osquery / osquery/osquery

Support nested groups on the user_groups table on darwin

Open
#1,762 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature virtual tables wishlist
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

There's an existing master task on #619 under Shared (cross platform) tables for group membership. To expand on scenarios/actionable criteria worth collecting, just sticking to the native local directory service, it would be vital to know who is in the admin group, and further to know(/potentially use as a foreign key?) nested groups - e.g., staff and or netaccounts in the _lpadmin group, to allow 'standard' (non-admin) users to print on Darwin. There is also a system ssh group, com.apple.access_ssh (whose GID has varied through different OS releases) that it is a common pattern to nest the admin group in.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the linked master task, #619, and the existing Darwin behavior of the user_groups table. Clarify how nested membership should be represented or queried, including admin, _lpadmin, and com.apple.access_ssh scenarios. Done should make the requested nested group relationships available through the Darwin table and cover the agreed criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, macos, sql
Domain
databases, operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.