From bbc36bbc83203ffbdbc49758a2de91b1d5c1da3c Mon Sep 17 00:00:00 2001 From: Ian Littman Date: Mon, 13 Oct 2025 17:33:20 -0500 Subject: [PATCH] Fall back to app filename when ingesting macOS apps that have no display name/bundle name and run.sh as the bundle executable (#34176) Fixes #34157. Seen on Steam games, which also don't have a bundle ID. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) ## Testing - [x] QA'd all new/changed functionality manually --- changes/34157-run-sh-ingestion | 1 + .../product-groups/orchestration/understanding-host-vitals.md | 2 +- server/service/osquery_utils/queries.go | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 changes/34157-run-sh-ingestion diff --git a/changes/34157-run-sh-ingestion b/changes/34157-run-sh-ingestion new file mode 100644 index 0000000000..37a7d5d6fd --- /dev/null +++ b/changes/34157-run-sh-ingestion @@ -0,0 +1 @@ +* Revised macOS software ingestion to correctly show application names for Steam games instead of `run.sh`. diff --git a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md index 2cacd29839..2bf7d869b3 100644 --- a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md +++ b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md @@ -716,7 +716,7 @@ WITH cached_users AS (WITH cached_groups AS (select * from groups) FROM users LEFT JOIN cached_groups USING (gid) WHERE type <> 'special' AND shell NOT LIKE '%/false' AND shell NOT LIKE '%/nologin' AND shell NOT LIKE '%/shutdown' AND shell NOT LIKE '%/halt' AND username NOT LIKE '%$' AND username NOT LIKE '\_%' ESCAPE '\' AND NOT (username = 'sync' AND shell ='/bin/sync' AND directory <> '')) SELECT - COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(bundle_executable, ''), TRIM(name, '.app') ) AS name, + COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), TRIM(name, '.app') ) AS name, COALESCE(NULLIF(bundle_short_version, ''), bundle_version) AS version, bundle_identifier AS bundle_identifier, '' AS extension_id, diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index d42e78207d..9ea6dea55a 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -909,7 +909,7 @@ var softwareMacOS = DetailQuery{ // which is used in vulnerability scanning. Query: withCachedUsers(`WITH cached_users AS (%s) SELECT - COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(bundle_executable, ''), TRIM(name, '.app') ) AS name, + COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), TRIM(name, '.app') ) AS name, COALESCE(NULLIF(bundle_short_version, ''), bundle_version) AS version, bundle_identifier AS bundle_identifier, '' AS extension_id,