Add touchid_system_config and touchid_user_config tables

BUILD.bazel

@@ -55,6 +55,7 @@ go_library(
         "//tables/socpower",
         "//tables/sofa",
         "//tables/thermalthrottling",
+        "//tables/touchid",
         "//tables/unifiedlog",
         "//tables/wifi_network",
         "@com_github_osquery_osquery_go//:osquery-go",

README.md

@@ -37,6 +37,8 @@ For production deployment, you should refer to the [osquery documentation](https
 | `puppet_state`               | State of every resource [Puppet](https://puppetlabs.com) is managing                          | Linux / macOS / Windows |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `sofa_security_release_info` | The information on the security release the device is running from [Sofa](https://sofa.macadmins.io) | macOS                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                       Use the `url` constraint to specify a data source other than `https://sofafeed.macadmins.io/v1/macos_data_feed.json` . By default this table will return vulnerability data for the running operating system. For historical data, use the `os_version` predicate (e.g `select * from sofa_security_release_info where os_version="14.4.0";`)                                                                                                                                                                                                                                                          |
 | `sofa_unpatched_cves`        | The CVEs that are unpatched on the device from [Sofa](https://sofa.macadmins.io) | macOS                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                       Use the `url` constraint to specify a data source other than `https://sofafeed.macadmins.io/v1/macos_data_feed.json`. By default this table will return all unpatched vulnerability data. For historical data, use the `os_version` predicate (e.g `select * from sofa_unpatched_cves where os_version="14.4.0";`)                                                                                                                                                               |
+| `touchid_system_config`      | Machine-wide Touch ID / Secure Enclave posture (`touchid_compatible`, `secure_enclave`, `touchid_enabled`, `touchid_unlock`) plus `touchid_builtin` (a built-in Touch ID sensor exists — laptops) and `touchid_sensor_present` (a usable sensor exists: built-in OR an attached Magic Keyboard with Touch ID). From `bioutil` and `ioreg`. | macOS | Apple Silicon only. `touchid_compatible`/`touchid_enabled` are `1` on every Apple Silicon Mac (the Secure Enclave is on-die), so use `touchid_sensor_present` to tell a Mac that can actually enroll a fingerprint from a keyboard-less Mac mini/Studio. The accessory half of `touchid_sensor_present` is a live signal — a disconnected Touch ID keyboard reads `0`. |
+| `touchid_user_config`        | Per-user Touch ID configuration and enrolled fingerprint count (`uid`, `fingerprints_registered`, `touchid_unlock`, `touchid_applepay`, `effective_unlock`, `effective_applepay`). From `bioutil`. | macOS | Apple Silicon only. Without a `WHERE uid =` constraint, returns a row per real local account. `fingerprints_registered` needs root (reads all users via `bioutil -c -s`); the config flags need the user logged in (`bioutil -r` via `launchctl asuser`) and are left empty (NULL) when unavailable rather than `0`. On a Mac with no usable Touch ID sensor (`touchid_system_config.touchid_sensor_present = 0`) this table returns no rows at all, since there is no per-user Touch ID configuration to report. |
 | `unified_log`                | Results from macOS' Unified Log                                                               | macOS                   | Use the constraints `predicate` and `last` to limit the number of results you pull, or this will not be very performant at all. Use `level` with a value of `info` to include info level messages. Use `level` with a value of `debug` to include info and debug level messages. (`select * from unified_log where last="1h" and level="debug" and predicate='processImagePath contains "mdmclient"';`)                                                                                                                                                                                                               |
 | `wifi_network`               | Table to get the current wifi network name since the Osquery `wifi_info` table no longer does this. Includes the rest of the working fields in `wifi_info`. | macOS                   | See [osquery issue #8220](https://github.com/osquery/osquery/issues/8220) |
 

VERSION

@@ -1 +1 @@
-1.4.1
+1.5.0

main.go

@@ -24,6 +24,7 @@ import (
 	"github.com/macadmins/osquery-extension/tables/socpower"
 	"github.com/macadmins/osquery-extension/tables/sofa"
 	"github.com/macadmins/osquery-extension/tables/thermalthrottling"
+	"github.com/macadmins/osquery-extension/tables/touchid"
 	"github.com/macadmins/osquery-extension/tables/unifiedlog"
 	"github.com/macadmins/osquery-extension/tables/wifi_network"
 
@@ -127,6 +128,8 @@ func main() {
 			),
 			table.NewPlugin("macos_thermal_pressure", thermalthrottling.ThermalPressureColumns(), thermalthrottling.ThermalPressureGenerate),
 			table.NewPlugin("macos_soc_power", socpower.SocPowerColumns(), socpower.SocPowerGenerate),
+			table.NewPlugin("touchid_system_config", touchid.TouchIDSystemConfigColumns(), touchid.TouchIDSystemConfigGenerate),
+			table.NewPlugin("touchid_user_config", touchid.TouchIDUserConfigColumns(), touchid.TouchIDUserConfigGenerate),
 		}
 		plugins = append(plugins, darwinPlugins...)
 	}

tables/touchid/BUILD.bazel

@@ -0,0 +1,25 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "touchid",
+    srcs = ["touchid.go"],
+    importpath = "github.com/macadmins/osquery-extension/tables/touchid",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/utils",
+        "@com_github_micromdm_plist//:plist",
+        "@com_github_osquery_osquery_go//plugin/table",
+    ],
+)
+
+go_test(
+    name = "touchid_test",
+    srcs = ["touchid_test.go"],
+    embed = [":touchid"],
+    deps = [
+        "//pkg/utils",
+        "@com_github_osquery_osquery_go//plugin/table",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)