{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1216","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1216/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1216/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1216/events","html_url":"https://github.com/facebook/osquery/pull/1216","id":89444382,"number":1216,"title":"[Implement #1103] DMG Mount Events","user":{"login":"sharvilshah","id":819943,"avatar_url":"https://avatars.githubusercontent.com/u/819943?v=3","gravatar_id":"","url":"https://api.github.com/users/sharvilshah","html_url":"https://github.com/sharvilshah","followers_url":"https://api.github.com/users/sharvilshah/followers","following_url":"https://api.github.com/users/sharvilshah/following{/other_user}","gists_url":"https://api.github.com/users/sharvilshah/gists{/gist_id}","starred_url":"https://api.github.com/users/sharvilshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharvilshah/subscriptions","organizations_url":"https://api.github.com/users/sharvilshah/orgs","repos_url":"https://api.github.com/users/sharvilshah/repos","events_url":"https://api.github.com/users/sharvilshah/events{/privacy}","received_events_url":"https://api.github.com/users/sharvilshah/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/CLA%20Signed","name":"CLA Signed","color":"009900"},{"url":"https://api.github.com/repos/facebook/osquery/labels/ready%20for%20review","name":"ready for review","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-06-19T01:58:45Z","updated_at":"2015-06-22T17:31:03Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1216","html_url":"https://github.com/facebook/osquery/pull/1216","diff_url":"https://github.com/facebook/osquery/pull/1216.diff","patch_url":"https://github.com/facebook/osquery/pull/1216.patch"},"body":"This implements #1103.\r\n\r\nThe `publisher` reports on disk events and its metadata, using the DiskArbitration framework on OS X. Currently disk appearance and disappearance events are published for both physical and virtual disks (DMG files). On an event trigger, disk properties are parsed and that metadata is reported along with the action.\r\n\r\nThe `subscriber` subscribes to virtual disk events currently.\r\n\r\n#### `add` action disk events:\r\n\r\n```\r\nosquery> .mode line\r\nosquery> select * from disk_events;\r\n    action = add\r\n      path = /Users/sbs/Downloads/googlechrome.dmg\r\n      name = Apple\r\n  bsd_name = /dev/disk2s1\r\n      uuid =\r\n      size = 32256\r\n      time = 1434779637\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_map\r\nmedia_name = Apple\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum = 7AC543FC\r\n\r\n    action = add\r\n      path = /Users/sbs/Downloads/googlechrome.dmg\r\n      name = DiscRecording 8.0d6\r\n  bsd_name = /dev/disk2s2\r\n      uuid = FB074CC5-33EC-3E1C-9BF4-1BDAA0528525\r\n      size = 187559936\r\n      time = 1434779637\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 0\r\n   content = Apple_HFS\r\nmedia_name = DiscRecording 8.0d6\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum = 7AC543FC\r\n\r\n    action = add\r\n      path = /Users/sbs/Downloads/googlechrome.dmg\r\n      name = Apple UDIF read-only compressed (bzip2) Media\r\n  bsd_name = /dev/disk2\r\n      uuid =\r\n      size = 187592704\r\n      time = 1434779637\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_scheme\r\nmedia_name = Apple UDIF read-only compressed (bzip2) Media\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum = 7AC543FC\r\n\r\n    action = add\r\n      path = /Users/sbs/Downloads/OmniOutliner-4.2.3.dmg\r\n      name = Apple UDIF read-only compressed (bzip2) Media\r\n  bsd_name = /dev/disk3\r\n      uuid = 93DC6337-A7AF-3D7D-9313-E82350E39EE8\r\n      size = 45772800\r\n      time = 1434782830\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 0\r\n   content =\r\nmedia_name = Apple UDIF read-only compressed (bzip2) Media\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum = B9FF22FA\r\n\r\n    action = add\r\n      path = /Users/sbs/test.dmg\r\n      name = Apple read/write Media\r\n  bsd_name = /dev/disk4\r\n      uuid = E8383EDF-BD81-3A67-880E-F5DEFBCA9A0A\r\n      size = 40960000\r\n      time = 