ID Application: Brother Industries, LTD. (5HCL85FLGW),com.brother.utility.WorkflowAppControlServer,/Library/Printers/Brother/Utilities/Server/WorkflowAppControl.app/,0',
|
|
'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5),com.elgato.WaveLink,/Applications/WaveLink.app/,0',
|
|
'Developer ID Application: Cypress.Io, Inc. (7D655LWGLY),com.electron.cypress,/Users/garrying/Library/Caches/Cypress/12.9.0/Cypress.app/,501',
|
|
'Developer ID Application: Dropbox, Inc. (G7HH3F8CAK),com.getdropbox.dropbox,/Applications/Dropbox.app/,501',
|
|
'Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),com.jetbrains.goland,/Applications/GoLand.app/,501',
|
|
'Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),com.jetbrains.pycharm,/Applications/PyCharm.app/,501',
|
|
'Developer ID Application: Opentest, Inc. (QGD2ZPXZZG),com.loom.desktop,/Applications/Loom.app/,501',
|
|
'Developer ID Application: RescueTime, Inc (FSY4RB8H39),com.rescuetime.RescueTime,/Applications/RescueTime.app/,0',
|
|
'Developer ID Application: Sonos, Inc. (2G4LW83Q3E),com.sonos.macController,/Applications/Sonos.app/,501',
|
|
'Developer ID Application: Spotify (2FNC3A47ZF),com.spotify.client,/Applications/Spotify.app/,501',
|
|
'Developer ID Application: Tailscale Inc. (W5364U7YZB),io.tailscale.ipn.macsys.network-extension,/Library/SystemExtensions/A30AF854-E980-4345-A658-17000BF66D00/io.tailscale.ipn.macsys.network-extension.systemextension/,0',
|
|
'Developer ID Application: VNG ONLINE CO.,LTD (CVB6BX97VM),com.vng.zalo,/Applications/Zalo.app/,501',
|
|
'Developer ID Application: Voicemod Sociedad Limitada. (S2MC4XQDSM),net.voicemod.desktop,/Applications/Voicemod.app/,0',
|
|
',dnsmasq,/opt/homebrew/Cellar/dnsmasq/2.88/sbin/dnsmasq,0',
|
|
',iodined-55554944d1ffcb236a84363d9b667be6a1742a17,/usr/local/sbin/iodined,501',
|
|
',java,/opt/homebrew/Cellar/openjdk/19/libexec/openjdk.jdk/Contents/Home/bin/java,501',
|
|
',org.python.python,/opt/homebrew/Cellar/python@3.10/3.10.9/Frameworks/Python.framework/Versions/3.10/Resources/Python.app/,501',
|
|
',org.python.python,/opt/homebrew/Cellar/python@3.11/3.11.2_1/Frameworks/Python.framework/Versions/3.11/Resources/Python.app/,501',
|
|
'Software Signing,com.apple.audio.InfoHelper,/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.InfoHelper.xpc/,0',
|
|
'Software Signing,com.apple.controlcenter,/System/Library/CoreServices/ControlCenter.app/,0',
|
|
'Software Signing,com.apple.Music,/System/Applications/Music.app/,0',
|
|
'Software Signing,com.apple.nc,/usr/bin/nc,0',
|
|
'Software Signing,com.apple.python3,/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/Resources/Python.app/,0',
|
|
'Software Signing,com.apple.WebKit.Networking,/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/,0',
|
|
'Software Signing,com.apple.WebKit.Networking,/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/,0',
|
|
'Software Signing,com.apple.xartstorageremoted,/usr/libexec/xartstorageremoted,0',
|
|
'/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/',
|
|
',,/usr/local/sbin/iodined,501'
|
|
)
|
|
AND NOT exception_key LIKE ',a.out,/Users/%/dev/%,501'
|
|
AND NOT exception_key LIKE ',org.python.python,/opt/homebrew/Cellar/python@%/Frameworks/Python.framework/Versions/3.11/Resources/Python.app/,501'
|
|
AND NOT exception_key LIKE ',a.out,/opt/homebrew/Cellar/podman/%/libexec/podman/gvproxy,501'
|
|
AND NOT exception_key LIKE ',net.java.openjdk.java,/opt/homebrew/Cellar/openjdk/%/libexec/openjdk.jdk/Contents/Home/bin/java,501'
|
|
AND NOT exception_key LIKE ',a.out,/private/var/folders/%/T/GoLand/%,501'
|
|
AND NOT exception_key LIKE ',a.out,/Users/%/GolandProjects/documentation-code-examples/debuggingTutorial/myApp,501'
|
|
AND NOT exception_key LIKE ',node,/opt/homebrew/Cellar/nvm/%/versions/node/v%/bin/node,501'
|
|
AND NOT exception_key LIKE ',java,/opt/homebrew/Cellar/openjdk/%/libexec/openjdk.jdk/Contents/Home/bin/java,501'
|
|
AND NOT (
|
|
signature.identifier LIKE 'cargo-%'
|
|
AND ae.path LIKE '/Users/%/.rustup/%'
|
|
)
|
|
AND NOT (
|
|
signature.identifier LIKE 'fake-%'
|
|
AND ae.path LIKE '%/exe/fake'
|
|
)
|
|
AND NOT (
|
|
signature.identifier LIKE 'mariadbd-%'
|
|
AND ae.path LIKE '/opt/homebrew/%/mariadbd'
|
|
)
|
|
AND NOT (
|
|
signature.identifier = 'netcat'
|
|
AND ae.path LIKE '/Users/%/homebrew/Cellar/netcat/%/bin/netcat'
|
|
)
|
|
AND NOT (
|
|
signature.identifier = 'syncthing'
|
|
AND ae.path LIKE '/nix/store/%-syncthing-%/bin/syncthing'
|
|
)
|
|
AND NOT (
|
|
signature.identifier = 'nix'
|
|
AND ae.path LIKE '/nix/store/%-nix-%/bin/nix'
|
|
)
|
|
AND NOT (
|
|
ae.path LIKE '/Users/%/Library/Application%20Support/Steam/Steam.AppBundle/Steam/'
|
|
)
|
|
AND NOT (
|
|
signature.authority = ''
|
|
AND signature.identifier = 'org.chromium.Chromium'
|
|
AND ae.path LIKE '/Users/%/Library/pnpm/global/%/.pnpm/carlo@%/node_modules/carlo/lib/.local-data/mac-%/chrome-mac/Chromium.app/'
|
|
)
|
|
AND NOT (
|
|
(
|
|
signature.identifier = 'a.out'
|
|
OR signature.identifier LIKE '%-%'
|
|
)
|
|
AND file.uid > 500
|
|
AND (
|
|
file.directory LIKE '/opt/homebrew/Cellar/%/bin'
|
|
OR file.directory LIKE '/Users/%/bin'
|
|
OR file.directory LIKE '/Users/%/code/%'
|
|
OR file.directory LIKE '/Users/%/src/%'
|
|
OR file.directory LIKE '/Users/%/gh/%'
|
|
OR file.directory LIKE '/Users/%/debug/%'
|
|
OR file.directory LIKE '/Users/%/target/%'
|
|
OR file.directory LIKE '/Users/%/tmp/%'
|
|
OR file.directory LIKE '/Users/%/sigstore/%'
|
|
OR file.directory LIKE '/Users/%/node_modules/.bin/%'
|
|
OR file.directory LIKE '/Users/%/git/%'
|
|
OR file.directory LIKE '/Users/%/%-cli'
|
|
OR file.directory LIKE '/private/var/folders/%/T/go-build%/exe'
|
|
)
|
|
)
|
|
GROUP BY
|
|
exception_key
|