{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/34369539","id":34369539,"diff_hunk":"@@ -0,0 +1,99 @@\n+/*\n+ *  Copyright (c) 2014, Facebook, Inc.\n+ *  All rights reserved.\n+ *\n+ *  This source code is licensed under the BSD-style license found in the\n+ *  LICENSE file in the root directory of this source tree. An additional grant\n+ *  of patent rights can be found in the PATENTS file in the same directory.\n+ *\n+ */\n+\n+#include <osquery/core.h>\n+#include <osquery/filesystem.h>\n+#include <osquery/logger.h>\n+#include <osquery/tables.h>\n+\n+#include \"osquery/core/conversions.h\"\n+\n+#include \"osquery/tables/system/darwin/authdb.h\"\n+\n+namespace osquery {\n+namespace tables {\n+\n+QueryData genOSXAuthDB(QueryContext& context) {\n+  \n+  QueryData results;\n+  CFArrayRef app_map = nullptr;\n+  Row r;\n+\n+  if (context.constraints[\"domain\"].exists(EQUALS)) {\n+    // If a specific domain is requested, speed up the set of type conversions.\n+    auto domains = context.constraints[\"domain\"].getAll(EQUALS);\n+    app_map = (CFArrayRef)CFArrayCreateMutable(\n+        kCFAllocatorDefault, domains.size(), &kCFTypeArrayCallBacks);\n+    for (const auto& domain : domains) {\n+      auto cf_domain = CFStringCreateWithCString(kCFAllocatorDefault,\n+                                                 domain.c_str(),\n+                                                 kCFStringEncodingASCII);\n+      CFArrayAppendValue((CFMutableArrayRef)app_map, cf_domain);\n+      CFRelease(cf_domain);\n+    }\n+  } \n+\n+  if (app_map == nullptr) {","path":"osquery/tables/system/darwin/authdb.mm","position":43,"original_position":43,"commit_id":"067ae60367d81483eeb8f4bdce7a0853ca0e7c7e","original_commit_id":"067ae60367d81483eeb8f4bdce7a0853ca0e7c7e","user":{"login":"marpaia","id":927168,"avatar_url":"https://avatars.githubusercontent.com/u/927168?v=3","gravatar_id":"","url":"https://api.github.com/users/marpaia","html_url":"https://github.com/marpaia","followers_url":"https://api.github.com/users/marpaia/followers","following_url":"https://api.github.com/users/marpaia/following{/other_user}","gists_url":"https://api.github.com/users/marpaia/gists{/gist_id}","starred_url":"https://api.github.com/users/marpaia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marpaia/subscriptions","organizations_url":"https://api.github.com/users/marpaia/orgs","repos_url":"https://api.github.com/users/marpaia/repos","events_url":"https://api.github.com/users/marpaia/events{/privacy}","received_events_url":"https://api.github.com/users/marpaia/received_events","type":"User","site_admin":false},"body":"You don't want to support someone doing `select * from authdb`?","created_at":"2015-07-10T16:08:33Z","updated_at":"2015-07-10T16:08:33Z","html_url":"https://github.com/facebook/osquery/pull/1318#discussion_r34369539","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/1318","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/34369539"},"html":{"href":"https://github.com/facebook/osquery/pull/1318#discussion_r34369539"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1318"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1318","id":39686669,"html_url":"https://github.com/facebook/osquery/pull/1318","diff_url":"https://github.com/facebook/osquery/pull/1318.diff","patch_url":"https://github.com/facebook/osquery/pull/1318.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1318","number":1318,"state":"open","locked":false,"title":"Added authdb table","user":{"login":"tburgin","id":2117646,"avatar_url":"https://avatars.githubusercontent.com/u/2117646?v=3","gravatar_id":"","url":"https://api.github.com/users/tburgin","html_url":"https://github.com/tburgin","followers_url":"https://api.github.com/users/tburgin/followers","following_url":"https://api.github.com/users/tburgin/following{/other_user}","gists_url":"https://api.github.com/users/tburgin/gists{/gist_id}","starred_url":"https://api.github.com/users/tburgin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tburgin/subscriptions","organizations_url":"https://api.github.com/users/tburgin/orgs","repos_url":"https://api.github.com/users/tburgin/repos","events_url":"https://api.github.com/users/tburgin/events{/privacy}","received_events_url":"https://api.github.com/users/tburgin/received_events","type":"User","site_admin":false},"body":"Adding an `authdb` table. This utilizes the `AuthorizationRightGet` function from the Security Framework.