authdb

The macOS authorizationdb is used by Mac admins to give their users or themselves granular permissions on the Macs they manage. The authdb osquery table returns JSON output for the authorizationdb read <right_name> command.

Example

The “right_name” string system.login.console is used in the mandatory WHERE clause for this table:

SELECT * FROM authdb WHERE right_name='system.login.console';

Notes

This table is from the Mac Admins osquery extension.

The authorizationdb is a SQLite database that can be dumped out with the following Terminal command:

sudo /usr/bin/sqlite3 /var/db/auth.db .dump

The following command generates a .plist showing the attributes of the authorizationdb configuration:

security authorizationdb read system.login.console

• Apple documentation
• A general purpose authorizationdb article
• Armin Briegel (Scripting OS X) on the macOS root user and the authorizationdb
• Elliot Jordan on using the authorizationdb in his tool Escrow Buddy