1434782862\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 1\r\n   content =\r\nmedia_name = Apple read/write Media\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n\r\n    action = add\r\n      path = /Users/sbs/test2.dmg\r\n      name = Apple\r\n  bsd_name = /dev/disk5s1\r\n      uuid =\r\n      size = 32256\r\n      time = 1434782877\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_map\r\nmedia_name = Apple\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n\r\n    action = add\r\n      path = /Users/sbs/test2.dmg\r\n      name = Apple read/write Media\r\n  bsd_name = /dev/disk5\r\n      uuid =\r\n      size = 40992768\r\n      time = 1434782877\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 1\r\n   content = Apple_partition_scheme\r\nmedia_name = Apple read/write Media\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n\r\n    action = add\r\n      path = /Users/sbs/test2.dmg\r\n      name = disk image\r\n  bsd_name = /dev/disk5s2\r\n      uuid = 8386A359-A9FB-32BA-BB69-708A032FF7AF\r\n      size = 40960000\r\n      time = 1434782877\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 1\r\n   content = Apple_HFS\r\nmedia_name = disk image\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n```\r\n\r\n#### `remove` action on  disk events:\r\n\r\n```\r\n    action = remove\r\n      path =\r\n      name = Apple UDIF read-only compressed (bzip2) Media\r\n  bsd_name = /dev/disk2\r\n      uuid =\r\n      size = 187592704\r\n      time = 1434783366\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_scheme\r\nmedia_name = Apple UDIF read-only compressed (bzip2) Media\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = DiscRecording 8.0d6\r\n  bsd_name = /dev/disk2s2\r\n      uuid = FB074CC5-33EC-3E1C-9BF4-1BDAA0528525\r\n      size = 187559936\r\n      time = 1434783366\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 0\r\n   content = Apple_HFS\r\nmedia_name = DiscRecording 8.0d6\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = Apple\r\n  bsd_name = /dev/disk2s1\r\n      uuid =\r\n      size = 32256\r\n      time = 1434783366\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_map\r\nmedia_name = Apple\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = Apple UDIF read-only compressed (bzip2) Media\r\n  bsd_name = /dev/disk3\r\n      uuid = 93DC6337-A7AF-3D7D-9313-E82350E39EE8\r\n      size = 45772800\r\n      time = 1434783367\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 0\r\n   content =\r\nmedia_name = Apple UDIF read-only compressed (bzip2) Media\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = Apple read/write Media\r\n  bsd_name = /dev/disk4\r\n      uuid = E8383EDF-BD81-3A67-880E-F5DEFBCA9A0A\r\n      size = 40960000\r\n      time = 1434783368\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 1\r\n   content =\r\nmedia_name = Apple read/write Media\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = Apple read/write Media\r\n  bsd_name = /dev/disk5\r\n      uuid =\r\n      size = 40992768\r\n      time = 1434783370\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 1\r\n   content = Apple_partition_scheme\r\nmedia_name = Apple read/write Media\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = disk image\r\n  bsd_name = /dev/disk5s2\r\n      uuid = 8386A359-A9FB-32BA-BB69-708A032FF7AF\r\n      size = 40960000\r\n      time = 1434783370\r\n ejectable = 1\r\n mountable = 1\r\n  writable = 1\r\n   content = Apple_HFS\r\nmedia_name = disk image\r\n    vendor = Apple\r\nfilesystem = hfs\r\n  checksum =\r\n\r\n    action = remove\r\n      path =\r\n      name = Apple\r\n  bsd_name = /dev/disk5s1\r\n      uuid =\r\n      size = 32256\r\n      time = 1434783370\r\n ejectable = 1\r\n mountable = 0\r\n  writable = 0\r\n   content = Apple_partition_map\r\nmedia_name = Apple\r\n    vendor = Apple\r\nfilesystem =\r\n  checksum =\r\n```"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/114191873","html_url":"https://github.com/facebook/osquery/pull/1216#issuecomment-114191873","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1216","id":114191873,"user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T17:31:03Z","updated_at":"2015-06-22T17:31:03Z","body":"ok to test"}}