\r\n\r\n","created_at":"2015-07-10T14:05:54Z","updated_at":"2015-07-10T16:08:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"33d94b8b62d8a0f3cca295701ed9d7c6217470d1","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/1318/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/1318/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1318/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/067ae60367d81483eeb8f4bdce7a0853ca0e7c7e","head":{"label":"tburgin:master","ref":"master","sha":"067ae60367d81483eeb8f4bdce7a0853ca0e7c7e","user":{"login":"tburgin","id":2117646,"avatar_url":"https://avatars.githubusercontent.com/u/2117646?v=3","gravatar_id":"","url":"https://api.github.com/users/tburgin","html_url":"https://github.com/tburgin","followers_url":"https://api.github.com/users/tburgin/followers","following_url":"https://api.github.com/users/tburgin/following{/other_user}","gists_url":"https://api.github.com/users/tburgin/gists{/gist_id}","starred_url":"https://api.github.com/users/tburgin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tburgin/subscriptions","organizations_url":"https://api.github.com/users/tburgin/orgs","repos_url":"https://api.github.com/users/tburgin/repos","events_url":"https://api.github.com/users/tburgin/events{/privacy}","received_events_url":"https://api.github.com/users/tburgin/received_events","type":"User","site_admin":false},"repo":{"id":38882150,"name":"osquery","full_name":"tburgin/osquery","owner":{"login":"tburgin","id":2117646,"avatar_url":"https://avatars.githubusercontent.com/u/2117646?v=3","gravatar_id":"","url":"https://api.github.com/users/tburgin","html_url":"https://github.com/tburgin","followers_url":"https://api.github.com/users/tburgin/followers","following_url":"https://api.github.com/users/tburgin/following{/other_user}","gists_url":"https://api.github.com/users/tburgin/gists{/gist_id}","starred_url":"https://api.github.com/users/tburgin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tburgin/subscriptions","organizations_url":"https://api.github.com/users/tburgin/orgs","repos_url":"https://api.github.com/users/tburgin/repos","events_url":"https://api.github.com/users/tburgin/events{/privacy}","received_events_url":"https://api.github.com/users/tburgin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/tburgin/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/tburgin/osquery","forks_url":"https://api.github.com/repos/tburgin/osquery/forks","keys_url":"https://api.github.com/repos/tburgin/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tburgin/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tburgin/osquery/teams","hooks_url":"https://api.github.com/repos/tburgin/osquery/hooks","issue_events_url":"https://api.github.com/repos/tburgin/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/tburgin/osquery/events","assignees_url":"https://api.github.com/repos/tburgin/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/tburgin/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/tburgin/osquery/tags","blobs_url":"https://api.github.com/repos/tburgin/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tburgin/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tburgin/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/tburgin/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tburgin/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/tburgin/osquery/languages","stargazers_url":"https://api.github.com/repos/tburgin/osquery/stargazers","contributors_url":"https://api.github.com/repos/tburgin/osquery/contributors","subscribers_url":"https://api.github.com/repos/tburgin/osquery/subscribers","subscription_url":"https://api.github.com/repos/tburgin/osquery/subscription","commits_url":"https://api.github.com/repos/tburgin/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/tburgin/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/tburgin/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/tburgin/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/tburgin/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/tburgin/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tburgin/osquery/merges","archive_url":"https://api.github.com/repos/tburgin/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tburgin/osquery/downloads","issues_url":"https://api.github.com/repos/tburgin/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/tburgin/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/tburgin/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/tburgin/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tburgin/osquery/labels{/name}","releases_url":"https://api.github.com/repos/tburgin/osquery/releases{/id}","created_at":"2015-07-10T13:35:34Z","updated_at":"2015-07-10T13:35:35Z","pushed_at":"2015-07-10T13:47:37Z","git_url":"git://github.com/tburgin/osquery.git","ssh_url":"git@github.com:tburgin/osquery.git","clone_url":"https://github.com/tburgin/osquery.git","svn_url":"https://github.com/tburgin/osquery","homepage":"https://osquery.io","size":14302,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"370290d1030b4ad20d26aae82a0f0318879b0851","user":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","created_at":"2014-07-29T20:27:33Z","updated_at":"2015-07-10T14:05:04Z","pushed_at":"2015-07-10T14:05:54Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":14302,"stargazers_count":4548,"watchers_count":4548,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":376,"mirror_url":null,"open_issues_count":29,"forks":376,"open_issues":29,"watchers":4548,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1318"},"html":{"href":"https://github.com/facebook/osquery/pull/1318"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/1318"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/1318/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1318/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1318/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/067ae60367d81483eeb8f4bdce7a0853ca0e7c7e"}}}}