From 035d4f4839e8bca0adb7c6d6758821577d8db2d1 Mon Sep 17 00:00:00 2001 From: Josh Roskos Date: Wed, 17 Sep 2025 11:48:58 -0500 Subject: [PATCH] Add FDA requirement + links to safari_extensions.yml (#33069) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added reference to FDA requirement along with links to enable FDA and a pre-created mobileconfig per discussion in product office hours (9/16/25). ~Josh 🖖🏻 --- articles/enroll-hosts.md | 4 +--- schema/osquery_fleet_schema.json | 2 +- schema/tables/safari_extensions.yml | 7 ++----- 3 files changed, 4 insertions(+), 9 deletions(-) diff --git a/articles/enroll-hosts.md b/articles/enroll-hosts.md index 5ac91f0263..e5ed1669c8 100644 --- a/articles/enroll-hosts.md +++ b/articles/enroll-hosts.md @@ -210,15 +210,13 @@ Also, remember to replace both `AC_USERNAME` and `AC_PASSWORD` environment varia ### Grant full disk access to osquery on macOS -MacOS does not allow applications to access all system files by default. +macOS does not allow applications to access all system files by default. If you are using an MDM solution or Fleet's MDM features, one of which is required to deploy these profiles, you can deploy a "Privacy Preferences Policy Control" policy to grant fleetd or osquery that level of access. This is required to query for files located in protected paths as well as to use event tables that require access to the [EndpointSecurity API](https://developer.apple.com/documentation/endpointsecurity#overview), such as *es_process_events*. -#### Creating the configuration profile - ##### Obtaining identifiers If you use plain osquery, instructions are [available here](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/). diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 53815785ad..8663bbc98c 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -23973,7 +23973,7 @@ ], "evented": false, "cacheable": false, - "notes": "Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires a `JOIN` operation.\n\nQuery explanation:\n\n- The `safari_extensions` table has a row for each installed extension\n- Each row has a column with the `uid` of the user who installed the extension\n- Each `uid` from the `safari_extensions` table is matched in the `users` table to collect Safari extensions in the output data for all user accounts on the Mac by the `JOIN`\n\nLinks:\n\n- Apple dcoumentaion on Safari Extensions: https://support.apple.com/en-us/102343\n- CROSS JOIN SQLite tutorial: https://www.sqlitetutorial.net/sqlite-cross-join/\n- [Fleet documentation on joining against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)\n- Fleet users table: https://fleetdm.com/tables/users", + "notes": "Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires [giving osquery full disk access](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos) and a [`JOIN` against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table).\n\nQuery explanation:\n\n- The `safari_extensions` table has a row for each installed extension\n- Each row has a column with the `uid` of the user who installed the extension\n- Each `uid` from the `safari_extensions` table is matched in the `users` table to collect Safari extensions in the output data for all user accounts on the Mac by the `JOIN`\n\nLinks:\n\n- [Apple documentation on Safari Extensions](https://support.apple.com/en-us/102343)", "examples": "Collect Safari extensions for all Mac users:\n\n```\nSELECT * FROM users CROSS JOIN safari_extensions USING (uid);\n```", "columns": [ { diff --git a/schema/tables/safari_extensions.yml b/schema/tables/safari_extensions.yml index ea0d561b39..c03b644cdd 100644 --- a/schema/tables/safari_extensions.yml +++ b/schema/tables/safari_extensions.yml @@ -9,7 +9,7 @@ examples: |- SELECT * FROM users CROSS JOIN safari_extensions USING (uid); ``` notes: |- - Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires a `JOIN` operation. + Because Safari data is intentionally isolated for each macOS user to maintain privacy, this query requires [giving osquery full disk access](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos) and a [`JOIN` against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table). Query explanation: @@ -19,7 +19,4 @@ notes: |- Links: - - Apple dcoumentaion on Safari Extensions: https://support.apple.com/en-us/102343 - - CROSS JOIN SQLite tutorial: https://www.sqlitetutorial.net/sqlite-cross-join/ - - [Fleet documentation on joining against the `users` table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table) - - Fleet users table: https://fleetdm.com/tables/users + - [Apple documentation on Safari Extensions](https://support.apple.com/en-us/102343)