Secure Token user list for munkireport

secure_token_list.py

#!/usr/bin/python

"""
Devtools for munkireport.
Will return array of strings of users with Secure Tokens
"""

import subprocess
import os
import plistlib
import sys

def isAPFS():
    '''Returns the boolean. True if APFS, False if not.'''
    cmd = ['/usr/sbin/diskutil', 'apfs', 'list', '/']
    proc = subprocess.Popen(cmd, shell=False, bufsize=-1,
                            stdin=subprocess.PIPE,
                            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    (output, unused_error) = proc.communicate()
    
    if 'No APFS Containers found' in output:
        return False
    
    return True

def get_crypto_users():
    '''Return list of UUIDs of all crypto users'''
    cmd = ['/usr/sbin/diskutil', 'apfs', 'listUsers', '/', '-plist']
    proc = subprocess.Popen(cmd, shell=False, bufsize=-1,
                            stdin=subprocess.PIPE,
                            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    (output, unused_error) = proc.communicate()

    user_list = []
    try:
        plist = plistlib.readPlistFromString(output)
        # system_profiler xml is an array
        user_dict = plist['Users']
        for pair in user_dict:
            for k, v in pair.items():
                if k in 'APFSCryptoUserUUID':
                    user_list.append(v)        
        return user_list
    except Exception:
        return {}

def translate_uuid_to_username(uuid_list):
    '''Translate list of UUIDs to usernames.'''
    
    translated_uuid = []
    for uuid in uuid_list:
        cmd1 = ['/usr/bin/dscl', '.', '-search', '/Users', 'GeneratedUID', uuid]
        cmd2 = ['awk', '/GeneratedUID/ {print $1}']
        proc1 = subprocess.Popen(cmd1, shell=False, bufsize=-1,
                                stdin=subprocess.PIPE,
                                stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        proc2 = subprocess.Popen(cmd2, stdin=proc1.stdout, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        proc1.stdout.close()
        (output, unused_error) = proc2.communicate()
        
        if output:
            translated_uuid.append(output.strip())
        
    return translated_uuid
    
def main():
    """Main"""
    # Skip manual check
    if len(sys.argv) > 1:
        if sys.argv[1] == 'manualcheck':
            print 'Manual check: skipping'
            exit(0)
    
    # Check if APFS -- skip if not since SecureTokens are only for APFS       
    if not isAPFS():
        print 'Skipping Secure Token check -- filesystem is not APFS'
        exit(0)
    
    # Create cache dir if it does not exist
    cachedir = '%s/cache' % os.path.dirname(os.path.realpath(__file__))
    if not os.path.exists(cachedir):
        os.makedirs(cachedir)

    # Get results
    result = dict()
    uuids = get_crypto_users()
    usernames = translate_uuid_to_username(uuids)
    if len(usernames):
    	result['secure_token_users'] = usernames
    
    # Write Secure Token results to cache
    output_plist = os.path.join(cachedir, 'secure_token.plist')
    plistlib.writePlist(result, output_plist)

if __name__ == "__main__":
    main()