✨ Add macOS FileVault, Gatekeeper, and SIP resources

providers/os/resources/macos_filevault.go

@@ -0,0 +1,47 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package resources
+
+import (
+	"io"
+	"strings"
+
+	"go.mondoo.com/mql/v13/providers/os/connection/shared"
+)
+
+func (m *mqlMacosFilevault) status() (string, error) {
+	conn := m.MqlRuntime.Connection.(shared.Connection)
+
+	cmd, err := conn.RunCommand("fdesetup status")
+	if err != nil {
+		return "", err
+	}
+
+	data, err := io.ReadAll(cmd.Stdout)
+	if err != nil {
+		return "", err
+	}
+
+	// fdesetup status outputs lines like:
+	// "FileVault is On."
+	// "FileVault is Off."
+	// "Encryption in progress: Percent completed = 50.0"
+	// "Decryption in progress: Percent completed = 50.0"
+	output := strings.TrimSpace(string(data))
+
+	// Return the first line which contains the primary status
+	lines := strings.SplitN(output, "\n", 2)
+	return strings.TrimSpace(lines[0]), nil
+}
+
+func (m *mqlMacosFilevault) enabled() (bool, error) {
+	status, err := m.status()
+	if err != nil {
+		return false, err
+	}
+
+	// FileVault is considered enabled if it's on or encryption is in progress
+	return strings.Contains(status, "FileVault is On") ||
+		strings.Contains(status, "Encryption in progress"), nil
+}

providers/os/resources/macos_gatekeeper.go

@@ -0,0 +1,39 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package resources
+
+import (
+	"io"
+	"strings"
+
+	"go.mondoo.com/mql/v13/providers/os/connection/shared"
+)
+
+func (m *mqlMacosGatekeeper) status() (string, error) {
+	conn := m.MqlRuntime.Connection.(shared.Connection)
+
+	cmd, err := conn.RunCommand("spctl --status")
+	if err != nil {
+		return "", err
+	}
+
+	data, err := io.ReadAll(cmd.Stdout)
+	if err != nil {
+		return "", err
+	}
+
+	// spctl --status outputs:
+	// "assessments enabled" (Gatekeeper on)
+	// "assessments disabled" (Gatekeeper off)
+	return strings.TrimSpace(string(data)), nil
+}
+
+func (m *mqlMacosGatekeeper) enabled() (bool, error) {
+	status, err := m.status()
+	if err != nil {
+		return false, err
+	}
+
+	return strings.Contains(status, "assessments enabled"), nil
+}

providers/os/resources/macos_sip.go

@@ -0,0 +1,44 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package resources
+
+import (
+	"io"
+	"strings"
+
+	"go.mondoo.com/mql/v13/providers/os/connection/shared"
+)
+
+func (m *mqlMacosSip) status() (string, error) {
+	conn := m.MqlRuntime.Connection.(shared.Connection)
+
+	cmd, err := conn.RunCommand("csrutil status")
+	if err != nil {
+		return "", err
+	}
+
+	data, err := io.ReadAll(cmd.Stdout)
+	if err != nil {
+		return "", err
+	}
+
+	// csrutil status outputs:
+	// "System Integrity Protection status: enabled."
+	// "System Integrity Protection status: disabled."
+	// May also include individual configuration flags on separate lines
+	output := strings.TrimSpace(string(data))
+
+	// Return the first line which contains the primary status
+	lines := strings.SplitN(output, "\n", 2)
+	return strings.TrimSpace(lines[0]), nil
+}
+
+func (m *mqlMacosSip) enabled() (bool, error) {
+	status, err := m.status()
+	if err != nil {
+		return false, err
+	}
+
+	return strings.Contains(status, "enabled"), nil
+}

providers/os/resources/os.lr

@@ -2263,6 +2263,30 @@
   state int
 }
 
+// macOS FileVault full-disk encryption
+macos.filevault @defaults("enabled status") {
+  // Whether FileVault is enabled
+  enabled() bool
+  // FileVault status (On, Off, Encryption in progress, Decryption in progress)
+  status() string
+}
+
+// macOS Gatekeeper application execution policy
+macos.gatekeeper @defaults("enabled") {
+  // Whether Gatekeeper assessments are enabled
+  enabled() bool
+  // Gatekeeper assessment status (assessments enabled, assessments disabled)
+  status() string
+}
+
+// macOS System Integrity Protection (SIP)
+macos.sip @defaults("enabled") {
+  // Whether System Integrity Protection is enabled
+  enabled() bool
+  // SIP status message
+  status() string
+}
+
 // macOS Time Machine
 macos.timemachine {
   // macOS Time Machine preferences