New fleetd table apfs_crypto_users

[kc9wwh]

Related issue: Resolves #50524

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes. See Changes files for more information.
• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.
• Timeouts are implemented and retries are limited to avoid infinite loops

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.33%. Comparing base (fc35085) to head (9a9c454).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50763      +/-   ##
==========================================
- Coverage   68.40%   68.33%   -0.07%     
==========================================
  Files        3964     3956       -8     
  Lines      255176   254800     -376     
  Branches    13457    13465       +8     
==========================================
- Hits       174560   174127     -433     
- Misses      65018    65078      +60     
+ Partials    15598    15595       -3     

Flag	Coverage Δ
backend	69.61% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kc9wwh]

└ $ diskutil apfs listCryptoUsers -plist /System/Volumes/Data

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Users</key>
	<array>
		<dict>
			<key>APFSCryptoUserType</key>
			<string>LocalOpenDirectory</string>
			<key>APFSCryptoUserUUID</key>
			<string>3C7DB8EE-5EA4-4C18-A7E4-25C6C0F94667</string>
			<key>VolumeOwner</key>
			<true/>
		</dict>
		<dict>
			<key>APFSCryptoUserType</key>
			<string>PersonalRecovery</string>
			<key>APFSCryptoUserUUID</key>
			<string>EBC6C064-0000-11AA-AA11-00306543ECAC</string>
			<key>VolumeOwner</key>
			<true/>
		</dict>
		<dict>
			<key>APFSCryptoUserType</key>
			<string>MDMRecovery</string>
			<key>APFSCryptoUserUUID</key>
			<string>2457711A-523C-4604-B75A-F48A571D5036</string>
			<key>VolumeOwner</key>
			<true/>
		</dict>
	</array>
</dict>
</plist>

└ $ mkdir -p /tmp/apfscheck
cat > /tmp/apfscheck/main.go <<'EOF'
package main

import (
        "context"
        "encoding/json"
        "fmt"

        "github.com/fleetdm/fleet/v4/orbit/pkg/table/diskutil/apfs"
        "github.com/osquery/osquery-go/plugin/table"
)

func main() {
        rows, err := apfs.CryptoUsersGenerate(context.Background(), table.QueryContext{})
        if err != nil {
                fmt.Println("ERROR:", err)
                return
        }
        b, _ := json.MarshalIndent(rows, "", "  ")
        fmt.Printf("rows=%d\n%s\n", len(rows), b)
}
EOF
go run /tmp/apfscheck/main.go
rows=3
[
  {
    "crypto_user_uuid": "3C7DB8EE-5EA4-4C18-A7E4-25C6C0F94667",
    "device_identifier": "disk3s5",
    "type": "LocalOpenDirectory",
    "volume_owner": "1",
    "volume_uuid": "48F75028-214A-4831-8C0B-5F6927F21742"
  },
  {
    "crypto_user_uuid": "EBC6C064-0000-11AA-AA11-00306543ECAC",
    "device_identifier": "disk3s5",
    "type": "PersonalRecovery",
    "volume_owner": "1",
    "volume_uuid": "48F75028-214A-4831-8C0B-5F6927F21742"
  },
  {
    "crypto_user_uuid": "2457711A-523C-4604-B75A-F48A571D5036",
    "device_identifier": "disk3s5",
    "type": "MDMRecovery",
    "volume_owner": "1",
    "volume_uuid": "48F75028-214A-4831-8C0B-5F6927F21742"
  }
]