From 3ffe6d87453559779eab85ee4dc6c73a5c8a42cc Mon Sep 17 00:00:00 2001
From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Date: Fri, 20 Jun 2025 21:48:41 -0500
Subject: [PATCH] Expand scope of `macos_compatibility` extension (#30219)

- Expanded scope of deployment to more than just our test devices
- Created label for scoped query reporting
---
 it-and-security/default.yml                                  | 1 +
 .../all/labels/macos-compatibility-extension-installed.yml   | 5 +++++
 .../macos/policies/install-macos-compatibility-extension.yml | 2 --
 .../lib/macos/queries/collect-macos-compatibility-data.yml   | 1 -
 it-and-security/teams/workstations-canary.yml                | 1 -
 it-and-security/teams/workstations.yml                       | 2 ++
 6 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 it-and-security/lib/all/labels/macos-compatibility-extension-installed.yml

diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index 985d4c813c..2bee9112b5 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -85,6 +85,7 @@ queries:
   - path: ./lib/all/queries/collect-operating-system-information.yml
   - path: ./lib/all/queries/collect-known-vulnerable-chrome-extensions.yml
   - path: ./lib/macos/queries/detect-apns-certificate.yml
+  - path: ./lib/macos/queries/collect-macos-compatibility-data.yml
 controls: 
   enable_disk_encryption: true
   macos_migration:
diff --git a/it-and-security/lib/all/labels/macos-compatibility-extension-installed.yml b/it-and-security/lib/all/labels/macos-compatibility-extension-installed.yml
new file mode 100644
index 0000000000..4796993fa3
--- /dev/null
+++ b/it-and-security/lib/all/labels/macos-compatibility-extension-installed.yml
@@ -0,0 +1,5 @@
+- name: macOS compatibility extension installed
+  description: macOS hosts that have the macOS compatibility extension installed
+  query: SELECT 1 WHERE EXISTS (SELECT * FROM file_lines WHERE path = "/var/osquery/extensions.load" AND line = "/var/fleet/extensions/macos_compatibility_universal.ext");
+  label_membership_type: dynamic
+  platform: darwin
diff --git a/it-and-security/lib/macos/policies/install-macos-compatibility-extension.yml b/it-and-security/lib/macos/policies/install-macos-compatibility-extension.yml
index 211c53e1ac..66e24d7fa6 100644
--- a/it-and-security/lib/macos/policies/install-macos-compatibility-extension.yml
+++ b/it-and-security/lib/macos/policies/install-macos-compatibility-extension.yml
@@ -6,5 +6,3 @@
   run_script:
     path: ../scripts/install-macos-compatibility-extension.sh
   platform: darwin
-  labels_include_any:
-    - Santa test devices
diff --git a/it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml b/it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml
index e8d6ec469e..70d2f246d7 100644
--- a/it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml
+++ b/it-and-security/lib/macos/queries/collect-macos-compatibility-data.yml
@@ -8,4 +8,3 @@
   platform: "darwin"
   query: SELECT * FROM macos_compatibility;
   labels_include_any:
-    - Santa test devices
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index d6425c16cb..8155409ab3 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -162,7 +162,6 @@ policies:
 queries:
   - path: ../lib/macos/queries/detect-apple-intelligence.yml
   - path: ../lib/macos/queries/collect-santa-denied-logs.yml
-  - path: ../lib/macos/queries/collect-macos-compatibility-data.yml
 software:
   packages:
     - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 4ef6318828..d5b98a597e 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -100,6 +100,7 @@ controls:
     - path: ../lib/windows/scripts/turn-off-mdm.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
     - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
+    - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
 policies:
   - path: ../lib/macos/policies/1password-emergency-kit-check.yml
   - path: ../lib/macos/policies/update-firefox.yml
@@ -116,6 +117,7 @@ policies:
   - path: ../lib/windows/policies/1password-installed.yml
   - path: ../lib/windows/policies/update-1password.yml
   - path: ../lib/linux/policies/disk-encryption-check.yml
+  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
 queries:
   - path: ../lib/macos/queries/detect-apple-intelligence.yml
 software: