Fleet uses incorrect bundle identifier for XCreds.pkg for automatic install policies

[ddribeiro]

Fleet versions

• Discovered: 4.84.2
• Reproduced: 4.84.3

Web browser and operating system: N/A

---

💥  Actual behavior

A Fleet premium customer from the community is using Fleet to deploy XCreds. They uploaded the XCreds.pkg as a custom package to their Fleet server and used the "Automatic deploy" option.

The policy that Fleet created used an incorrect bundle identifier, which would always cause the generated policy to fail. It would never pass, even after the software has correctly been installed. Here is the policy that Fleet generates:
SELECT 1 FROM apps WHERE bundle_identifier = 'com.twocanoes.pkg.secureremoteaccess';

But the CFBundleIdentifier from XCred's Info.plist file is com.twocanoes.xcreds, which is what osquery reads from.

🛠️ Expected behavior

The identifier that Fleet uses in the automatically generated policy should match the identifier that osquery reports for in the bundle_identifier column in the apps table.

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Obtain the XCreds installer from the Twocanoes website.
2. Upload XCreds.pkg to your Fleet server and make sure the "Deploy" toggle is enabled, so Fleet will automatically generate an install policy for the software.
3. Observe the Fleet generated policy uses com.twocanoes.pkg.secureremoteaccess.
4. Install XCreds on your test system. Run SELECT bundle_identifier FROM apps; on your test system. Observe the osquery reported bundle_identifier is com.twocanoes.xcreds

🕯️ More info (optional)

This is because Fleet is using 2 different namespaces to generate the policy and detect when it's installed. Upon upload, Fleet is checking the pkg install identifier from pkgbuild --identifier but osquery is using the CFBundleIdentifier from Info.plist. These namespaces are often the same, but not guaranteed to be.

[marko-lisica]

Hey @allenhouchins, I'm wondering if it would be possible to add XCreds as a Fleet-maintained app using custom tap?

I believe it will be easier to add it as FMA than to create an override for metadata extraction logic in the product.

I just checked, and this package contains another package, which is why Fleet extracts the wrong bundle ID.

[allenhouchins]

@marko-lisica working on that here: #45404

[marko-lisica]

@noahtalerman @ddribeiro, I think we can close this bug when @allenhouchins merges his PR.